From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Stefan Assmann <sassmann@kpanic.de>,
Konrad Jankowski <konrad0.jankowski@intel.com>,
Tony Nguyen <anthony.l.nguyen@intel.com>,
Sasha Levin <sashal@kernel.org>,
intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 012/176] iavf: do not override the adapter state in the watchdog task
Date: Thu, 9 Sep 2021 07:48:34 -0400 [thread overview]
Message-ID: <20210909115118.146181-12-sashal@kernel.org> (raw)
In-Reply-To: <20210909115118.146181-1-sashal@kernel.org>
From: Stefan Assmann <sassmann@kpanic.de>
[ Upstream commit 22c8fd71d3a5e6fe584ccc2c1e8760e5baefd5aa ]
The iavf watchdog task overrides adapter->state to __IAVF_RESETTING
when it detects a pending reset. Then schedules iavf_reset_task() which
takes care of the reset.
The reset task is capable of handling the reset without changing
adapter->state. In fact we lose the state information when the watchdog
task prematurely changes the adapter state. This may lead to a crash if
instead of the reset task the iavf_remove() function gets called before
the reset task.
In that case (if we were in state __IAVF_RUNNING previously) the
iavf_remove() function triggers iavf_close() which fails to close the
device because of the incorrect state information.
This may result in a crash due to pending interrupts.
kernel BUG at drivers/pci/msi.c:357!
[...]
Call Trace:
[<ffffffffbddf24dd>] pci_disable_msix+0x3d/0x50
[<ffffffffc08d2a63>] iavf_reset_interrupt_capability+0x23/0x40 [iavf]
[<ffffffffc08d312a>] iavf_remove+0x10a/0x350 [iavf]
[<ffffffffbddd3359>] pci_device_remove+0x39/0xc0
[<ffffffffbdeb492f>] __device_release_driver+0x7f/0xf0
[<ffffffffbdeb49c3>] device_release_driver+0x23/0x30
[<ffffffffbddcabb4>] pci_stop_bus_device+0x84/0xa0
[<ffffffffbddcacc2>] pci_stop_and_remove_bus_device+0x12/0x20
[<ffffffffbddf361f>] pci_iov_remove_virtfn+0xaf/0x160
[<ffffffffbddf3bcc>] sriov_disable+0x3c/0xf0
[<ffffffffbddf3ca3>] pci_disable_sriov+0x23/0x30
[<ffffffffc0667365>] i40e_free_vfs+0x265/0x2d0 [i40e]
[<ffffffffc0667624>] i40e_pci_sriov_configure+0x144/0x1f0 [i40e]
[<ffffffffbddd5307>] sriov_numvfs_store+0x177/0x1d0
Code: 00 00 e8 3c 25 e3 ff 49 c7 86 88 08 00 00 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7b 28 e8 0d 44
RIP [<ffffffffbbbf1068>] free_msi_irqs+0x188/0x190
The solution is to not touch the adapter->state in iavf_watchdog_task()
and let the reset task handle the state transition.
Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/iavf/iavf_main.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index 7023aa147043..da401d5694bf 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -1951,7 +1951,6 @@ static void iavf_watchdog_task(struct work_struct *work)
/* check for hw reset */
reg_val = rd32(hw, IAVF_VF_ARQLEN1) & IAVF_VF_ARQLEN1_ARQENABLE_MASK;
if (!reg_val) {
- adapter->state = __IAVF_RESETTING;
adapter->flags |= IAVF_FLAG_RESET_PENDING;
adapter->aq_required = 0;
adapter->current_op = VIRTCHNL_OP_UNKNOWN;
--
2.30.2
next prev parent reply other threads:[~2021-09-09 12:32 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210909115118.146181-1-sashal@kernel.org>
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 005/176] libbpf: Fix reuse of pinned map on older kernel Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 009/176] tipc: keep the skb in rcv queue until the whole data is read Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 010/176] net: phy: Fix data type in DP83822 dp8382x_disable_wol() Sasha Levin
2021-09-09 11:48 ` Sasha Levin [this message]
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 013/176] iavf: fix locking of critical sections Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 016/176] netlink: Deal with ESRCH error in nlmsg_notify() Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 022/176] igc: Check if num of q_vectors is smaller than max before array access Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 037/176] nfp: fix return statement in nfp_net_parse_meta() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 039/176] ethtool: improve compat ioctl handling Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 042/176] bpf/tests: Fix copy-and-paste error in double word test Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 043/176] bpf/tests: Do not PASS tests without actually testing the result Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 049/176] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 050/176] flow_dissector: Fix out-of-bounds warnings Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 058/176] samples: bpf: Fix tracex7 error raised on the missing argument Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 059/176] libbpf: Fix race when pinning maps in parallel Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 062/176] Bluetooth: skip invalid hci_sync_conn_complete_evt Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 067/176] bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 071/176] bpf: Fix off-by-one in tail call count limiting Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 091/176] net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 099/176] selftests/bpf: Fix xdp_tx.c prog section name Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 101/176] Bluetooth: schedule SCO timeouts with delayed_work Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 102/176] Bluetooth: avoid circular locks in sco_sock_connect Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 104/176] net/mlx5: Fix variable type to match 64bit Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 107/176] mac80211: Fix monitor MTU limit so that A-MSDUs get through Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 115/176] Bluetooth: Fix handling of LE Enhanced Connection Complete Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 119/176] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 120/176] rpc: fix gss_svc_init cleanup on failure Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 121/176] selftests/bpf: Fix flaky send_signal test Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 124/176] net: Fix offloading indirect devices dependency on qdisc order creation Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 131/176] rtl8xxxu: Fix the handling of TX A-MPDU aggregation Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 132/176] rtw88: use read_poll_timeout instead of fixed sleep Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 133/176] rtw88: wow: build wow function only if CONFIG_PM is on Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 134/176] rtw88: wow: fix size access error of probe request Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 135/176] octeontx2-pf: Fix NIX1_RX interface backpressure Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 149/176] selftests/bpf: Enlarge select() timeout for test_maps Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 160/176] iwlwifi: pcie: free RBs during configure Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 161/176] iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 162/176] iwlwifi: mvm: avoid static queue number aliasing Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 163/176] iwlwifi: mvm: fix access to BSS elements Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 164/176] iwlwifi: fw: correctly limit to monitor dump Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 165/176] iwlwifi: mvm: Fix scan channel flags settings Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 166/176] net/mlx5: DR, fix a potential use-after-free bug Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 167/176] net/mlx5: DR, Enable QP retransmission Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 169/176] selftests/bpf: Fix potential unreleased lock Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 170/176] wcn36xx: Fix missing frame timestamp for beacon/probe-resp Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 171/176] ath9k: fix OOB read ar9300_eeprom_restore_internal Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 172/176] ath9k: fix sleeping in atomic context Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 173/176] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 174/176] fix array-index-out-of-bounds in taprio_change Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 175/176] net: w5100: check return value after calling platform_get_resource() Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 176/176] net: hns3: clean up a type mismatch warning Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909115118.146181-12-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=anthony.l.nguyen@intel.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=konrad0.jankowski@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sassmann@kpanic.de \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).