Commit 16b2dd8c authored by Przemyslaw Patynowski's avatar Przemyslaw Patynowski Committed by Tony Nguyen
Browse files

iavf: Fix double free in iavf_reset_task 



Fix double free possibility in iavf_disable_vf, as crit_lock is
freed in caller, iavf_reset_task. Add kernel-doc for iavf_disable_vf.
Remove mutex_unlock in iavf_disable_vf.
Without this patch there is double free scenario, when calling
iavf_reset_task.

Fixes: e85ff9c6 ("iavf: Fix deadlock in iavf_reset_task")
Signed-off-by: default avatarPrzemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Suggested-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
parent 1b4ae7d9

drivers/net/ethernet/intel/iavf/iavf_main.c

+7 −1
Original line number Diff line number Diff line
@@ -2541,6 +2541,13 @@ static void iavf_watchdog_task(struct work_struct *work) 
		queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2);

}



/**

 * iavf_disable_vf - disable VF

 * @adapter: board private structure

 *

 * Set communication failed flag and free all resources.

 * NOTE: This function is expected to be called with crit_lock being held.

 **/

static void iavf_disable_vf(struct iavf_adapter *adapter)

{

	struct iavf_mac_filter *f, *ftmp;
@@ -2595,7 +2602,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) 
	memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE);

	iavf_shutdown_adminq(&adapter->hw);

	adapter->netdev->flags &= ~IFF_UP;

	mutex_unlock(&adapter->crit_lock);

	adapter->flags &= ~IAVF_FLAG_RESET_PENDING;

	iavf_change_state(adapter, __IAVF_DOWN);

	wake_up(&adapter->down_waitqueue);