Patch "sfc: fix crash when reading stats while NIC is resetting" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    sfc: fix crash when reading stats while NIC is resetting

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7c7835043e5345e44f6601ec4cfab0a95e60d01c
Author: Edward Cree <ecree.xilinx@xxxxxxxxx>
Date:   Fri Jun 23 15:34:48 2023 +0100

    sfc: fix crash when reading stats while NIC is resetting
    
    [ Upstream commit d1b355438b8325a486f087e506d412c4e852f37b ]
    
    efx_net_stats() (.ndo_get_stats64) can be called during an ethtool
     selftest, during which time nic_data->mc_stats is NULL as the NIC has
     been fini'd.  In this case do not attempt to fetch the latest stats
     from the hardware, else we will crash on a NULL dereference:
        BUG: kernel NULL pointer dereference, address: 0000000000000038
        RIP efx_nic_update_stats
        abridged calltrace:
        efx_ef10_update_stats_pf
        efx_net_stats
        dev_get_stats
        dev_seq_printf_stats
    Skipping the read is safe, we will simply give out stale stats.
    To ensure that the free in efx_ef10_fini_nic() does not race against
     efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the
     efx->stats_lock in fini_nic (it is already held across update_stats).
    
    Fixes: d3142c193dca ("sfc: refactor EF10 stats handling")
    Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@xxxxxxx>
    Signed-off-by: Edward Cree <ecree.xilinx@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 302b97c2e617c..b20dbda37c7ef 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1297,8 +1297,10 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)
 {
 	struct efx_ef10_nic_data *nic_data = efx->nic_data;
 
+	spin_lock_bh(&efx->stats_lock);
 	kfree(nic_data->mc_stats);
 	nic_data->mc_stats = NULL;
+	spin_unlock_bh(&efx->stats_lock);
 }
 
 static int efx_ef10_init_nic(struct efx_nic *efx)
@@ -1852,9 +1854,14 @@ static size_t efx_ef10_update_stats_pf(struct efx_nic *efx, u64 *full_stats,
 
 	efx_ef10_get_stat_mask(efx, mask);
 
-	efx_nic_copy_stats(efx, nic_data->mc_stats);
-	efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
-			     mask, stats, nic_data->mc_stats, false);
+	/* If NIC was fini'd (probably resetting), then we can't read
+	 * updated stats right now.
+	 */
+	if (nic_data->mc_stats) {
+		efx_nic_copy_stats(efx, nic_data->mc_stats);
+		efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
+				     mask, stats, nic_data->mc_stats, false);
+	}
 
 	/* Update derived statistics */
 	efx_nic_fix_nodesc_drop_stat(efx,



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux