From: Simon Horman <horms@kernel.org>
To: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Cc: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org,
decui@microsoft.com, longli@microsoft.com, andrew+netdev@lunn.ch,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, ssengar@linux.microsoft.com,
dipayanroy@linux.microsoft.com, gargaditya@linux.microsoft.com,
shirazsaleem@microsoft.com, kees@kernel.org,
kotaranov@microsoft.com, leon@kernel.org, shacharr@microsoft.com,
stephen@networkplumber.org, linux-hyperv@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net v4 0/5] net: mana: Fix probe/remove error path bugs
Date: Tue, 21 Apr 2026 17:49:59 +0100 [thread overview]
Message-ID: <20260421164959.GH651125@horms.kernel.org> (raw)
In-Reply-To: <20260420124741.1056179-1-ernis@linux.microsoft.com>
On Mon, Apr 20, 2026 at 05:47:34AM -0700, Erni Sri Satya Vennela wrote:
> Fix five bugs in mana_probe()/mana_remove() error handling that can
> cause warnings on uninitialized work structs, NULL pointer dereferences,
> masked errors, and resource leaks when early probe steps fail.
>
> Patches 1-2 move work struct initialization (link_change_work and
> gf_stats_work) to before any error path that could trigger
> mana_remove(), preventing WARN_ON in __flush_work() or debug object
> warnings when sync cancellation runs on uninitialized work structs.
>
> Patch 3 guards mana_remove() against double invocation. If PM resume
> fails, mana_probe() calls mana_remove() which sets gdma_context and
> driver_data to NULL. A failed resume does not unbind the driver, so
> when the device is eventually unbound, mana_remove() is called again
> and dereferences NULL, causing a kernel panic. An early return on
> NULL gdma_context or driver_data makes the second call harmless.
>
> Patch 4 prevents add_adev() from overwriting a port probe error,
> which could leave the driver in a broken state with NULL ports while
> reporting success.
>
> Patch 5 changes 'goto out' to 'break' in mana_remove()'s port loop
> so that mana_destroy_eq() is always reached, preventing EQ leaks when
> a NULL port is encountered.
> ---
> Changes in v4:
> * Correct Fixes tag from ca9c54d2d6a5 to 635096a86edb
> * Correct Fixes tag from ced82fce77e9 to a69839d4327d
Thanks for the updates.
For the series:
Reviewed-by: Simon Horman <horms@kernel.org>
I see that Sashiko provided feedback on patch 4/5.
However, as it notes, the issue it flags is addressed in patch 5/5.
No further action required AFAICS.
next prev parent reply other threads:[~2026-04-21 16:50 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-20 12:47 [PATCH net v4 0/5] net: mana: Fix probe/remove error path bugs Erni Sri Satya Vennela
2026-04-20 12:47 ` [PATCH net v4 1/5] net: mana: Init link_change_work before potential error paths in probe Erni Sri Satya Vennela
2026-04-20 12:47 ` [PATCH net v4 2/5] net: mana: Init gf_stats_work " Erni Sri Satya Vennela
2026-04-20 12:47 ` [PATCH net v4 3/5] net: mana: Guard mana_remove against double invocation Erni Sri Satya Vennela
2026-04-23 10:52 ` Paolo Abeni
2026-04-20 12:47 ` [PATCH net v4 4/5] net: mana: Don't overwrite port probe error with add_adev result Erni Sri Satya Vennela
2026-04-20 12:47 ` [PATCH net v4 5/5] net: mana: Fix EQ leak in mana_remove on NULL port Erni Sri Satya Vennela
2026-04-21 16:49 ` Simon Horman [this message]
2026-04-23 11:00 ` [PATCH net v4 0/5] net: mana: Fix probe/remove error path bugs patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260421164959.GH651125@horms.kernel.org \
--to=horms@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=decui@microsoft.com \
--cc=dipayanroy@linux.microsoft.com \
--cc=edumazet@google.com \
--cc=ernis@linux.microsoft.com \
--cc=gargaditya@linux.microsoft.com \
--cc=haiyangz@microsoft.com \
--cc=kees@kernel.org \
--cc=kotaranov@microsoft.com \
--cc=kuba@kernel.org \
--cc=kys@microsoft.com \
--cc=leon@kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=longli@microsoft.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shacharr@microsoft.com \
--cc=shirazsaleem@microsoft.com \
--cc=ssengar@linux.microsoft.com \
--cc=stephen@networkplumber.org \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.