[PATCH net 0/2] bnxt_en: 2 bug fixes

[PATCH net 0/2] bnxt_en: 2 bug fixes

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 475 bytes --]

This series fixes 2 issues:

1. A potential order-5 memory allocation failure during open.
2. Double memory free bug during shutdown.

Michael Chan (1):
  bnxt_en: Avoid order-5 memory allocation for TPA data

Selvin Xavier (1):
  bnxt_en: Fix the double free during device removal

 drivers/net/ethernet/broadcom/bnxt/bnxt.c     | 25 +++++++++----------
 drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c |  2 ++
 2 files changed, 14 insertions(+), 13 deletions(-)

-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4209 bytes --]

[PATCH net 1/2] bnxt_en: Avoid order-5 memory allocation for TPA data

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 3745 bytes --]

The driver needs to keep track of all the possible concurrent TPA (GRO/LRO)
completions on the aggregation ring.  On P5 chips, the maximum number
of concurrent TPA is 256 and the amount of memory we allocate is order-5
on systems using 4K pages.  Memory allocation failure has been reported:

NetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
CPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1
Hardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022
Call Trace:
 dump_stack+0x57/0x6e
 warn_alloc.cold.120+0x7b/0xdd
 ? _cond_resched+0x15/0x30
 ? __alloc_pages_direct_compact+0x15f/0x170
 __alloc_pages_slowpath.constprop.108+0xc58/0xc70
 __alloc_pages_nodemask+0x2d0/0x300
 kmalloc_order+0x24/0xe0
 kmalloc_order_trace+0x19/0x80
 bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en]
 ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en]
 __bnxt_open_nic+0x12e/0x780 [bnxt_en]
 bnxt_open+0x10b/0x240 [bnxt_en]
 __dev_open+0xe9/0x180
 __dev_change_flags+0x1af/0x220
 dev_change_flags+0x21/0x60
 do_setlink+0x35c/0x1100

Instead of allocating this big chunk of memory and dividing it up for the
concurrent TPA instances, allocate each small chunk separately for each
TPA instance.  This will reduce it to order-0 allocations.

Fixes: 79632e9ba386 ("bnxt_en: Expand bnxt_tpa_info struct to support 57500 chips.")
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 5d4b1f2ebeac..f96d539b469c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -3145,7 +3145,7 @@ static int bnxt_alloc_ring(struct bnxt *bp, struct bnxt_ring_mem_info *rmem)
 
 static void bnxt_free_tpa_info(struct bnxt *bp)
 {
-	int i;
+	int i, j;
 
 	for (i = 0; i < bp->rx_nr_rings; i++) {
 		struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
@@ -3153,8 +3153,10 @@ static void bnxt_free_tpa_info(struct bnxt *bp)
 		kfree(rxr->rx_tpa_idx_map);
 		rxr->rx_tpa_idx_map = NULL;
 		if (rxr->rx_tpa) {
-			kfree(rxr->rx_tpa[0].agg_arr);
-			rxr->rx_tpa[0].agg_arr = NULL;
+			for (j = 0; j < bp->max_tpa; j++) {
+				kfree(rxr->rx_tpa[j].agg_arr);
+				rxr->rx_tpa[j].agg_arr = NULL;
+			}
 		}
 		kfree(rxr->rx_tpa);
 		rxr->rx_tpa = NULL;
@@ -3163,14 +3165,13 @@ static void bnxt_free_tpa_info(struct bnxt *bp)
 
 static int bnxt_alloc_tpa_info(struct bnxt *bp)
 {
-	int i, j, total_aggs = 0;
+	int i, j;
 
 	bp->max_tpa = MAX_TPA;
 	if (bp->flags & BNXT_FLAG_CHIP_P5) {
 		if (!bp->max_tpa_v2)
 			return 0;
 		bp->max_tpa = max_t(u16, bp->max_tpa_v2, MAX_TPA_P5);
-		total_aggs = bp->max_tpa * MAX_SKB_FRAGS;
 	}
 
 	for (i = 0; i < bp->rx_nr_rings; i++) {
@@ -3184,12 +3185,12 @@ static int bnxt_alloc_tpa_info(struct bnxt *bp)
 
 		if (!(bp->flags & BNXT_FLAG_CHIP_P5))
 			continue;
-		agg = kcalloc(total_aggs, sizeof(*agg), GFP_KERNEL);
-		rxr->rx_tpa[0].agg_arr = agg;
-		if (!agg)
-			return -ENOMEM;
-		for (j = 1; j < bp->max_tpa; j++)
-			rxr->rx_tpa[j].agg_arr = agg + j * MAX_SKB_FRAGS;
+		for (j = 0; j < bp->max_tpa; j++) {
+			agg = kcalloc(MAX_SKB_FRAGS, sizeof(*agg), GFP_KERNEL);
+			if (!agg)
+				return -ENOMEM;
+			rxr->rx_tpa[j].agg_arr = agg;
+		}
 		rxr->rx_tpa_idx_map = kzalloc(sizeof(*rxr->rx_tpa_idx_map),
 					      GFP_KERNEL);
 		if (!rxr->rx_tpa_idx_map)
-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4209 bytes --]

[PATCH net 2/2] bnxt_en: Fix the double free during device removal

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 3940 bytes --]

From: Selvin Xavier <selvin.xavier@broadcom.com>

Following warning reported by KASAN during driver unload

==================================================================
BUG: KASAN: double-free in bnxt_remove_one+0x103/0x200 [bnxt_en]
Free of addr ffff88814e8dd4c0 by task rmmod/17469
CPU: 47 PID: 17469 Comm: rmmod Kdump: loaded Tainted: G S                 6.2.0-rc7+ #2
Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.3.10 08/15/2019
Call Trace:
 <TASK>
 dump_stack_lvl+0x33/0x46
 print_report+0x17b/0x4b3
 ? __call_rcu_common.constprop.79+0x27e/0x8c0
 ? __pfx_free_object_rcu+0x10/0x10
 ? __virt_addr_valid+0xe3/0x160
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 kasan_report_invalid_free+0x64/0xd0
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 __kasan_slab_free+0x179/0x1c0
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 __kmem_cache_free+0x194/0x350
 bnxt_remove_one+0x103/0x200 [bnxt_en]
 pci_device_remove+0x62/0x110
 device_release_driver_internal+0xf6/0x1c0
 driver_detach+0x76/0xe0
 bus_remove_driver+0x89/0x160
 pci_unregister_driver+0x26/0x110
 ? strncpy_from_user+0x188/0x1c0
 bnxt_exit+0xc/0x24 [bnxt_en]
 __x64_sys_delete_module+0x21f/0x390
 ? __pfx___x64_sys_delete_module+0x10/0x10
 ? __pfx_mem_cgroup_handle_over_high+0x10/0x10
 ? _raw_spin_lock+0x87/0xe0
 ? __pfx__raw_spin_lock+0x10/0x10
 ? __audit_syscall_entry+0x185/0x210
 ? ktime_get_coarse_real_ts64+0x51/0x80
 ? syscall_trace_enter.isra.18+0x126/0x1a0
 do_syscall_64+0x37/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7effcb6fd71b
Code: 73 01 c3 48 8b 0d 6d 17 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 17 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffeada270b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 00005623660e0750 RCX: 00007effcb6fd71b
RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005623660e07b8
RBP: 0000000000000000 R08: 00007ffeada26031 R09: 0000000000000000
R10: 00007effcb771280 R11: 0000000000000206 R12: 00007ffeada272e0
R13: 00007ffeada28bc4 R14: 00005623660e02a0 R15: 00005623660e0750
 </TASK>

Auxiliary device structures are freed in bnxt_aux_dev_release. So avoid
calling kfree from bnxt_remove_one.

Also, set bp->edev to NULL before freeing the auxilary private structure.

