[PATCH net] net: hns3: fix kernel crash when uninstalling driver

[PATCH net] net: hns3: fix kernel crash when uninstalling driver

[Jijie Shao]

From: Peiyang Wang <wangpeiyang1@huawei.com>

When the driver is uninstalled and the VF is disabled concurrently, a
kernel crash occurs. The reason is that the two actions call function
pci_disable_sriov(). The num_VFs is checked to determine whether to
release the corresponding resources. During the second calling, num_VFs
is not 0 and the resource release function is called. However, the
corresponding resource has been released during the first invoking.
Therefore, the problem occurs:

[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
...
[15278.131557][T50670] Call trace:
[15278.134686][T50670]  klist_put+0x28/0x12c
[15278.138682][T50670]  klist_del+0x14/0x20
[15278.142592][T50670]  device_del+0xbc/0x3c0
[15278.146676][T50670]  pci_remove_bus_device+0x84/0x120
[15278.151714][T50670]  pci_stop_and_remove_bus_device+0x6c/0x80
[15278.157447][T50670]  pci_iov_remove_virtfn+0xb4/0x12c
[15278.162485][T50670]  sriov_disable+0x50/0x11c
[15278.166829][T50670]  pci_disable_sriov+0x24/0x30
[15278.171433][T50670]  hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
[15278.178039][T50670]  hclge_exit+0x28/0xd0 [hclge]
[15278.182730][T50670]  __se_sys_delete_module.isra.0+0x164/0x230
[15278.188550][T50670]  __arm64_sys_delete_module+0x1c/0x30
[15278.193848][T50670]  invoke_syscall+0x50/0x11c
[15278.198278][T50670]  el0_svc_common.constprop.0+0x158/0x164
[15278.203837][T50670]  do_el0_svc+0x34/0xcc
[15278.207834][T50670]  el0_svc+0x20/0x30

For details, see the following figure.

     rmmod hclge              disable VFs
----------------------------------------------------
hclge_exit()            sriov_numvfs_store()
  ...                     device_lock()
  pci_disable_sriov()     hns3_pci_sriov_configure()
                            pci_disable_sriov()
                              sriov_disable()
    sriov_disable()             if !num_VFs :
      if !num_VFs :               return;
        return;                 sriov_del_vfs()
      sriov_del_vfs()             ...
        ...                       klist_put()
        klist_put()               ...
        ...                     num_VFs = 0;
      num_VFs = 0;        device_unlock();

In this patch, when driver is removing, we get the device_lock()
to protect num_VFs, just like sriov_numvfs_store().

Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
index 67b0bf310daa..9a63fbc69408 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
 		pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
 		if (!pci_id)
 			continue;
-		if (IS_ENABLED(CONFIG_PCI_IOV))
+		if (IS_ENABLED(CONFIG_PCI_IOV)) {
+			device_lock(&ae_dev->pdev->dev);
 			pci_disable_sriov(ae_dev->pdev);
+			device_unlock(&ae_dev->pdev->dev);
+		}
 	}
 }
 EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
-- 
2.33.0

Re: [PATCH net] net: hns3: fix kernel crash when uninstalling driver

[Simon Horman]

On Fri, Nov 01, 2024 at 05:15:07PM +0800, Jijie Shao wrote:
> From: Peiyang Wang <wangpeiyang1@huawei.com>
> 
> When the driver is uninstalled and the VF is disabled concurrently, a
> kernel crash occurs. The reason is that the two actions call function
> pci_disable_sriov(). The num_VFs is checked to determine whether to
> release the corresponding resources. During the second calling, num_VFs
> is not 0 and the resource release function is called. However, the
> corresponding resource has been released during the first invoking.
> Therefore, the problem occurs:
> 
> [15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
> ...
> [15278.131557][T50670] Call trace:
> [15278.134686][T50670]  klist_put+0x28/0x12c
> [15278.138682][T50670]  klist_del+0x14/0x20
> [15278.142592][T50670]  device_del+0xbc/0x3c0
> [15278.146676][T50670]  pci_remove_bus_device+0x84/0x120
> [15278.151714][T50670]  pci_stop_and_remove_bus_device+0x6c/0x80
> [15278.157447][T50670]  pci_iov_remove_virtfn+0xb4/0x12c
> [15278.162485][T50670]  sriov_disable+0x50/0x11c
> [15278.166829][T50670]  pci_disable_sriov+0x24/0x30
> [15278.171433][T50670]  hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
> [15278.178039][T50670]  hclge_exit+0x28/0xd0 [hclge]
> [15278.182730][T50670]  __se_sys_delete_module.isra.0+0x164/0x230
> [15278.188550][T50670]  __arm64_sys_delete_module+0x1c/0x30
> [15278.193848][T50670]  invoke_syscall+0x50/0x11c
> [15278.198278][T50670]  el0_svc_common.constprop.0+0x158/0x164
> [15278.203837][T50670]  do_el0_svc+0x34/0xcc
> [15278.207834][T50670]  el0_svc+0x20/0x30
> 
> For details, see the following figure.
> 
>      rmmod hclge              disable VFs
> ----------------------------------------------------
> hclge_exit()            sriov_numvfs_store()
>   ...                     device_lock()
>   pci_disable_sriov()     hns3_pci_sriov_configure()
>                             pci_disable_sriov()
>                               sriov_disable()
>     sriov_disable()             if !num_VFs :
>       if !num_VFs :               return;
>         return;                 sriov_del_vfs()
>       sriov_del_vfs()             ...
>         ...                       klist_put()
>         klist_put()               ...
>         ...                     num_VFs = 0;
>       num_VFs = 0;        device_unlock();
> 
> In this patch, when driver is removing, we get the device_lock()
> to protect num_VFs, just like sriov_numvfs_store().
> 
> Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
> Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net: hns3: fix kernel crash when uninstalling driver

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 1 Nov 2024 17:15:07 +0800 you wrote:
> From: Peiyang Wang <wangpeiyang1@huawei.com>
> 
> When the driver is uninstalled and the VF is disabled concurrently, a
> kernel crash occurs. The reason is that the two actions call function
> pci_disable_sriov(). The num_VFs is checked to determine whether to
> release the corresponding resources. During the second calling, num_VFs
> is not 0 and the resource release function is called. However, the
> corresponding resource has been released during the first invoking.
> Therefore, the problem occurs:
> 
> [...]

Here is the summary with links:
  - [net] net: hns3: fix kernel crash when uninstalling driver
    https://git.kernel.org/netdev/net/c/df3dff8ab6d7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html