From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7151C4363D for ; Fri, 25 Sep 2020 12:52:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 72D9B21741 for ; Fri, 25 Sep 2020 12:52:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038375; bh=RnSiq0cNVDO4LQGLwpxpSIalJIe6dLxD9UaNZfL6S5M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=w7LDZn2cSA9Ecy6k4O+APKjTmD47QhxZpraZ6jNkPcEW2oM24urDQ7CyOOSH3+Fcd AmgiMejYEfYjAojsF+Ii12ChhlR9UJ6fz1qGisy/0s9AsR3Yc81xAOUtK/CvIusM60 +aRaCqEJMzCNb8blEoijsIO/YueTOokkPTZVluow= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728969AbgIYMwy (ORCPT ); Fri, 25 Sep 2020 08:52:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:57728 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728836AbgIYMwu (ORCPT ); Fri, 25 Sep 2020 08:52:50 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 59D1A2072E; Fri, 25 Sep 2020 12:52:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038368; bh=RnSiq0cNVDO4LQGLwpxpSIalJIe6dLxD9UaNZfL6S5M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hy/t1MX3wQeIEdm1hEos7COHX5JmGE/BJneXX7DH91CZw95qk0Bqqu0pxKNphH5xp rEfjCRJUo+GOjt2V5MTTZKF5MGoL+TwDkKo6BaA09+t0gBJZ5/o8Fy5W7i9PMuEaAD td0LykNYso71sylIQy9ha3EYteZXe6DLiGPn3eOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Edwin Peer , Vasundhara Volam , Michael Chan , Jakub Kicinski Subject: [PATCH 5.4 08/43] bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() Date: Fri, 25 Sep 2020 14:48:20 +0200 Message-Id: <20200925124724.804801430@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200925124723.575329814@linuxfoundation.org> References: <20200925124723.575329814@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Vasundhara Volam [ Upstream commit b16939b59cc00231a75d224fd058d22c9d064976 ] bnxt_fw_reset_task() which runs from a workqueue can race with bnxt_remove_one(). For example, if firmware reset and VF FLR are happening at about the same time. bnxt_remove_one() already cancels the workqueue and waits for it to finish, but we need to do this earlier before the devlink reporters are destroyed. This will guarantee that the devlink reporters will always be valid when bnxt_fw_reset_task() is still running. Fixes: b148bb238c02 ("bnxt_en: Fix possible crash in bnxt_fw_reset_task().") Reviewed-by: Edwin Peer Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -11385,14 +11385,15 @@ static void bnxt_remove_one(struct pci_d if (BNXT_PF(bp)) bnxt_sriov_disable(bp); + clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); + bnxt_cancel_sp_work(bp); + bp->sp_event = 0; + bnxt_dl_fw_reporters_destroy(bp, true); pci_disable_pcie_error_reporting(pdev); unregister_netdev(dev); bnxt_dl_unregister(bp); bnxt_shutdown_tc(bp); - clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); - bnxt_cancel_sp_work(bp); - bp->sp_event = 0; bnxt_clear_int_mode(bp); bnxt_hwrm_func_drv_unrgtr(bp);