Commit 3b85720d authored by Yuval Basson's avatar Yuval Basson Committed by David S. Miller
Browse files

qed: Fix race condition between scheduling and destroying the slowpath workqueue 



Calling queue_delayed_work concurrently with
destroy_workqueue might race to an unexpected outcome -
scheduled task after wq is destroyed or other resources
(like ptt_pool) are freed (yields NULL pointer dereference).
cancel_delayed_work prevents the race by cancelling
the timer triggered for scheduling a new task.

Fixes: 59ccf86f ("qed: Add driver infrastucture for handling mfw requests")
Signed-off-by: default avatarDenis Bolotin <dbolotin@marvell.com>
Signed-off-by: default avatarMichal Kalderon <mkalderon@marvell.com>
Signed-off-by: default avatarYuval Basson <ybason@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 798dda81

drivers/net/ethernet/qlogic/qed/qed_main.c

+2 −11
Original line number Diff line number Diff line
@@ -1087,9 +1087,6 @@ static void qed_update_pf_params(struct qed_dev *cdev, 
#define QED_PERIODIC_DB_REC_INTERVAL_MS		100

#define QED_PERIODIC_DB_REC_INTERVAL \

	msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS)

#define QED_PERIODIC_DB_REC_WAIT_COUNT		10

#define QED_PERIODIC_DB_REC_WAIT_INTERVAL \

	(QED_PERIODIC_DB_REC_INTERVAL_MS / QED_PERIODIC_DB_REC_WAIT_COUNT)



static int qed_slowpath_delayed_work(struct qed_hwfn *hwfn,

				     enum qed_slowpath_wq_flag wq_flag,
@@ -1123,7 +1120,7 @@ void qed_periodic_db_rec_start(struct qed_hwfn *p_hwfn) 


static void qed_slowpath_wq_stop(struct qed_dev *cdev)

{

	int i, sleep_count = QED_PERIODIC_DB_REC_WAIT_COUNT;

	int i;



	if (IS_VF(cdev))

		return;
@@ -1135,13 +1132,7 @@ static void qed_slowpath_wq_stop(struct qed_dev *cdev) 
		/* Stop queuing new delayed works */

		cdev->hwfns[i].slowpath_wq_active = false;



		/* Wait until the last periodic doorbell recovery is executed */

		while (test_bit(QED_SLOWPATH_PERIODIC_DB_REC,

				&cdev->hwfns[i].slowpath_task_flags) &&

		       sleep_count--)

			msleep(QED_PERIODIC_DB_REC_WAIT_INTERVAL);



		flush_workqueue(cdev->hwfns[i].slowpath_wq);

		cancel_delayed_work(&cdev->hwfns[i].slowpath_task);

		destroy_workqueue(cdev->hwfns[i].slowpath_wq);

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE