Commit 31333c1a authored by Alexander Lobakin's avatar Alexander Lobakin Committed by David S. Miller

net: qed: fix async event callbacks unregistering

qed_spq_unregister_async_cb() should be called before
qed_rdma_info_free() to avoid crash-spawning uses-after-free.
Instead of calling it from each subsystem exit code, do it in one place
on PF down.

Fixes: 291d57f6 ("qed: Fix rdma_info structure allocation")
Signed-off-by: default avatarAlexander Lobakin <alobakin@marvell.com>
Signed-off-by: default avatarIgor Russkikh <irusskikh@marvell.com>
Signed-off-by: default avatarMichal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 97dd1abd
...@@ -1368,6 +1368,8 @@ static void qed_dbg_user_data_free(struct qed_hwfn *p_hwfn) ...@@ -1368,6 +1368,8 @@ static void qed_dbg_user_data_free(struct qed_hwfn *p_hwfn)
void qed_resc_free(struct qed_dev *cdev) void qed_resc_free(struct qed_dev *cdev)
{ {
struct qed_rdma_info *rdma_info;
struct qed_hwfn *p_hwfn;
int i; int i;
if (IS_VF(cdev)) { if (IS_VF(cdev)) {
...@@ -1385,7 +1387,8 @@ void qed_resc_free(struct qed_dev *cdev) ...@@ -1385,7 +1387,8 @@ void qed_resc_free(struct qed_dev *cdev)
qed_llh_free(cdev); qed_llh_free(cdev);
for_each_hwfn(cdev, i) { for_each_hwfn(cdev, i) {
struct qed_hwfn *p_hwfn = &cdev->hwfns[i]; p_hwfn = cdev->hwfns + i;
rdma_info = p_hwfn->p_rdma_info;
qed_cxt_mngr_free(p_hwfn); qed_cxt_mngr_free(p_hwfn);
qed_qm_info_free(p_hwfn); qed_qm_info_free(p_hwfn);
...@@ -1404,8 +1407,10 @@ void qed_resc_free(struct qed_dev *cdev) ...@@ -1404,8 +1407,10 @@ void qed_resc_free(struct qed_dev *cdev)
qed_ooo_free(p_hwfn); qed_ooo_free(p_hwfn);
} }
if (QED_IS_RDMA_PERSONALITY(p_hwfn)) if (QED_IS_RDMA_PERSONALITY(p_hwfn) && rdma_info) {
qed_spq_unregister_async_cb(p_hwfn, rdma_info->proto);
qed_rdma_info_free(p_hwfn); qed_rdma_info_free(p_hwfn);
}
qed_iov_free(p_hwfn); qed_iov_free(p_hwfn);
qed_l2_free(p_hwfn); qed_l2_free(p_hwfn);
......
...@@ -2836,8 +2836,6 @@ int qed_iwarp_stop(struct qed_hwfn *p_hwfn) ...@@ -2836,8 +2836,6 @@ int qed_iwarp_stop(struct qed_hwfn *p_hwfn)
if (rc) if (rc)
return rc; return rc;
qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_IWARP);
return qed_iwarp_ll2_stop(p_hwfn); return qed_iwarp_ll2_stop(p_hwfn);
} }
......
...@@ -113,7 +113,6 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn) ...@@ -113,7 +113,6 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn)
break; break;
} }
} }
qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_ROCE);
} }
static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid, static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment