Patch "ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ice-check-ice_vsi_down-under-rtnl_lock-when-preparin.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a05b25c275d94d9723e32d7607ee1cd957205765
Author: Larysa Zaremba <larysa.zaremba@xxxxxxxxx>
Date:   Fri Aug 23 11:59:29 2024 +0200

    ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
    
    [ Upstream commit d8c40b9d3a6cef61eb5a0c58c34a3090ea938d89 ]
    
    Consider the following scenario:
    
    .ndo_bpf()              | ice_prepare_for_reset()               |
    ________________________|_______________________________________|
    rtnl_lock()             |                                       |
    ice_down()              |                                       |
                            | test_bit(ICE_VSI_DOWN) - true         |
                            | ice_dis_vsi() returns                 |
    ice_up()                |                                       |
                            | proceeds to rebuild a running VSI     |
    
    .ndo_bpf() is not the only rtnl-locked callback that toggles the interface
    to apply new configuration. Another example is .set_channels().
    
    To avoid the race condition above, act only after reading ICE_VSI_DOWN
    under rtnl_lock.
    
    Fixes: 0f9d5027a749 ("ice: Refactor VSI allocation, deletion and rebuild flow")
    Reviewed-by: Wojciech Drewek <wojciech.drewek@xxxxxxxxx>
    Reviewed-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Tested-by: Chandan Kumar Rout <chandanx.rout@xxxxxxxxx>
    Signed-off-by: Larysa Zaremba <larysa.zaremba@xxxxxxxxx>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 8c0ee9a8ff86..8a00864ead7c 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -2751,8 +2751,7 @@ int ice_ena_vsi(struct ice_vsi *vsi, bool locked)
  */
 void ice_dis_vsi(struct ice_vsi *vsi, bool locked)
 {
-	if (test_bit(ICE_VSI_DOWN, vsi->state))
-		return;
+	bool already_down = test_bit(ICE_VSI_DOWN, vsi->state);
 
 	set_bit(ICE_VSI_NEEDS_RESTART, vsi->state);
 
@@ -2760,15 +2759,16 @@ void ice_dis_vsi(struct ice_vsi *vsi, bool locked)
 		if (netif_running(vsi->netdev)) {
 			if (!locked)
 				rtnl_lock();
-
-			ice_vsi_close(vsi);
+			already_down = test_bit(ICE_VSI_DOWN, vsi->state);
+			if (!already_down)
+				ice_vsi_close(vsi);
 
 			if (!locked)
 				rtnl_unlock();
-		} else {
+		} else if (!already_down) {
 			ice_vsi_close(vsi);
 		}
-	} else if (vsi->type == ICE_VSI_CTRL) {
+	} else if (vsi->type == ICE_VSI_CTRL && !already_down) {
 		ice_vsi_close(vsi);
 	}
 }