Fixes: d80d88b0dfff ("bnxt_en: Add auxiliary driver support")
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c     | 2 --
 drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index f96d539b469c..808236dc898b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -13205,8 +13205,6 @@ static void bnxt_remove_one(struct pci_dev *pdev)
 	bnxt_free_hwrm_resources(bp);
 	bnxt_ethtool_free(bp);
 	bnxt_dcb_free(bp);
-	kfree(bp->edev);
-	bp->edev = NULL;
 	kfree(bp->ptp_cfg);
 	bp->ptp_cfg = NULL;
 	kfree(bp->fw_health);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index d4cc9c371e7b..e7b5e28ee29f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -317,9 +317,11 @@ static void bnxt_aux_dev_release(struct device *dev)
 {
 	struct bnxt_aux_priv *aux_priv =
 		container_of(dev, struct bnxt_aux_priv, aux_dev.dev);
+	struct bnxt *bp = netdev_priv(aux_priv->edev->net);
 
 	ida_free(&bnxt_aux_dev_ids, aux_priv->id);
 	kfree(aux_priv->edev->ulp_tbl);
+	bp->edev = NULL;
 	kfree(aux_priv->edev);
 	kfree(aux_priv);
 }
-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4209 bytes --]

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri,  3 Mar 2023 18:43:56 -0800 you wrote:
> This series fixes 2 issues:
> 
> 1. A potential order-5 memory allocation failure during open.
> 2. Double memory free bug during shutdown.
> 
> Michael Chan (1):
>   bnxt_en: Avoid order-5 memory allocation for TPA data
> 
> [...]

Here is the summary with links:
  - [net,1/2] bnxt_en: Avoid order-5 memory allocation for TPA data
    https://git.kernel.org/netdev/net/c/accd7e23693a
  - [net,2/2] bnxt_en: Fix the double free during device removal
    https://git.kernel.org/netdev/net/c/89b59a84cb16

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Sun, 15 Aug 2021 16:15:35 -0400 you wrote:
> The first one disables aRFS/NTUPLE on an older broken firmware version.
> The second one adds missing memory barriers related to completion ring
> handling.
> 
> Michael Chan (2):
>   bnxt_en: Disable aRFS if running on 212 firmware
>   bnxt_en: Add missing DMA memory barriers
> 
> [...]

Here is the summary with links:
  - [net,1/2] bnxt_en: Disable aRFS if running on 212 firmware
    https://git.kernel.org/netdev/net/c/976e52b718c3
  - [net,2/2] bnxt_en: Add missing DMA memory barriers
    https://git.kernel.org/netdev/net/c/828affc27ed4

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH net 0/2] bnxt_en: 2 bug fixes

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 378 bytes --]

The first one disables aRFS/NTUPLE on an older broken firmware version.
The second one adds missing memory barriers related to completion ring
handling.

Michael Chan (2):
  bnxt_en: Disable aRFS if running on 212 firmware
  bnxt_en: Add missing DMA memory barriers

 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

-- 
2.18.1


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4209 bytes --]

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Sat, 15 May 2021 03:25:17 -0400 you wrote:
> The first one fixes a bug to properly identify some recently added HyperV
> device IDs.  The second one fixes device context memory set up on systems
> with 64K page size.
> 
> Please queue these for -stable as well.  Thanks.
> 
> Andy Gospodarek (1):
>   bnxt_en: Include new P5 HV definition in VF check.
> 
> [...]

Here is the summary with links:
  - [net,1/2] bnxt_en: Include new P5 HV definition in VF check.
    https://git.kernel.org/netdev/net/c/ab21494be9dc
  - [net,2/2] bnxt_en: Fix context memory setup for 64K page size.
    https://git.kernel.org/netdev/net/c/702279d2ce46

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

The first one fixes a bug to properly identify some recently added HyperV
device IDs.  The second one fixes device context memory set up on systems
with 64K page size.

Please queue these for -stable as well.  Thanks.

Andy Gospodarek (1):
  bnxt_en: Include new P5 HV definition in VF check.

Michael Chan (1):
  bnxt_en: Fix context memory setup for 64K page size.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +++---------
 drivers/net/ethernet/broadcom/bnxt/bnxt.h | 10 ++++++++++
 2 files changed, 13 insertions(+), 9 deletions(-)

-- 
2.18.1

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Thu, 11 Feb 2021 02:24:22 -0500 you wrote:
> Two unrelated fixes.  The first one fixes intermittent false TX timeouts
> during ring reconfigurations.  The second one fixes a formatting
> discrepancy between the stored and the running FW versions.
> 
> Please also queue these for -stable.  Thanks.
> 
> Edwin Peer (1):
>   bnxt_en: reverse order of TX disable and carrier off
> 
> [...]

