Commit 16b2dd8c authored by Przemyslaw Patynowski's avatar Przemyslaw Patynowski Committed by Tony Nguyen

iavf: Fix double free in iavf_reset_task

Fix double free possibility in iavf_disable_vf, as crit_lock is
freed in caller, iavf_reset_task. Add kernel-doc for iavf_disable_vf.
Remove mutex_unlock in iavf_disable_vf.
Without this patch there is double free scenario, when calling
iavf_reset_task.

Fixes: e85ff9c6 ("iavf: Fix deadlock in iavf_reset_task")
Signed-off-by: default avatarPrzemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Suggested-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
parent 1b4ae7d9
...@@ -2541,6 +2541,13 @@ static void iavf_watchdog_task(struct work_struct *work) ...@@ -2541,6 +2541,13 @@ static void iavf_watchdog_task(struct work_struct *work)
queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2); queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2);
} }
/**
* iavf_disable_vf - disable VF
* @adapter: board private structure
*
* Set communication failed flag and free all resources.
* NOTE: This function is expected to be called with crit_lock being held.
**/
static void iavf_disable_vf(struct iavf_adapter *adapter) static void iavf_disable_vf(struct iavf_adapter *adapter)
{ {
struct iavf_mac_filter *f, *ftmp; struct iavf_mac_filter *f, *ftmp;
...@@ -2595,7 +2602,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) ...@@ -2595,7 +2602,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter)
memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE);
iavf_shutdown_adminq(&adapter->hw); iavf_shutdown_adminq(&adapter->hw);
adapter->netdev->flags &= ~IFF_UP; adapter->netdev->flags &= ~IFF_UP;
mutex_unlock(&adapter->crit_lock);
adapter->flags &= ~IAVF_FLAG_RESET_PENDING; adapter->flags &= ~IAVF_FLAG_RESET_PENDING;
iavf_change_state(adapter, __IAVF_DOWN); iavf_change_state(adapter, __IAVF_DOWN);
wake_up(&adapter->down_waitqueue); wake_up(&adapter->down_waitqueue);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment