| Message ID | 20241101091507.3644584-1-shaojijie@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: hns3: fix kernel crash when uninstalling driver | expand |
On Fri, Nov 01, 2024 at 05:15:07PM +0800, Jijie Shao wrote: > From: Peiyang Wang <wangpeiyang1@huawei.com> > > When the driver is uninstalled and the VF is disabled concurrently, a > kernel crash occurs. The reason is that the two actions call function > pci_disable_sriov(). The num_VFs is checked to determine whether to > release the corresponding resources. During the second calling, num_VFs > is not 0 and the resource release function is called. However, the > corresponding resource has been released during the first invoking. > Therefore, the problem occurs: > > [15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 > ... > [15278.131557][T50670] Call trace: > [15278.134686][T50670] klist_put+0x28/0x12c > [15278.138682][T50670] klist_del+0x14/0x20 > [15278.142592][T50670] device_del+0xbc/0x3c0 > [15278.146676][T50670] pci_remove_bus_device+0x84/0x120 > [15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80 > [15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c > [15278.162485][T50670] sriov_disable+0x50/0x11c > [15278.166829][T50670] pci_disable_sriov+0x24/0x30 > [15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3] > [15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge] > [15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230 > [15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30 > [15278.193848][T50670] invoke_syscall+0x50/0x11c > [15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164 > [15278.203837][T50670] do_el0_svc+0x34/0xcc > [15278.207834][T50670] el0_svc+0x20/0x30 > > For details, see the following figure. > > rmmod hclge disable VFs > ---------------------------------------------------- > hclge_exit() sriov_numvfs_store() > ... device_lock() > pci_disable_sriov() hns3_pci_sriov_configure() > pci_disable_sriov() > sriov_disable() > sriov_disable() if !num_VFs : > if !num_VFs : return; > return; sriov_del_vfs() > sriov_del_vfs() ... > ... klist_put() > klist_put() ... > ... num_VFs = 0; > num_VFs = 0; device_unlock(); > > In this patch, when driver is removing, we get the device_lock() > to protect num_VFs, just like sriov_numvfs_store(). > > Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer") > Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com> > Signed-off-by: Jijie Shao <shaojijie@huawei.com> Reviewed-by: Simon Horman <horms@kernel.org>
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c index 67b0bf310daa..9a63fbc69408 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c @@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo) pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev); if (!pci_id) continue; - if (IS_ENABLED(CONFIG_PCI_IOV)) + if (IS_ENABLED(CONFIG_PCI_IOV)) { + device_lock(&ae_dev->pdev->dev); pci_disable_sriov(ae_dev->pdev); + device_unlock(&ae_dev->pdev->dev); + } } } EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);