Here is the summary with links:
  - [net,1/2] bnxt_en: reverse order of TX disable and carrier off
    https://git.kernel.org/netdev/net/c/132e0b65dc2b
  - [net,2/2] bnxt_en: Fix devlink info's stored fw.psid version format.
    https://git.kernel.org/netdev/net/c/db28b6c77f40

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

Two unrelated fixes.  The first one fixes intermittent false TX timeouts
during ring reconfigurations.  The second one fixes a formatting
discrepancy between the stored and the running FW versions.

Please also queue these for -stable.  Thanks.

Edwin Peer (1):
  bnxt_en: reverse order of TX disable and carrier off

Vasundhara Volam (1):
  bnxt_en: Fix devlink info's stored fw.psid version format.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c         | 3 ++-
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
2.18.1

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[David Miller]

From: Michael Chan <michael.chan@broadcom.com>
Date: Sun,  1 Mar 2020 22:07:16 -0500

> This first patch fixes a rare but possible crash in pci_disable_msix()
> when the MTU is changed.  The 2nd patch fixes a regression in error
> code handling when flashing a file to NVRAM.

Applied.

> Please also queue these for -stable.  Thanks.

Queued up, thanks Michael.

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

This first patch fixes a rare but possible crash in pci_disable_msix()
when the MTU is changed.  The 2nd patch fixes a regression in error
code handling when flashing a file to NVRAM.

Please also queue these for -stable.  Thanks.

Edwin Peer (1):
  bnxt_en: fix error handling when flashing from file

Vasundhara Volam (1):
  bnxt_en: reinitialize IRQs when MTU is modified

 drivers/net/ethernet/broadcom/bnxt/bnxt.c         |  4 ++--
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 24 +++++++++++------------
 2 files changed, 13 insertions(+), 15 deletions(-)

-- 
2.5.1

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[David Miller]

From: Michael Chan <michael.chan@broadcom.com>
Date: Mon,  8 Apr 2019 17:39:53 -0400

> The first patch prevents possible driver crash if we get a bad RX index
> from the hardware.  The second patch resets the device when the hardware
> reports buffer error to recover from the error.
> 
> Please queue these for -stable also.  Thanks.

Series applied and queued up for -stable, thanks.

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

The first patch prevents possible driver crash if we get a bad RX index
from the hardware.  The second patch resets the device when the hardware
reports buffer error to recover from the error.

Please queue these for -stable also.  Thanks.

Michael Chan (2):
  bnxt_en: Improve RX consumer index validity check.
  bnxt_en: Reset device on RX buffer errors.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

-- 
2.5.1

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[David Miller]

From: Michael Chan <michael.chan@broadcom.com>
Date: Fri, 11 Nov 2016 00:11:41 -0500

> Bug fixes in bnxt_setup_tc() and VF vitual link state.

Series applied, thanks Michael.

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

Bug fixes in bnxt_setup_tc() and VF vitual link state.

Michael Chan (2):
  bnxt_en: Fix ring arithmetic in bnxt_setup_tc().
  bnxt_en: Fix VF virtual link state.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c       | 11 ++++++-----
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c |  4 ++--
 2 files changed, 8 insertions(+), 7 deletions(-)

-- 
1.8.3.1

Re: [PATCH net 0/2] bnxt_en: 2 bug fixes.

[David Miller]

From: Michael Chan <michael.chan@broadcom.com>
Date: Wed,  4 May 2016 16:56:42 -0400

> Fix crash on ppc64 due to missing memory barrier and restore multicast
> after reset.

Looks good, series applied, thanks.

[PATCH net 0/2] bnxt_en: 2 bug fixes.

[Michael Chan]

Fix crash on ppc64 due to missing memory barrier and restore multicast
after reset.

Michael Chan (2):
  bnxt_en: Need memory barrier when processing the completion ring.
  bnxt_en: Setup multicast properly after resetting device.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

-- 
1.8.3.1