Patch "stmmac: Clear variable when destroying workqueue" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    stmmac: Clear variable when destroying workqueue

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     stmmac-clear-variable-when-destroying-workqueue.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9ec36d8c21e7e96a4065dd440d8f027edd73d6db
Author: Jakub Raczynski <j.raczynski@xxxxxxxxxxx>
Date:   Mon Feb 26 17:42:32 2024 +0100

    stmmac: Clear variable when destroying workqueue
    
    [ Upstream commit 8af411bbba1f457c33734795f024d0ef26d0963f ]
    
    Currently when suspending driver and stopping workqueue it is checked whether
    workqueue is not NULL and if so, it is destroyed.
    Function destroy_workqueue() does drain queue and does clear variable, but
    it does not set workqueue variable to NULL. This can cause kernel/module
    panic if code attempts to clear workqueue that was not initialized.
    
    This scenario is possible when resuming suspended driver in stmmac_resume(),
    because there is no handling for failed stmmac_hw_setup(),
    which can fail and return if DMA engine has failed to initialize,
    and workqueue is initialized after DMA engine.
    Should DMA engine fail to initialize, resume will proceed normally,
    but interface won't work and TX queue will eventually timeout,
    causing 'Reset adapter' error.
    This then does destroy workqueue during reset process.
    And since workqueue is initialized after DMA engine and can be skipped,
    it will cause kernel/module panic.
    
    To secure against this possible crash, set workqueue variable to NULL when
    destroying workqueue.
    
    Log/backtrace from crash goes as follows:
    [88.031977]------------[ cut here ]------------
    [88.031985]NETDEV WATCHDOG: eth0 (sxgmac): transmit queue 1 timed out
    [88.032017]WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:477 dev_watchdog+0x390/0x398
               <Skipping backtrace for watchdog timeout>
    [88.032251]---[ end trace e70de432e4d5c2c0 ]---
    [88.032282]sxgmac 16d88000.ethernet eth0: Reset adapter.
    [88.036359]------------[ cut here ]------------
    [88.036519]Call trace:
    [88.036523] flush_workqueue+0x3e4/0x430
    [88.036528] drain_workqueue+0xc4/0x160
    [88.036533] destroy_workqueue+0x40/0x270
    [88.036537] stmmac_fpe_stop_wq+0x4c/0x70
    [88.036541] stmmac_release+0x278/0x280
    [88.036546] __dev_close_many+0xcc/0x158
    [88.036551] dev_close_many+0xbc/0x190
    [88.036555] dev_close.part.0+0x70/0xc0
    [88.036560] dev_close+0x24/0x30
    [88.036564] stmmac_service_task+0x110/0x140
    [88.036569] process_one_work+0x1d8/0x4a0
    [88.036573] worker_thread+0x54/0x408
    [88.036578] kthread+0x164/0x170
    [88.036583] ret_from_fork+0x10/0x20
    [88.036588]---[ end trace e70de432e4d5c2c1 ]---
    [88.036597]Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
    
    Fixes: 5a5586112b929 ("net: stmmac: support FPE link partner hand-shaking procedure")
    Signed-off-by: Jakub Raczynski <j.raczynski@xxxxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e9a1b60ebb503..de4d769195174 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3942,8 +3942,10 @@ static void stmmac_fpe_stop_wq(struct stmmac_priv *priv)
 {
 	set_bit(__FPE_REMOVING, &priv->fpe_task_state);
 
-	if (priv->fpe_wq)
+	if (priv->fpe_wq) {
 		destroy_workqueue(priv->fpe_wq);
+		priv->fpe_wq = NULL;
+	}
 
 	netdev_info(priv->dev, "FPE workqueue stop");
 }




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux