From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793212527; b=rmCrRJX1P2D2xw7mAuTEZ2YM/qYLCkbAra7SHDeCKixiMFKc6GvD0xTPH76m39RZOhB8 JVvXPVJxKxYyID1sBvJWzRqq461qmckxPuBOV4u5eNOIZtt28hliRVNwHSJTQaGRgm5dB uK4lK7vLVaIFX00hqOxYpgnBbltKJTqaMcwDT73AjsJo00VYMXj23Ll7zAPFpyvCFt/VO KoBSRbyw9WTPKXBVuWvb9+9v58TCvSNJM6tNRdoXSWkvwnfltxgEhBp8IAfXXkMjdj7eR NqUObc558CWoss6AbxUBTllYHfIqzX6zZB5mziTCMF10l/ZpmgqTRV8Fp9dq+jxNCyw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793212527; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=LFTgpGd4xCbSoKI67dIJQ86Xpucajwcd+BHElqAnzVA=; b=B9CWaUVh1N4Ov5eaUF2al+2oGedLFI/63HQKJLQKU81Uh7Z+Sa8vNhh4/zHl1hVBZuRJ C5IgykZZxF3h/GY0MnyDDEWz3mCIyuzMRmjrjWCawOzDWrNPpnQKVUHToj5Ab87Lde4ZD /YAe0nrviLIGrRCKz7hzkBYBwM5sAcGPKrWNk2tHryFNSjjE/9htCaPsdjUvT+1BWbxwO AithCRdRinSywPtlTVBkzxF2Mfc0B7O+wYE1Ufkgl9Yo7MMoiWuHK88yexPxbAHsBJEuw tlJFUdVR06PUU8HcnbAAkmXnEHnxa/zDec89pYvWbBjUmv0lVB3s9MS/r6VLm9N9tlA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=N2qJS6UA; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02E7F606A31D; Wed, 28 Oct 2026 18:35:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=N2qJS6UA Received: by smtp.kernel.org (Postfix) with ESMTPSA id 573191F01825; Wed, 28 Oct 2026 18:35:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793212526; bh=LFTgpGd4xCbSoKI67dIJQ86Xpucajwcd+BHElqAnzVA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=N2qJS6UABAcZNWjlc6YoWJBIcDSHzXJHRSmokOWmqZFTmwFVkpGsawac0+4MbvXOJ stekYMnanWLvNay7ASqevJAsDReWl7sepmxqQGhBbf+1kHVgIkDRF+kPiwBG7SiIee zcSHP6oGk6mW6UkmsQ0hiQYtGAHclfbowIJIjUsI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shay Drory , Tariq Toukan , Simon Horman , Jakub Kicinski , Artem Dinaburg , Sasha Levin Subject: [PATCH 6.1 0184/1887] net/mlx5e: Fix netif state handling Date: Wed, 28 Oct 2026 17:38:00 +0100 Message-ID: <20261028170503.423499042@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shay Drory [ Upstream commit 3d5918477f94e4c2f064567875c475468e264644 ] mlx5e_suspend cleans resources only if netif_device_present() returns true. However, mlx5e_resume changes the state of netif, via mlx5e_nic_enable, only if reg_state == NETREG_REGISTERED. In the below case, the above leads to NULL-ptr Oops[1] and memory leaks: mlx5e_probe _mlx5e_resume mlx5e_attach_netdev mlx5e_nic_enable <-- netdev not reg, not calling netif_device_attach() register_netdev <-- failed for some reason. ERROR_FLOW: _mlx5e_suspend <-- netif_device_present return false, resources aren't freed :( Hence, clean resources in this case as well. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0010 [#1] SMP CPU: 2 PID: 9345 Comm: test-ovs-ct-gen Not tainted 6.5.0_for_upstream_min_debug_2023_09_05_16_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:0x0 Code: Unable to access opcode bytes at0xffffffffffffffd6. RSP: 0018:ffff888178aaf758 EFLAGS: 00010246 Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x14c/0x3c0 ? exc_page_fault+0x75/0x140 ? asm_exc_page_fault+0x22/0x30 notifier_call_chain+0x35/0xb0 blocking_notifier_call_chain+0x3d/0x60 mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] mlx5_core_uplink_netdev_event_replay+0x3e/0x60 [mlx5_core] mlx5_mdev_netdev_track+0x53/0x60 [mlx5_ib] mlx5_ib_roce_init+0xc3/0x340 [mlx5_ib] __mlx5_ib_add+0x34/0xd0 [mlx5_ib] mlx5r_probe+0xe1/0x210 [mlx5_ib] ? auxiliary_match_id+0x6a/0x90 auxiliary_bus_probe+0x38/0x80 ? driver_sysfs_add+0x51/0x80 really_probe+0xc9/0x3e0 ? driver_probe_device+0x90/0x90 __driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 bus_probe_device+0x86/0xa0 device_add+0x637/0x840 __auxiliary_device_add+0x3b/0xa0 add_adev+0xc9/0x140 [mlx5_core] mlx5_rescan_drivers_locked+0x22a/0x310 [mlx5_core] mlx5_register_device+0x53/0xa0 [mlx5_core] mlx5_init_one_devl_locked+0x5c4/0x9c0 [mlx5_core] mlx5_init_one+0x3b/0x60 [mlx5_core] probe_one+0x44c/0x730 [mlx5_core] local_pci_probe+0x3e/0x90 pci_device_probe+0xbf/0x210 ? kernfs_create_link+0x5d/0xa0 ? sysfs_do_create_link_sd+0x60/0xc0 really_probe+0xc9/0x3e0 ? driver_probe_device+0x90/0x90 __driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 pci_bus_add_device+0x54/0x80 pci_iov_add_virtfn+0x2e6/0x320 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x9e/0x200 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 kernfs_fop_write_iter+0x10c/0x1a0 vfs_write+0x291/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- [ Backport to 6.1.y: added an internal suspend helper so probe unwind cleans resources without changing the registered-device suspend path. ] Fixes: 2c3b5beec46a ("net/mlx5e: More generic netdev management API") Signed-off-by: Shay Drory Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20240509112951.590184-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski Assisted-by: LLM Signed-off-by: Artem Dinaburg Signed-off-by: Sasha Levin --- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c index 2d0b57583ea35..d26c36479ee91 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -5896,13 +5896,14 @@ static int mlx5e_resume(struct auxiliary_device *adev) return 0; } -static int mlx5e_suspend(struct auxiliary_device *adev, pm_message_t state) +static int mlx5e_suspend_common(struct auxiliary_device *adev, + bool pre_netdev_reg) { struct mlx5e_priv *priv = auxiliary_get_drvdata(adev); struct net_device *netdev = priv->netdev; struct mlx5_core_dev *mdev = priv->mdev; - if (!netif_device_present(netdev)) { + if (!pre_netdev_reg && !netif_device_present(netdev)) { if (test_bit(MLX5E_STATE_DESTROYING, &priv->state)) mlx5e_destroy_mdev_resources(mdev); return -ENODEV; @@ -5913,6 +5914,11 @@ static int mlx5e_suspend(struct auxiliary_device *adev, pm_message_t state) return 0; } +static int mlx5e_suspend(struct auxiliary_device *adev, pm_message_t state) +{ + return mlx5e_suspend_common(adev, false); +} + static int mlx5e_probe(struct auxiliary_device *adev, const struct auxiliary_device_id *id) { @@ -5920,7 +5926,6 @@ static int mlx5e_probe(struct auxiliary_device *adev, const struct mlx5e_profile *profile = &mlx5e_nic_profile; struct mlx5_core_dev *mdev = edev->mdev; struct net_device *netdev; - pm_message_t state = {}; struct mlx5e_priv *priv; int err; @@ -5969,7 +5974,7 @@ static int mlx5e_probe(struct auxiliary_device *adev, return 0; err_resume: - mlx5e_suspend(adev, state); + mlx5e_suspend_common(adev, true); err_profile_cleanup: profile->cleanup(priv); err_devlink_cleanup: -- 2.53.0