github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-08 03:26:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bna: prevent IOC timer rearm during teardown

Browse Source 
bna: prevent IOC timer rearm during teardown

bnad_pci_remove() and the probe disable_ioceth path call
timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for
iocpf_timer.  bnad_iocpf_timeout() then takes bnad->bna_lock after
free_netdev() has freed the struct bnad.

Deleting iocpf_timer last does not fix this.  sem_timer and
iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm
iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from
bfa_ioc_hw_sem_get() when the semaphore is busy.
timer_delete_sync() only waits out its own callback.
bnad_ioceth_disable() can time out and leave that callback live.

Shut all four IOC timers down with timer_shutdown_sync() on both
paths, so a later mod_timer() is ignored.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 1d32f76962 ("bna: IOC failure auto recovery fix")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260922014605.588040-1-mhun512@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Myeonghun Pak 2026-09-21 21:46:05 -04:00 committed by Paolo Abeni
parent 3cd204d4c6
commit 77b1718e39
1 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/net/ethernet/brocade/bna/bnad.c
View File

@ -2571,6 +2571,22 @@ bnad_ioceth_disable(struct bnad *bnad)
return err;
}
/*
* The IOC timers rearm one another, so deleting one cannot stop a
* sibling callback from arming it again. Shut them down so a later
* mod_timer() is ignored.
*/
static void
bnad_ioc_timers_shutdown(struct bnad *bnad)
{
struct bfa_ioc *ioc = &bnad->bna.ioceth.ioc;
timer_shutdown_sync(&ioc->ioc_timer);
timer_shutdown_sync(&ioc->sem_timer);
timer_shutdown_sync(&ioc->hb_timer);
timer_shutdown_sync(&ioc->iocpf_timer);
}
static int
bnad_ioceth_enable(struct bnad *bnad)
{
@ -3727,9 +3743,7 @@ bnad_pci_probe(struct pci_dev *pdev,
bnad_res_free(bnad, &bnad->mod_res_info[0], BNA_MOD_RES_T_MAX);
disable_ioceth:
bnad_ioceth_disable(bnad);
timer_delete_sync(&bnad->bna.ioceth.ioc.ioc_timer);
timer_delete_sync(&bnad->bna.ioceth.ioc.sem_timer);
timer_delete_sync(&bnad->bna.ioceth.ioc.hb_timer);
bnad_ioc_timers_shutdown(bnad);
spin_lock_irqsave(&bnad->bna_lock, flags);
bna_uninit(bna);
spin_unlock_irqrestore(&bnad->bna_lock, flags);
@ -3770,9 +3784,7 @@ bnad_pci_remove(struct pci_dev *pdev)
mutex_lock(&bnad->conf_mutex);
bnad_ioceth_disable(bnad);
timer_delete_sync(&bnad->bna.ioceth.ioc.ioc_timer);
timer_delete_sync(&bnad->bna.ioceth.ioc.sem_timer);
timer_delete_sync(&bnad->bna.ioceth.ioc.hb_timer);
bnad_ioc_timers_shutdown(bnad);
spin_lock_irqsave(&bnad->bna_lock, flags);
bna_uninit(bna);
spin_unlock_irqrestore(&bnad->bna_lock, flags);