Commit c2e16545 authored by Aleksandr Loktionov's avatar Aleksandr Loktionov Committed by Yongqiang Liu
Browse files

i40e: fix vf may be used uninitialized in this function warning 

stable inclusion
from stable-v5.10.215
commit b8e82128b44fa40bf99a50b919488ef361e1683c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM2V
CVE: CVE-2024-36020

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b8e82128b44fa40bf99a50b919488ef361e1683c



--------------------------------

commit f37c4eac99c258111d414d31b740437e1925b8e8 upstream.

To fix the regression introduced by commit 52424f97, which causes
servers hang in very hard to reproduce conditions with resets races.
Using two sources for the information is the root cause.
In this function before the fix bumping v didn't mean bumping vf
pointer. But the code used this variables interchangeably, so stale vf
could point to different/not intended vf.

Remove redundant "v" variable and iterate via single VF pointer across
whole function instead to guarantee VF pointer validity.

Fixes: 52424f97 ("i40e: Fix VF hang when reset is triggered on another VF")
Signed-off-by: default avatarAleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Reviewed-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: default avatarPaul Menzel <pmenzel@molgen.mpg.de>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 9fac591d

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

+16 −18
Original line number Diff line number Diff line
@@ -1573,8 +1573,8 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
{

	struct i40e_hw *hw = &pf->hw;

	struct i40e_vf *vf;

	int i, v;

	u32 reg;

	int i;



	/* If we don't have any VFs, then there is nothing to reset */

	if (!pf->num_alloc_vfs)
@@ -1585,11 +1585,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
		return false;



	/* Begin reset on all VFs at once */

	for (v = 0; v < pf->num_alloc_vfs; v++) {

		vf = &pf->vf[v];

	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {

		/* If VF is being reset no need to trigger reset again */

		if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))

			i40e_trigger_vf_reset(&pf->vf[v], flr);

			i40e_trigger_vf_reset(vf, flr);

	}



	/* HW requires some time to make sure it can flush the FIFO for a VF
@@ -1598,14 +1597,13 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
	 * the VFs using a simple iterator that increments once that VF has

	 * finished resetting.

	 */

	for (i = 0, v = 0; i < 10 && v < pf->num_alloc_vfs; i++) {

	for (i = 0, vf = &pf->vf[0]; i < 10 && vf < &pf->vf[pf->num_alloc_vfs]; ++i) {

		usleep_range(10000, 20000);



		/* Check each VF in sequence, beginning with the VF to fail

		 * the previous check.

		 */

		while (v < pf->num_alloc_vfs) {

			vf = &pf->vf[v];

		while (vf < &pf->vf[pf->num_alloc_vfs]) {

			if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) {

				reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id));

				if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK))
@@ -1615,7 +1613,7 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
			/* If the current VF has finished resetting, move on

			 * to the next VF in sequence.

			 */

			v++;

			++vf;

		}

	}
@@ -1625,39 +1623,39 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
	/* Display a warning if at least one VF didn't manage to reset in

	 * time, but continue on with the operation.

	 */

	if (v < pf->num_alloc_vfs)

	if (vf < &pf->vf[pf->num_alloc_vfs])

		dev_err(&pf->pdev->dev, "VF reset check timeout on VF %d\n",

			pf->vf[v].vf_id);

			vf->vf_id);

	usleep_range(10000, 20000);



	/* Begin disabling all the rings associated with VFs, but do not wait

	 * between each VF.

	 */

	for (v = 0; v < pf->num_alloc_vfs; v++) {

	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {

		/* On initial reset, we don't have any queues to disable */

		if (pf->vf[v].lan_vsi_idx == 0)

		if (vf->lan_vsi_idx == 0)

			continue;



		/* If VF is reset in another thread just continue */

		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))

			continue;



		i40e_vsi_stop_rings_no_wait(pf->vsi[pf->vf[v].lan_vsi_idx]);

		i40e_vsi_stop_rings_no_wait(pf->vsi[vf->lan_vsi_idx]);

	}



	/* Now that we've notified HW to disable all of the VF rings, wait

	 * until they finish.

	 */

	for (v = 0; v < pf->num_alloc_vfs; v++) {

	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {

		/* On initial reset, we don't have any queues to disable */

		if (pf->vf[v].lan_vsi_idx == 0)

		if (vf->lan_vsi_idx == 0)

			continue;



		/* If VF is reset in another thread just continue */

		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))

			continue;



		i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[v].lan_vsi_idx]);

		i40e_vsi_wait_queues_disabled(pf->vsi[vf->lan_vsi_idx]);

	}



	/* Hw may need up to 50ms to finish disabling the RX queues. We
@@ -1666,12 +1664,12 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) 
	mdelay(50);



	/* Finish the reset on each VF */

	for (v = 0; v < pf->num_alloc_vfs; v++) {

	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {

		/* If VF is reset in another thread just continue */

		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))

			continue;



		i40e_cleanup_reset_vf(&pf->vf[v]);

		i40e_cleanup_reset_vf(vf);

	}



	i40e_flush(hw);