Patch "net/mlx5: Always drain health in shutdown callback" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/mlx5: Always drain health in shutdown callback

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-mlx5-always-drain-health-in-shutdown-callback.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 659a51c0ae7856d806f0d02df1615f9e7788e843
Author: Shay Drory <shayd@xxxxxxxxxx>
Date:   Thu Oct 10 15:01:07 2024 +0800

    net/mlx5: Always drain health in shutdown callback
    
    [ Upstream commit 1b75da22ed1e6171e261bc9265370162553d5393 ]
    
    There is no point in recovery during device shutdown. if health
    work started need to wait for it to avoid races and NULL pointer
    access.
    
    Hence, drain health WQ on shutdown callback.
    
    Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver")
    Fixes: d2aa060d40fa ("net/mlx5: Cancel health poll before sending panic teardown command")
    Signed-off-by: Shay Drory <shayd@xxxxxxxxxx>
    Reviewed-by: Moshe Shemesh <moshe@xxxxxxxxxx>
    Signed-off-by: Tariq Toukan <tariqt@xxxxxxxxxx>
    Reviewed-by: Wojciech Drewek <wojciech.drewek@xxxxxxxxx>
    Link: https://patch.msgid.link/20240730061638.1831002-2-tariqt@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
    [Xiangyu: Modified to apply on 6.1.y to fix CVE-2024-43866]
    Signed-off-by: Xiangyu Chen <xiangyu.chen@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 76af59cfdd0e6..825ad7663fa45 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1950,7 +1950,6 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
 	/* Panic tear down fw command will stop the PCI bus communication
 	 * with the HCA, so the health poll is no longer needed.
 	 */
-	mlx5_drain_health_wq(dev);
 	mlx5_stop_health_poll(dev, false);
 
 	ret = mlx5_cmd_fast_teardown_hca(dev);
@@ -1985,6 +1984,7 @@ static void shutdown(struct pci_dev *pdev)
 
 	mlx5_core_info(dev, "Shutdown was called\n");
 	set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
+	mlx5_drain_health_wq(dev);
 	err = mlx5_try_fast_unload(dev);
 	if (err)
 		mlx5_unload_one(dev, false);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
index 2424cdf9cca99..d6850eb0ed7f4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
@@ -75,6 +75,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev)
 {
 	struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
 
+	mlx5_drain_health_wq(sf_dev->mdev);
 	mlx5_unload_one(sf_dev->mdev, false);
 }