From patchwork Sun Jul 18 19:36:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Chan X-Patchwork-Id: 479781 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-20.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, MIME_HEADER_CTYPE_ONLY, SPF_HELO_NONE, SPF_PASS, T_TVD_MIME_NO_HEADERS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9ADFCC636CB for ; Sun, 18 Jul 2021 19:37:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 80978600D1 for ; Sun, 18 Jul 2021 19:37:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232718AbhGRTj5 (ORCPT ); Sun, 18 Jul 2021 15:39:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33232 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232685AbhGRTjy (ORCPT ); Sun, 18 Jul 2021 15:39:54 -0400 Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13900C0613DC for ; Sun, 18 Jul 2021 12:36:56 -0700 (PDT) Received: by mail-pj1-x1033.google.com with SMTP id jx7-20020a17090b46c7b02901757deaf2c8so10640855pjb.0 for ; Sun, 18 Jul 2021 12:36:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=PGtu9gXsE9eKcTfKhMF9/4Fku9aurqwITVl4XRUTWwU=; b=TvTWiNBR2TloQauGQJTjBkDS0G4PhAyzEfWqHMF8ZZIA/Y9BESzdUlRA9USf6oX8RF sVfLtzlViBNsbJzUHj+aMUMBgmvyOB0FW+aF1cshiadgPHhMYm4qHLrdeC11pHHD9NlH B1HtfHWCjiZGewbB0/86i5hi2njeqsYhWCUBE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=PGtu9gXsE9eKcTfKhMF9/4Fku9aurqwITVl4XRUTWwU=; b=UwtY8HHocXhNu8/j3l/oS5DlrMY9iztkZkNTDwBbjpg0owk/RnQoseaQ+5kFQIrfR2 uo6fH1VSDYZYx8cmTUnYKI7wiNNJXNpUQW/8S+hvArs/HjSWgv1+TAxOXs80LppOwEex YJFL74hiFv/u7Qajr2oT+XiAK+6voBA5n13tyZP8f7Qut4z/yKF3fYdkPxRDc6Xf6BJ4 oP6qY2ih/auqBW7EqGvGcxqGsAI455nT+sPqgbCVniY0dguG9ud3eYXu/Qq713eOsG8i AsgEZdZoVmDIQp9RG4IwEOnSsOf4X+Ur9xXqx6IBsmxcErbws9VDLsviiWEG9QN0O/dM pIOg== X-Gm-Message-State: AOAM5305v9PX2gzP+At6VGgf4aXz1CzbrGCkAXuBLYx31FikhcUEZSnt OonDLLByA2MH/kakyP0OtQBmUw== X-Google-Smtp-Source: ABdhPJzrnmLfG46JR+66b/ilMOm/2PqKXPJrKRCeUPJT4Ea898Ne8n2Wq69x992ypy2xhCxsXNvZDw== X-Received: by 2002:a17:902:a503:b029:12b:2429:385e with SMTP id s3-20020a170902a503b029012b2429385emr16566968plq.64.1626637015346; Sun, 18 Jul 2021 12:36:55 -0700 (PDT) Received: from localhost.swdvt.lab.broadcom.net ([192.19.223.252]) by smtp.gmail.com with ESMTPSA id 22sm16743648pfo.80.2021.07.18.12.36.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 18 Jul 2021 12:36:54 -0700 (PDT) From: Michael Chan To: davem@davemloft.net Cc: netdev@vger.kernel.org, kuba@kernel.org, gospo@broadcom.com Subject: [PATCH net 7/9] bnxt_en: Check abort error state in bnxt_half_open_nic() Date: Sun, 18 Jul 2021 15:36:31 -0400 Message-Id: <1626636993-31926-8-git-send-email-michael.chan@broadcom.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1626636993-31926-1-git-send-email-michael.chan@broadcom.com> References: <1626636993-31926-1-git-send-email-michael.chan@broadcom.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Somnath Kotur bnxt_half_open_nic() is called during during ethtool self test and is protected by rtnl_lock. Firmware reset can be happening at the same time. Only critical portions of the entire firmware reset sequence are protected by the rtnl_lock. It is possible that bnxt_half_open_nic() can be called when the firmware reset sequence is aborting. In that case, bnxt_half_open_nic() needs to check if the ABORT_ERR flag is set and abort if it is. The ethtool self test will fail but the NIC will be brought to a consistent IF_DOWN state. Without this patch, if bnxt_half_open_nic() were to continue in this error state, it may crash like this: bnxt_en 0000:82:00.1 enp130s0f1np1: FW reset in progress during close, FW reset will be aborted Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... Process ethtool (pid: 333327, stack limit = 0x0000000046476577) Call trace: bnxt_alloc_mem+0x444/0xef0 [bnxt_en] bnxt_half_open_nic+0x24/0xb8 [bnxt_en] bnxt_self_test+0x2dc/0x390 [bnxt_en] ethtool_self_test+0xe0/0x1f8 dev_ethtool+0x1744/0x22d0 dev_ioctl+0x190/0x3e0 sock_ioctl+0x238/0x480 do_vfs_ioctl+0xc4/0x758 ksys_ioctl+0x84/0xb8 __arm64_sys_ioctl+0x28/0x38 el0_svc_handler+0xb0/0x180 el0_svc+0x8/0xc Fixes: a1301f08c5ac ("bnxt_en: Check abort error state in bnxt_open_nic().") Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 169f093e01de..31eb3c00851a 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -10208,6 +10208,12 @@ int bnxt_half_open_nic(struct bnxt *bp) { int rc = 0; + if (test_bit(BNXT_STATE_ABORT_ERR, &bp->state)) { + netdev_err(bp->dev, "A previous firmware reset has not completed, aborting half open\n"); + rc = -ENODEV; + goto half_open_err; + } + rc = bnxt_alloc_mem(bp, false); if (rc) { netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc);