Patch "devlink: hold region lock when flushing snapshots" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    devlink: hold region lock when flushing snapshots

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     devlink-hold-region-lock-when-flushing-snapshots.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7900cb775b18791f4a8f72eb85270f94920684ce
Author: Jakub Kicinski <kuba@xxxxxxxxxx>
Date:   Wed Dec 14 18:01:00 2022 -0800

    devlink: hold region lock when flushing snapshots
    
    [ Upstream commit b4cafb3d2c740f8d1b1234b43ac4a60e5291c960 ]
    
    Netdevsim triggers a splat on reload, when it destroys regions
    with snapshots pending:
    
      WARNING: CPU: 1 PID: 787 at net/core/devlink.c:6291 devlink_region_snapshot_del+0x12e/0x140
      CPU: 1 PID: 787 Comm: devlink Not tainted 6.1.0-07460-g7ae9888d6e1c #580
      RIP: 0010:devlink_region_snapshot_del+0x12e/0x140
      Call Trace:
       <TASK>
       devl_region_destroy+0x70/0x140
       nsim_dev_reload_down+0x2f/0x60 [netdevsim]
       devlink_reload+0x1f7/0x360
       devlink_nl_cmd_reload+0x6ce/0x860
       genl_family_rcv_msg_doit.isra.0+0x145/0x1c0
    
    This is the locking assert in devlink_region_snapshot_del(),
    we're supposed to be holding the region->snapshot_lock here.
    
    Fixes: 2dec18ad826f ("net: devlink: remove region snapshots list dependency on devlink->lock")
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/devlink.c b/net/core/devlink.c
index cfa6a099457a..b3a869ccc8ed 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -11358,8 +11358,10 @@ void devl_region_destroy(struct devlink_region *region)
 	devl_assert_locked(devlink);
 
 	/* Free all snapshots of region */
+	mutex_lock(&region->snapshot_lock);
 	list_for_each_entry_safe(snapshot, ts, &region->snapshot_list, list)
 		devlink_region_snapshot_del(region, snapshot);
+	mutex_unlock(&region->snapshot_lock);
 
 	list_del(&region->list);
 	mutex_destroy(&region->snapshot_lock);