Received: by 2002:a05:6a10:413:0:0:0:0 with SMTP id 19csp3187014pxp; Mon, 14 Mar 2022 12:51:34 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwmG4fIzN2tqDOPqGTIO2OStaKLipSlFZ49FDyE7dj/fgG2qRthrmLesjrYRh+oUhXhmgGT X-Received: by 2002:a17:902:aa0b:b0:151:e196:c6e4 with SMTP id be11-20020a170902aa0b00b00151e196c6e4mr24864270plb.162.1647287494676; Mon, 14 Mar 2022 12:51:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1647287494; cv=none; d=google.com; s=arc-20160816; b=jT3epHBpTeAAMKGUjJT0bw87z0vDBZqhyiwInCudJ33m8Znsg56MF6ZJdL77+4l5LY Ax5SPiHMQmyDTP6JClLqC21ine1CjUvhAM7YcMlaIUMwMYpc3xLOkkREbhXEWIwWbdnt 767hwJ6+uJlggV9xd2FWKRqybc4NrQNbpYOrfuXhwGg9niRTy8xhKJj9qjsRCF5hnaMj anluIxVBX7hXHUuCq5io9RMY/Shh0toxr5aYJ7EYmpmeZ/AUK6ho/SJ1DbN1XfE1DH7b sF1UWBc4oqasrf5ceWuqzg86NgJOWPglGA39z4OtlK9vBNhpIJ7bJmSdKrMV5d+A85sp 92eA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=io5nt842hZrDUsuQvrQy5/diHfQJNzjKEtQRzkcRzzc=; b=wcPlWnWyWWxLTRpojxs0wnvKhqd+b1wF7dFV2ef+SqVH7e64UhQy8Tguk7LbsKbMDx JD76bFGOo/fn41m/QzkFxH1GMEWr56do6oAsv2DRcyA1DMAnW5L6EIMvRAJsZ4glicYw wcNfbO7pEeNU/Up3XXzbeW2Sjr5d7YgsNhtMkCl/nsS1aWINqns4EJ6xXF0GtrnMjYdy rQn2sdduZrgRoSmv/xLdQN7foM4T21IGdnpaQ6SoYF3TPiqmkuIODIugzbSsdASdgZa9 jPkXmkTpwhCAcd37S77x51WXnDLBzOzZbg4AzM9exL+BKbs2oNusG/uZnwuOa1FnIdNR LKQQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xguu5s+s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bx9-20020a17090af48900b001bf73a5460csi205680pjb.0.2022.03.14.12.51.21; Mon, 14 Mar 2022 12:51:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xguu5s+s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239865AbiCNL5G (ORCPT + 99 others); Mon, 14 Mar 2022 07:57:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239841AbiCNL45 (ORCPT ); Mon, 14 Mar 2022 07:56:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B1990AE44; Mon, 14 Mar 2022 04:55:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0B8B26123C; Mon, 14 Mar 2022 11:55:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C058CC340E9; Mon, 14 Mar 2022 11:55:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647258937; bh=uxRqkDKVyWKsiFeWFpHm+0f93z5WEk1dKRzymym8nL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xguu5s+s3kJbg3R+5IckyCe0eWQ9ZENzvyuUfmFpUh05c+pwKQw/pa46XWkf4Z8tg DCrU2VfmKqqMMDsWc5KmGR2kjYDwUd6YCeRNraOoryGRxFOaQJLoh3Eemta/Ca91hi Yvz9YwaAGKiXhaNi8e1HUxyBlKFD7QdL1gkD83vU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Moshe Shemesh , Eran Ben Elisha , Saeed Mahameed , Sasha Levin Subject: [PATCH 5.4 13/43] net/mlx5: Fix a race on command flush flow Date: Mon, 14 Mar 2022 12:53:24 +0100 Message-Id: <20220314112734.791652369@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220314112734.415677317@linuxfoundation.org> References: <20220314112734.415677317@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-8.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Moshe Shemesh [ Upstream commit 063bd355595428750803d8736a9bb7c8db67d42d ] Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock. It fixes the following warning trace: refcount_t: addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] enter_error_state+0x44/0x80 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] process_one_work+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 Fixes: 50b2412b7e78 ("net/mlx5: Avoid possible free of command entry while timeout comp handler") Signed-off-by: Moshe Shemesh Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: Sasha Levin --- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c index 1a7aa078f351..6c7b364d0bf0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c @@ -130,11 +130,8 @@ static int cmd_alloc_index(struct mlx5_cmd *cmd) static void cmd_free_index(struct mlx5_cmd *cmd, int idx) { - unsigned long flags; - - spin_lock_irqsave(&cmd->alloc_lock, flags); + lockdep_assert_held(&cmd->alloc_lock); set_bit(idx, &cmd->bitmask); - spin_unlock_irqrestore(&cmd->alloc_lock, flags); } static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) @@ -144,17 +141,21 @@ static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) { + struct mlx5_cmd *cmd = ent->cmd; + unsigned long flags; + + spin_lock_irqsave(&cmd->alloc_lock, flags); if (!refcount_dec_and_test(&ent->refcnt)) - return; + goto out; if (ent->idx >= 0) { - struct mlx5_cmd *cmd = ent->cmd; - cmd_free_index(cmd, ent->idx); up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); } cmd_free_ent(ent); +out: + spin_unlock_irqrestore(&cmd->alloc_lock, flags); } static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx) -- 2.34.1