Unverified Commit bed633e6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7512 [sync] PR-7408: backport important fix for broadcom net card 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/7408 
 
PR sync from: Baogen Shang <baogen.shang@outlook.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NN5YDDZOUZ4KSRNZXCFEO5RIGNGCD6QZ/ 
From: Baogen Shang <baogen.shang@windriver.com>

David Christensen (1):
  net/tg3: resolve deadlock in tg3_reset_task() during EEH

Dinghao Liu (1):
  net: bnxt: fix a potential use-after-free in bnxt_init_tc

Thinh Tran (2):
  net/bnx2x: Prevent access to a freed page in page_pool
  net/tg3: fix race condition in tg3_reset_task()


-- 
2.33.0
 
https://gitee.com/openeuler/kernel/issues/I9J6AL 
 
Link:https://gitee.com/openeuler/kernel/pulls/7512

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 303dc005 648f1c96

drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h

+3 −3
Original line number Diff line number Diff line
@@ -1002,9 +1002,6 @@ static inline void bnx2x_set_fw_mac_addr(__le16 *fw_hi, __le16 *fw_mid, 
static inline void bnx2x_free_rx_mem_pool(struct bnx2x *bp,

					  struct bnx2x_alloc_pool *pool)

{

	if (!pool->page)

		return;



	put_page(pool->page);



	pool->page = NULL;
@@ -1015,6 +1012,9 @@ static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp, 
{

	int i;



	if (!fp->page_pool.page)

		return;



	if (fp->mode == TPA_MODE_DISABLED)

		return;

drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c

+1 −0
Original line number Diff line number Diff line
@@ -2061,6 +2061,7 @@ int bnxt_init_tc(struct bnxt *bp) 
	rhashtable_destroy(&tc_info->flow_table);

free_tc_info:

	kfree(tc_info);

	bp->tc_info = NULL;

	return rc;

}

drivers/net/ethernet/broadcom/tg3.c

+13 −4
Original line number Diff line number Diff line
@@ -6454,6 +6454,14 @@ static void tg3_dump_state(struct tg3 *tp) 
	int i;

	u32 *regs;



	/* If it is a PCI error, all registers will be 0xffff,

	 * we don't dump them out, just report the error and return

	 */

	if (tp->pdev->error_state != pci_channel_io_normal) {

		netdev_err(tp->dev, "PCI channel ERROR!\n");

		return;

	}



	regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC);

	if (!regs)

		return;
@@ -11186,7 +11194,8 @@ static void tg3_reset_task(struct work_struct *work) 
	rtnl_lock();

	tg3_full_lock(tp, 0);



	if (!netif_running(tp->dev)) {

	if (tp->pcierr_recovery || !netif_running(tp->dev) ||

	    tp->pdev->error_state != pci_channel_io_normal) {

		tg3_flag_clear(tp, RESET_TASK_PENDING);

		tg3_full_unlock(tp);

		rtnl_unlock();
@@ -18192,6 +18201,9 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, 


	netdev_info(netdev, "PCI I/O error detected\n");



	/* Want to make sure that the reset task doesn't run */

	tg3_reset_task_cancel(tp);



	rtnl_lock();



	/* Could be second call or maybe we don't have netdev yet */
@@ -18208,9 +18220,6 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, 


	tg3_timer_stop(tp);



	/* Want to make sure that the reset task doesn't run */

	tg3_reset_task_cancel(tp);



	netif_device_detach(netdev);



	/* Clean up software state, even if MMIO is blocked */