[PATCH net-next 0/7] ibmveth: fix hangs, use-after-frees and netpoll races

[Mingming Cao <mmc@linux.ibm.com>]

Hi,

Seven fixes for serious bugs in the ibmveth driver: two hang the
system, three are use-after-frees, one corrupts memory, and one makes
ethtool -L report success when it failed.

The series is based on net-next commit 071876fd5048 ("ref_tracker: Don't
use __GFP_NOFAIL for PF_MEMALLOC thread."). It does not depend on
the two open() error-path fixes recently applied to net
(commit af0524bf4ce1, commit 84bec0bf0352) and merges cleanly with them;
patch 2 explains how it relates to them. It also applies to net with
git am -3.

  1. Netpoll races with RX replenish (memory corruption, NULL
     dereference): remove ndo_poll_controller, as was done for
     ibmvnic, and enable NAPI only once the RX resources exist.
     Fixes: 6b4223748895 ("[PATCH] ibmveth: Add netpoll function")
     Fixes: bea3348eef27 ("[NET]: Make NAPI polling independent of struct net_device objects.")

  2. Hang after a failed internal reopen: the next close() waits in
     napi_disable() forever with RTNL held, and only a reboot
     recovers. Skip close() when open() did not succeed.
     Fixes: 860f242eb534 ("[PATCH] ibmveth change buffer pools dynamically")

  3. Use-after-free in remove(): a reset queued from NAPI could run
     on the freed adapter. Disable the reset work first.
     Fixes: 2c91e2319ed9 ("net: ibmveth: Reset the adapter when unexpected states are detected")

  4. RX poll hang on a bad correlator: poll restarts on the same slot
     until RCU stalls, and an inactive pool dereferences NULL. Step
     past the slot, reject inactive pools, count the drop.
     Fixes: 2c91e2319ed9 ("net: ibmveth: Reset the adapter when unexpected states are detected")
     Fixes: 860f242eb534 ("[PATCH] ibmveth change buffer pools dynamically")

  5. Use-after-free after a failed probe: the pool kobjects stay in
     sysfs after the adapter is freed. Put them, as remove() does.
     The pool kobjects have no release(), so with
     CONFIG_DEBUG_KOBJECT_RELEASE a short window remains here and in
     remove(); giving them a release() is left for a follow-up.
     Fixes: 860f242eb534 ("[PATCH] ibmveth change buffer pools dynamically")

  6. ethtool -L returns 0 when it cannot allocate the new TX queues.
     Return the allocation error.
     Fixes: 10c2aba89cc0 ("ibmveth: Ethtool set queue support")

  7. Use-after-free of TX buffers: close(), called directly for MTU,
     offload and buffer pool changes, frees them without waiting for
     a running transmit. Use netif_tx_disable().
     Fixes: d6832ca48d8a ("ibmveth: Copy tx skbs into a premapped buffer")

The triggers are rare and there are no field reports, so the series
targets net-next. All carry Fixes: tags; I am happy to repost
against net, or add Cc: stable, if you prefer.

All were found by AI-assisted review of the ibmveth multi-queue
RX series [1]. Landing them first also shrinks that series, which
then only extends this handling per queue.

Testing: the new and extended KUnit cases in patch 4 fail on the
unfixed driver and pass on qemu pseries (ppc64le). On a POWER10
LPAR: netconsole under printk and ping floods, MTU and buffer pool
changes under traffic, a forced open() failure followed by down and
up, unbind/bind under traffic, a forced register_netdev() failure in
probe, and ethtool -L with a forced TX buffer allocation failure.

[1] https://lore.kernel.org/netdev/cover.1790319558.git.mmc@linux.ibm.com/

Thanks,
Mingming

Mingming Cao (7):
  ibmveth: fix netpoll races with RX replenish
  ibmveth: do not close twice after a failed reopen
  ibmveth: disable the reset work before unregister in remove
  ibmveth: step past bad RX correlators instead of spinning or oopsing
  ibmveth: release the pool kobjects when probe fails
  ibmveth: return the error when set_channels cannot add TX queues
  ibmveth: wait for in-flight transmits in ibmveth_close()

 drivers/net/ethernet/ibm/ibmveth.c | 238 ++++++++++++++++++++++-------
 drivers/net/ethernet/ibm/ibmveth.h |   2 +
 2 files changed, 184 insertions(+), 56 deletions(-)

-- 
2.39.3 (Apple Git-146)