Commit a1b80e01 authored by Luo bin's avatar Luo bin Committed by David S. Miller
Browse files

hinic: fix rewaking txq after netif_tx_disable 



When calling hinic_close in hinic_set_channels, all queues are
stopped after netif_tx_disable, but some queue may be rewaken in
free_tx_poll by mistake while drv is handling tx irq. If one queue
is rewaken core may call hinic_xmit_frame to send pkt after
netif_tx_disable within a short time which may results in accessing
memory that has been already freed in hinic_close. So we call
napi_disable before netif_tx_disable in hinic_close to fix this bug.

Fixes: 2eed5a8b ("hinic: add set_channels ethtool_ops support")
Signed-off-by: default avatarLuo bin <luobin9@huawei.com>
Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b5b73b26

drivers/net/ethernet/huawei/hinic/hinic_main.c

+24 −0
Original line number Diff line number Diff line
@@ -174,6 +174,24 @@ err_init_txq: 
	return err;

}



static void enable_txqs_napi(struct hinic_dev *nic_dev)

{

	int num_txqs = hinic_hwdev_num_qps(nic_dev->hwdev);

	int i;



	for (i = 0; i < num_txqs; i++)

		napi_enable(&nic_dev->txqs[i].napi);

}



static void disable_txqs_napi(struct hinic_dev *nic_dev)

{

	int num_txqs = hinic_hwdev_num_qps(nic_dev->hwdev);

	int i;



	for (i = 0; i < num_txqs; i++)

		napi_disable(&nic_dev->txqs[i].napi);

}



/**

 * free_txqs - Free the Logical Tx Queues of specific NIC device

 * @nic_dev: the specific NIC device
@@ -400,6 +418,8 @@ int hinic_open(struct net_device *netdev) 
		goto err_create_txqs;

	}



	enable_txqs_napi(nic_dev);



	err = create_rxqs(nic_dev);

	if (err) {

		netif_err(nic_dev, drv, netdev,
@@ -484,6 +504,7 @@ err_port_state: 
	}



err_create_rxqs:

	disable_txqs_napi(nic_dev);

	free_txqs(nic_dev);



err_create_txqs:
@@ -497,6 +518,9 @@ int hinic_close(struct net_device *netdev) 
	struct hinic_dev *nic_dev = netdev_priv(netdev);

	unsigned int flags;



	/* Disable txq napi firstly to aviod rewaking txq in free_tx_poll */

	disable_txqs_napi(nic_dev);



	down(&nic_dev->mgmt_lock);



	flags = nic_dev->flags;

drivers/net/ethernet/huawei/hinic/hinic_tx.c

+4 −16
Original line number Diff line number Diff line
@@ -745,18 +745,6 @@ static int free_tx_poll(struct napi_struct *napi, int budget) 
	return budget;

}



static void tx_napi_add(struct hinic_txq *txq, int weight)

{

	netif_napi_add(txq->netdev, &txq->napi, free_tx_poll, weight);

	napi_enable(&txq->napi);

}



static void tx_napi_del(struct hinic_txq *txq)

{

	napi_disable(&txq->napi);

	netif_napi_del(&txq->napi);

}



static irqreturn_t tx_irq(int irq, void *data)

{

	struct hinic_txq *txq = data;
@@ -790,7 +778,7 @@ static int tx_request_irq(struct hinic_txq *txq) 


	qp = container_of(sq, struct hinic_qp, sq);



	tx_napi_add(txq, nic_dev->tx_weight);

	netif_napi_add(txq->netdev, &txq->napi, free_tx_poll, nic_dev->tx_weight);



	hinic_hwdev_msix_set(nic_dev->hwdev, sq->msix_entry,

			     TX_IRQ_NO_PENDING, TX_IRQ_NO_COALESC,
@@ -807,14 +795,14 @@ static int tx_request_irq(struct hinic_txq *txq) 
	if (err) {

		netif_err(nic_dev, drv, txq->netdev,

			  "Failed to set TX interrupt coalescing attribute\n");

		tx_napi_del(txq);

		netif_napi_del(&txq->napi);

		return err;

	}



	err = request_irq(sq->irq, tx_irq, 0, txq->irq_name, txq);

	if (err) {

		dev_err(&pdev->dev, "Failed to request Tx irq\n");

		tx_napi_del(txq);

		netif_napi_del(&txq->napi);

		return err;

	}
@@ -826,7 +814,7 @@ static void tx_free_irq(struct hinic_txq *txq) 
	struct hinic_sq *sq = txq->sq;



	free_irq(sq->irq, txq);

	tx_napi_del(txq);

	netif_napi_del(&txq->napi);

}



/**

CRA Git | Maintained and supported by SUSTech CRA and CCSE