Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 164d9a15 authored by Alexander Lobakin's avatar Alexander Lobakin Committed by Sasha Levin
Browse files

net: qed: fix async event callbacks unregistering 



[ Upstream commit 31333c1a2521ff4b4ceb0c29de492549cd4a8de3 ]

qed_spq_unregister_async_cb() should be called before
qed_rdma_info_free() to avoid crash-spawning uses-after-free.
Instead of calling it from each subsystem exit code, do it in one place
on PF down.

Fixes: 291d57f6 ("qed: Fix rdma_info structure allocation")
Signed-off-by: default avatarAlexander Lobakin <alobakin@marvell.com>
Signed-off-by: default avatarIgor Russkikh <irusskikh@marvell.com>
Signed-off-by: default avatarMichal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5cf7f0c6

drivers/net/ethernet/qlogic/qed/qed_dev.c

+7 −2
Original line number Diff line number Diff line
@@ -1368,6 +1368,8 @@ static void qed_dbg_user_data_free(struct qed_hwfn *p_hwfn) 


void qed_resc_free(struct qed_dev *cdev)

{

	struct qed_rdma_info *rdma_info;

	struct qed_hwfn *p_hwfn;

	int i;



	if (IS_VF(cdev)) {
@@ -1385,7 +1387,8 @@ void qed_resc_free(struct qed_dev *cdev) 
	qed_llh_free(cdev);



	for_each_hwfn(cdev, i) {

		struct qed_hwfn *p_hwfn = &cdev->hwfns[i];

		p_hwfn = cdev->hwfns + i;

		rdma_info = p_hwfn->p_rdma_info;



		qed_cxt_mngr_free(p_hwfn);

		qed_qm_info_free(p_hwfn);
@@ -1404,8 +1407,10 @@ void qed_resc_free(struct qed_dev *cdev) 
			qed_ooo_free(p_hwfn);

		}



		if (QED_IS_RDMA_PERSONALITY(p_hwfn))

		if (QED_IS_RDMA_PERSONALITY(p_hwfn) && rdma_info) {

			qed_spq_unregister_async_cb(p_hwfn, rdma_info->proto);

			qed_rdma_info_free(p_hwfn);

		}



		qed_iov_free(p_hwfn);

		qed_l2_free(p_hwfn);

drivers/net/ethernet/qlogic/qed/qed_iwarp.c

+0 −2
Original line number Diff line number Diff line
@@ -2832,8 +2832,6 @@ int qed_iwarp_stop(struct qed_hwfn *p_hwfn) 
	if (rc)

		return rc;



	qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_IWARP);



	return qed_iwarp_ll2_stop(p_hwfn);

}

drivers/net/ethernet/qlogic/qed/qed_roce.c

+0 −1
Original line number Diff line number Diff line
@@ -113,7 +113,6 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn) 
			break;

		}

	}

	qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_ROCE);

}



static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid,