Commit b16939b5 authored by Vasundhara Volam's avatar Vasundhara Volam Committed by Jakub Kicinski

bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task()

bnxt_fw_reset_task() which runs from a workqueue can race with
bnxt_remove_one().  For example, if firmware reset and VF FLR are
happening at about the same time.

bnxt_remove_one() already cancels the workqueue and waits for it
to finish, but we need to do this earlier before the devlink
reporters are destroyed.  This will guarantee that
the devlink reporters will always be valid when bnxt_fw_reset_task()
is still running.

Fixes: b148bb23 ("bnxt_en: Fix possible crash in bnxt_fw_reset_task().")
Reviewed-by: default avatarEdwin Peer <edwin.peer@broadcom.com>
Signed-off-by: default avatarVasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b340dc68
...@@ -11779,6 +11779,10 @@ static void bnxt_remove_one(struct pci_dev *pdev) ...@@ -11779,6 +11779,10 @@ static void bnxt_remove_one(struct pci_dev *pdev)
if (BNXT_PF(bp)) if (BNXT_PF(bp))
bnxt_sriov_disable(bp); bnxt_sriov_disable(bp);
clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
bnxt_cancel_sp_work(bp);
bp->sp_event = 0;
bnxt_dl_fw_reporters_destroy(bp, true); bnxt_dl_fw_reporters_destroy(bp, true);
if (BNXT_PF(bp)) if (BNXT_PF(bp))
devlink_port_type_clear(&bp->dl_port); devlink_port_type_clear(&bp->dl_port);
...@@ -11786,9 +11790,6 @@ static void bnxt_remove_one(struct pci_dev *pdev) ...@@ -11786,9 +11790,6 @@ static void bnxt_remove_one(struct pci_dev *pdev)
unregister_netdev(dev); unregister_netdev(dev);
bnxt_dl_unregister(bp); bnxt_dl_unregister(bp);
bnxt_shutdown_tc(bp); bnxt_shutdown_tc(bp);
clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
bnxt_cancel_sp_work(bp);
bp->sp_event = 0;
bnxt_clear_int_mode(bp); bnxt_clear_int_mode(bp);
bnxt_hwrm_func_drv_unrgtr(bp); bnxt_hwrm_func_drv_unrgtr(bp);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment