From patchwork Tue Mar 15 21:12:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tony Nguyen X-Patchwork-Id: 12781839 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E15C8C433FE for ; Tue, 15 Mar 2022 21:12:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351881AbiCOVNQ (ORCPT ); Tue, 15 Mar 2022 17:13:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351875AbiCOVNO (ORCPT ); Tue, 15 Mar 2022 17:13:14 -0400 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6B045B3D7 for ; Tue, 15 Mar 2022 14:12:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1647378721; x=1678914721; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=kp2m0YcIS3HNtMLjRIoXR1Nu5rcOmWYSxmnmsOsZQ6o=; b=gkOJqij++eGp1HpcRY1jcZtMZG/R4jcKh04b+/RPjftId0Bz05QCCYzD SfScdubTMGmGgRoCyPXeSpl2LMjIVHwANVUnSMs4YsgR92tnxd8Hq4w08 jVBLiU5Fr+UAgH2s+0/6IlcrK9Dia4GVsNV6N+Lz0Lv4PDM1gKmNwHmM1 QIGGaD5WEaocrxTwxiAUB8HTSJ5utpevsKTPv8cinO+o3fEFDNhj8DzfV PpKTckfedbXK0eEhPQo23TDUfQyL6U3PDDdSdFOf5Eit70VK4HE3chSkN 4psl6NE5PZ/iutrMf+P7BEeFFVlnDAORjTE4oT7Z+48KDn2PNws0ekGzv w==; X-IronPort-AV: E=McAfee;i="6200,9189,10286"; a="236370469" X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="236370469" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Mar 2022 14:12:01 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="820113204" Received: from anguy11-desk2.jf.intel.com ([10.166.244.147]) by fmsmga005.fm.intel.com with ESMTP; 15 Mar 2022 14:12:00 -0700 From: Tony Nguyen To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com Cc: Maciej Fijalkowski , netdev@vger.kernel.org, anthony.l.nguyen@intel.com, magnus.karlsson@intel.com, kernel test robot , Dan Carpenter , Alexander Lobakin , Gurucharan G Subject: [PATCH net 1/3] ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats() Date: Tue, 15 Mar 2022 14:12:23 -0700 Message-Id: <20220315211225.2923496-2-anthony.l.nguyen@intel.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> References: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Maciej Fijalkowski It is possible to do NULL pointer dereference in routine that updates Tx ring stats. Currently only stats and bytes are updated when ring pointer is valid, but later on ring is accessed to propagate gathered Tx stats onto VSI stats. Change the existing logic to move to next ring when ring is NULL. Fixes: e72bba21355d ("ice: split ice_ring onto Tx/Rx separate structs") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Maciej Fijalkowski Acked-by: Alexander Lobakin Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen --- drivers/net/ethernet/intel/ice/ice_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index 493942e910be..d4a7c39fd078 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -5962,8 +5962,9 @@ ice_update_vsi_tx_ring_stats(struct ice_vsi *vsi, u64 pkts = 0, bytes = 0; ring = READ_ONCE(rings[i]); - if (ring) - ice_fetch_u64_stats_per_ring(&ring->syncp, ring->stats, &pkts, &bytes); + if (!ring) + continue; + ice_fetch_u64_stats_per_ring(&ring->syncp, ring->stats, &pkts, &bytes); vsi_stats->tx_packets += pkts; vsi_stats->tx_bytes += bytes; vsi->tx_restart += ring->tx_stats.restart_q; From patchwork Tue Mar 15 21:12:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tony Nguyen X-Patchwork-Id: 12781841 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5ADFEC433F5 for ; Tue, 15 Mar 2022 21:12:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343516AbiCOVNS (ORCPT ); Tue, 15 Mar 2022 17:13:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59754 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351880AbiCOVNO (ORCPT ); Tue, 15 Mar 2022 17:13:14 -0400 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E8155B3E4 for ; Tue, 15 Mar 2022 14:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1647378722; x=1678914722; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8PgYKHlLZqQxXxjKCcUpVXINScXFg/XQ6ZqY9CRDYcY=; b=lS2C0s4enE+Bn7BxjzHkx2Cbr5z0gUkqMMboXB6clfVvAssJk+aRPZmd 6M8UaMfF8bCGEOyGWp7rrHhlONzrZMSCMt3vxyNQeSeqenQYgBVXOumAj JQBwpw/MqXAMKyfvdlFdDB3SN2ZxdisMwHRCJusC6z4IGvuobLZGe7eEz iMZ8qz9r75iGxGEG1/HjTLj15T1pMswsCcNH1el3nj3Q86tIXXGcGzG4n 4dWT9ZQDrV13AqrzJUxTPcfiTImhHNixLSnZdmjLQOl7g7MHFtMdYgp7C z3RagAmA6t1OtndUQckO6EbjdBcBC//LlBlfOr0GtKoX91UjVZsap4Q9v g==; X-IronPort-AV: E=McAfee;i="6200,9189,10286"; a="236370470" X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="236370470" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Mar 2022 14:12:01 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="820113210" Received: from anguy11-desk2.jf.intel.com ([10.166.244.147]) by fmsmga005.fm.intel.com with ESMTP; 15 Mar 2022 14:12:01 -0700 From: Tony Nguyen To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com Cc: Sudheer Mogilappagari , netdev@vger.kernel.org, anthony.l.nguyen@intel.com, Bharathi Sreenivas Subject: [PATCH net 2/3] ice: destroy flow director filter mutex after releasing VSIs Date: Tue, 15 Mar 2022 14:12:24 -0700 Message-Id: <20220315211225.2923496-3-anthony.l.nguyen@intel.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> References: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Sudheer Mogilappagari Currently fdir_fltr_lock is accessed in ice_vsi_release_all() function after it is destroyed. Instead destroy mutex after ice_vsi_release_all. Fixes: 40319796b732 ("ice: Add flow director support for channel mode") Signed-off-by: Sudheer Mogilappagari Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen --- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index d4a7c39fd078..b7e8744b0c0a 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -4880,7 +4880,6 @@ static void ice_remove(struct pci_dev *pdev) ice_devlink_unregister_params(pf); set_bit(ICE_DOWN, pf->state); - mutex_destroy(&(&pf->hw)->fdir_fltr_lock); ice_deinit_lag(pf); if (test_bit(ICE_FLAG_PTP_SUPPORTED, pf->flags)) ice_ptp_release(pf); @@ -4888,6 +4887,7 @@ static void ice_remove(struct pci_dev *pdev) ice_remove_arfs(pf); ice_setup_mc_magic_wake(pf); ice_vsi_release_all(pf); + mutex_destroy(&(&pf->hw)->fdir_fltr_lock); ice_set_wake(pf); ice_free_irq_msix_misc(pf); ice_for_each_vsi(pf, i) { From patchwork Tue Mar 15 21:12:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tony Nguyen X-Patchwork-Id: 12781840 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D79E8C433EF for ; Tue, 15 Mar 2022 21:12:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346765AbiCOVNR (ORCPT ); Tue, 15 Mar 2022 17:13:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351869AbiCOVNP (ORCPT ); Tue, 15 Mar 2022 17:13:15 -0400 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E29B5574A5 for ; Tue, 15 Mar 2022 14:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1647378722; x=1678914722; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hexcrjPy0P4KcMWDHKaBYnhIFz5iTyp1BwWvGr/ug58=; b=UciD9VyX5jt9kuvcrlqwwGkaVOw4i+nFLUVmFa2BIiyVr/OHsIjQjEbD qvi+S01OJA1NAN3gQB+vrZimxy6HU/zxqVljVCQlI9lDi+7CUaQYzIRcv gOVJr/ahngM227QjwWeOcT8xuOkm91rZIR9OV11uQzMLakCM3YOFP2+7c 2B6UoAb5FV/AXG5L5IbFdBV44Mm6t44RMJWhv4SRPLuRShvbbVLZOJGTX E9dCx85WbsuOv7FoQho1auDZyktPTda3jg/cJCpgO/+ufTWSyHhzV3W3E 4DfsHzYA8YWuTPi+hV7vdzFBM5HY8SmHXnzAX6T3Tt/tHsM6wOxNqQmVS A==; X-IronPort-AV: E=McAfee;i="6200,9189,10286"; a="236370472" X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="236370472" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Mar 2022 14:12:02 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.90,184,1643702400"; d="scan'208";a="820113217" Received: from anguy11-desk2.jf.intel.com ([10.166.244.147]) by fmsmga005.fm.intel.com with ESMTP; 15 Mar 2022 14:12:01 -0700 From: Tony Nguyen To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com Cc: Przemyslaw Patynowski , netdev@vger.kernel.org, anthony.l.nguyen@intel.com, sassmann@redhat.com, Dan Carpenter , Mateusz Palczewski , Konrad Jankowski Subject: [PATCH net 3/3] iavf: Fix double free in iavf_reset_task Date: Tue, 15 Mar 2022 14:12:25 -0700 Message-Id: <20220315211225.2923496-4-anthony.l.nguyen@intel.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> References: <20220315211225.2923496-1-anthony.l.nguyen@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Przemyslaw Patynowski Fix double free possibility in iavf_disable_vf, as crit_lock is freed in caller, iavf_reset_task. Add kernel-doc for iavf_disable_vf. Remove mutex_unlock in iavf_disable_vf. Without this patch there is double free scenario, when calling iavf_reset_task. Fixes: e85ff9c631e1 ("iavf: Fix deadlock in iavf_reset_task") Signed-off-by: Przemyslaw Patynowski Suggested-by: Dan Carpenter Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen --- drivers/net/ethernet/intel/iavf/iavf_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c index 8e644e9ed8da..45570e3f782e 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -2541,6 +2541,13 @@ static void iavf_watchdog_task(struct work_struct *work) queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2); } +/** + * iavf_disable_vf - disable VF + * @adapter: board private structure + * + * Set communication failed flag and free all resources. + * NOTE: This function is expected to be called with crit_lock being held. + **/ static void iavf_disable_vf(struct iavf_adapter *adapter) { struct iavf_mac_filter *f, *ftmp; @@ -2595,7 +2602,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); iavf_shutdown_adminq(&adapter->hw); adapter->netdev->flags &= ~IFF_UP; - mutex_unlock(&adapter->crit_lock); adapter->flags &= ~IAVF_FLAG_RESET_PENDING; iavf_change_state(adapter, __IAVF_DOWN); wake_up(&adapter->down_waitqueue);