Patch "ice: synchronize the misc IRQ when tearing down Tx tracker" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ice: synchronize the misc IRQ when tearing down Tx tracker

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ice-synchronize-the-misc-irq-when-tearing-down-tx-tr.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f7c483874bcc31abb853b046529e00ee3c2b5b83
Author: Jacob Keller <jacob.e.keller@xxxxxxxxx>
Date:   Mon Dec 5 11:52:46 2022 -0800

    ice: synchronize the misc IRQ when tearing down Tx tracker
    
    [ Upstream commit f0ae124019faaa03f8b4c3fbe52ae35ab3a8dbda ]
    
    Since commit 1229b33973c7 ("ice: Add low latency Tx timestamp read") the
    ice driver has used a threaded IRQ for handling Tx timestamps. This change
    did not add a call to synchronize_irq during ice_ptp_release_tx_tracker.
    Thus it is possible that an interrupt could occur just as the tracker is
    being removed. This could lead to a use-after-free of the Tx tracker
    structure data.
    
    Fix this by calling sychronize_irq in ice_ptp_release_tx_tracker after
    we've cleared the init flag. In addition, make sure that we re-check the
    init flag at the end of ice_ptp_tx_tstamp before we exit ensuring that we
    will stop polling for new timestamps once the tracker de-initialization has
    begun.
    
    Refactor the ts_handled variable into "more_timestamps" so that we can
    simply directly assign this boolean instead of relying on an initialized
    value of true. This makes the new combined check easier to read.
    
    With this change, the ice_ptp_release_tx_tracker function will now wait for
    the threaded interrupt to complete if it was executing while the init flag
    was cleared.
    
    Signed-off-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Tested-by: Gurucharan G <gurucharanx.g@xxxxxxxxx> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 0f668468d141..53fec5bbe6e0 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -639,7 +639,7 @@ static u64 ice_ptp_extend_40b_ts(struct ice_pf *pf, u64 in_tstamp)
 static bool ice_ptp_tx_tstamp(struct ice_ptp_tx *tx)
 {
 	struct ice_ptp_port *ptp_port;
-	bool ts_handled = true;
+	bool more_timestamps;
 	struct ice_pf *pf;
 	u8 idx;
 
@@ -701,11 +701,10 @@ static bool ice_ptp_tx_tstamp(struct ice_ptp_tx *tx)
 	 * poll for remaining timestamps.
 	 */
 	spin_lock(&tx->lock);
-	if (!bitmap_empty(tx->in_use, tx->len))
-		ts_handled = false;
+	more_timestamps = tx->init && !bitmap_empty(tx->in_use, tx->len);
 	spin_unlock(&tx->lock);
 
-	return ts_handled;
+	return !more_timestamps;
 }
 
 /**
@@ -776,6 +775,9 @@ ice_ptp_release_tx_tracker(struct ice_pf *pf, struct ice_ptp_tx *tx)
 {
 	tx->init = 0;
 
+	/* wait for potentially outstanding interrupt to complete */
+	synchronize_irq(pf->msix_entries[pf->oicr_idx].vector);
+
 	ice_ptp_flush_tx_tracker(pf, tx);
 
 	kfree(tx->tstamps);