Commit 3a444e2b authored by Hao Chen's avatar Hao Chen Committed by Jiantao Xiao
Browse files

net: hns3: fix debugfs concurrency issue between kfree buffer and read 

mainline inclusion
from mainline-v6.6-rc1
commit c295160b
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7YRUW
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c295160b1d95e885f1af4586a221cb221d232d10



----------------------------------------------------------------------

Now in hns3_dbg_uninit(), there may be concurrency between
kfree buffer and read, it may result in memory error.

Moving debugfs_remove_recursive() in front of kfree buffer to ensure
they don't happen at the same time.

Fixes: 5e69ea7e ("net: hns3: refactor the debugfs process")
Signed-off-by: default avatarHao Chen <chenhao418@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarJiantao Xiao <xiaojiantao1@h-partners.com>
parent c9ee9209

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

+4 −3
Original line number Diff line number Diff line
@@ -1419,9 +1419,9 @@ int hns3_dbg_init(struct hnae3_handle *handle) 
	return 0;



out:

	mutex_destroy(&handle->dbgfs_lock);

	debugfs_remove_recursive(handle->hnae3_dbgfs);

	handle->hnae3_dbgfs = NULL;

	mutex_destroy(&handle->dbgfs_lock);

	return ret;

}
@@ -1429,6 +1429,9 @@ void hns3_dbg_uninit(struct hnae3_handle *handle) 
{

	u32 i;



	debugfs_remove_recursive(handle->hnae3_dbgfs);

	handle->hnae3_dbgfs = NULL;



	for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++)

		if (handle->dbgfs_buf[i]) {

			kvfree(handle->dbgfs_buf[i]);
@@ -1436,8 +1439,6 @@ void hns3_dbg_uninit(struct hnae3_handle *handle) 
		}



	mutex_destroy(&handle->dbgfs_lock);

	debugfs_remove_recursive(handle->hnae3_dbgfs);

	handle->hnae3_dbgfs = NULL;

}



void hns3_dbg_register_debugfs(const char *debugfs_dir_name)