lkml.org 
[lkml]   [2018]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 002/235] net/mlx5: Fix use-after-free in self-healing flow
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jack Morgenstein <jackm@dev.mellanox.co.il>

    [ Upstream commit 76d5581c870454be5f1f1a106c57985902e7ea20 ]

    When the mlx5 health mechanism detects a problem while the driver
    is in the middle of init_one or remove_one, the driver needs to prevent
    the health mechanism from scheduling future work; if future work
    is scheduled, there is a problem with use-after-free: the system WQ
    tries to run the work item (which has been freed) at the scheduled
    future time.

    Prevent this by disabling work item scheduling in the health mechanism
    when the driver is in the middle of init_one() or remove_one().

    Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Reviewed-by: Feras Daoud <ferasda@mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/mellanox/mlx5/core/health.c | 10 +++++++++-
    drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++---
    include/linux/mlx5/driver.h | 2 +-
    3 files changed, 13 insertions(+), 5 deletions(-)

    --- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
    @@ -331,9 +331,17 @@ void mlx5_start_health_poll(struct mlx5_
    add_timer(&health->timer);
    }

    -void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
    +void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health)
    {
    struct mlx5_core_health *health = &dev->priv.health;
    + unsigned long flags;
    +
    + if (disable_health) {
    + spin_lock_irqsave(&health->wq_lock, flags);
    + set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
    + set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
    + spin_unlock_irqrestore(&health->wq_lock, flags);
    + }

    del_timer_sync(&health->timer);
    }
    --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
    @@ -1266,7 +1266,7 @@ err_cleanup_once:
    mlx5_cleanup_once(dev);

    err_stop_poll:
    - mlx5_stop_health_poll(dev);
    + mlx5_stop_health_poll(dev, boot);
    if (mlx5_cmd_teardown_hca(dev)) {
    dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
    goto out_err;
    @@ -1325,7 +1325,7 @@ static int mlx5_unload_one(struct mlx5_c
    mlx5_free_irq_vectors(dev);
    if (cleanup)
    mlx5_cleanup_once(dev);
    - mlx5_stop_health_poll(dev);
    + mlx5_stop_health_poll(dev, cleanup);
    err = mlx5_cmd_teardown_hca(dev);
    if (err) {
    dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
    @@ -1587,7 +1587,7 @@ static int mlx5_try_fast_unload(struct m
    * with the HCA, so the health polll is no longer needed.
    */
    mlx5_drain_health_wq(dev);
    - mlx5_stop_health_poll(dev);
    + mlx5_stop_health_poll(dev, false);

    ret = mlx5_cmd_force_teardown_hca(dev);
    if (ret) {
    --- a/include/linux/mlx5/driver.h
    +++ b/include/linux/mlx5/driver.h
    @@ -1042,7 +1042,7 @@ int mlx5_cmd_free_uar(struct mlx5_core_d
    void mlx5_health_cleanup(struct mlx5_core_dev *dev);
    int mlx5_health_init(struct mlx5_core_dev *dev);
    void mlx5_start_health_poll(struct mlx5_core_dev *dev);
    -void mlx5_stop_health_poll(struct mlx5_core_dev *dev);
    +void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health);
    void mlx5_drain_health_wq(struct mlx5_core_dev *dev);
    void mlx5_trigger_health_work(struct mlx5_core_dev *dev);
    void mlx5_drain_health_recovery(struct mlx5_core_dev *dev);

    \
     
     \ /
      Last update: 2018-09-24 14:52    [W:2.283 / U:3.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site