Commit 76cdc5c5 authored by Sukadev Bhattiprolu's avatar Sukadev Bhattiprolu Committed by Jakub Kicinski
Browse files

ibmvnic: track pending login 



If after ibmvnic sends a LOGIN it gets a FAILOVER, it is possible that
the worker thread will start reset process and free the login response
buffer before it gets a (now stale) LOGIN_RSP. The ibmvnic tasklet will
then try to access the login response buffer and crash.

Have ibmvnic track pending logins and discard any stale login responses.

Fixes: 032c5e82 ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: default avatarSukadev Bhattiprolu <sukadev@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent f15fde9d

drivers/net/ethernet/ibm/ibmvnic.c

+17 −0
Original line number Diff line number Diff line
@@ -3841,6 +3841,8 @@ static int send_login(struct ibmvnic_adapter *adapter) 
	crq.login.cmd = LOGIN;

	crq.login.ioba = cpu_to_be32(buffer_token);

	crq.login.len = cpu_to_be32(buffer_size);



	adapter->login_pending = true;

	ibmvnic_send_crq(adapter, &crq);



	return 0;
@@ -4393,6 +4395,15 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq, 
	u64 *size_array;

	int i;



	/* CHECK: Test/set of login_pending does not need to be atomic

	 * because only ibmvnic_tasklet tests/clears this.

	 */

	if (!adapter->login_pending) {

		netdev_warn(netdev, "Ignoring unexpected login response\n");

		return 0;

	}

	adapter->login_pending = false;



	dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,

			 DMA_TO_DEVICE);

	dma_unmap_single(dev, adapter->login_rsp_buf_token,
@@ -4764,6 +4775,11 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, 
		case IBMVNIC_CRQ_INIT:

			dev_info(dev, "Partner initialized\n");

			adapter->from_passive_init = true;

			/* Discard any stale login responses from prev reset.

			 * CHECK: should we clear even on INIT_COMPLETE?

			 */

			adapter->login_pending = false;



			if (!completion_done(&adapter->init_done)) {

				complete(&adapter->init_done);

				adapter->init_done_rc = -EIO;
@@ -5196,6 +5212,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) 
	dev_set_drvdata(&dev->dev, netdev);

	adapter->vdev = dev;

	adapter->netdev = netdev;

	adapter->login_pending = false;



	ether_addr_copy(adapter->mac_addr, mac_addr_p);

	ether_addr_copy(netdev->dev_addr, adapter->mac_addr);

drivers/net/ethernet/ibm/ibmvnic.h

+1 −0
Original line number Diff line number Diff line
@@ -1086,6 +1086,7 @@ struct ibmvnic_adapter { 
	struct delayed_work ibmvnic_delayed_reset;

	unsigned long resetting;

	bool napi_enabled, from_passive_init;

	bool login_pending;



	bool failover_pending;

	bool force_reset_recovery;