From: Tony Nguyen <anthony.l.nguyen@intel.com>
To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com
Cc: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>,
netdev@vger.kernel.org, anthony.l.nguyen@intel.com,
sassmann@redhat.com, Dan Carpenter <dan.carpenter@oracle.com>,
Mateusz Palczewski <mateusz.palczewski@intel.com>,
Konrad Jankowski <konrad0.jankowski@intel.com>
Subject: [PATCH net 3/3] iavf: Fix double free in iavf_reset_task
Date: Tue, 15 Mar 2022 14:12:25 -0700 [thread overview]
Message-ID: <20220315211225.2923496-4-anthony.l.nguyen@intel.com> (raw)
In-Reply-To: <20220315211225.2923496-1-anthony.l.nguyen@intel.com>
From: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Fix double free possibility in iavf_disable_vf, as crit_lock is
freed in caller, iavf_reset_task. Add kernel-doc for iavf_disable_vf.
Remove mutex_unlock in iavf_disable_vf.
Without this patch there is double free scenario, when calling
iavf_reset_task.
Fixes: e85ff9c631e1 ("iavf: Fix deadlock in iavf_reset_task")
Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/iavf/iavf_main.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index 8e644e9ed8da..45570e3f782e 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -2541,6 +2541,13 @@ static void iavf_watchdog_task(struct work_struct *work)
queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2);
}
+/**
+ * iavf_disable_vf - disable VF
+ * @adapter: board private structure
+ *
+ * Set communication failed flag and free all resources.
+ * NOTE: This function is expected to be called with crit_lock being held.
+ **/
static void iavf_disable_vf(struct iavf_adapter *adapter)
{
struct iavf_mac_filter *f, *ftmp;
@@ -2595,7 +2602,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter)
memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE);
iavf_shutdown_adminq(&adapter->hw);
adapter->netdev->flags &= ~IFF_UP;
- mutex_unlock(&adapter->crit_lock);
adapter->flags &= ~IAVF_FLAG_RESET_PENDING;
iavf_change_state(adapter, __IAVF_DOWN);
wake_up(&adapter->down_waitqueue);
--
2.31.1
next prev parent reply other threads:[~2022-03-15 21:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-15 21:12 [PATCH net 0/3][pull request] Intel Wired LAN Driver Updates 2022-03-15 Tony Nguyen
2022-03-15 21:12 ` [PATCH net 1/3] ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats() Tony Nguyen
2022-03-16 3:29 ` Jakub Kicinski
2022-03-16 19:00 ` Nguyen, Anthony L
2022-03-16 20:24 ` Alexander Duyck
2022-03-16 20:46 ` Tony Nguyen
2022-03-15 21:12 ` [PATCH net 2/3] ice: destroy flow director filter mutex after releasing VSIs Tony Nguyen
2022-03-16 3:32 ` Jakub Kicinski
2022-03-16 18:45 ` Tony Nguyen
2022-03-15 21:12 ` Tony Nguyen [this message]
2022-03-16 3:30 ` [PATCH net 3/3] iavf: Fix double free in iavf_reset_task Jakub Kicinski
2022-03-16 18:46 ` Tony Nguyen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220315211225.2923496-4-anthony.l.nguyen@intel.com \
--to=anthony.l.nguyen@intel.com \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=konrad0.jankowski@intel.com \
--cc=kuba@kernel.org \
--cc=mateusz.palczewski@intel.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=przemyslawx.patynowski@intel.com \
--cc=sassmann@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.