[PATCH] qed: qed ll2 race condition fixes

[PATCH] qed: qed ll2 race condition fixes

[Shai Malin]

Avoiding qed ll2 race condition and NULL pointer dereference as part
of the remove and recovery flows.

Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
---
 drivers/net/ethernet/qlogic/qed/qed_ll2.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 02a4610d9330..927e163cc9d6 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -327,6 +327,9 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
 	unsigned long flags;
 	int rc = -EINVAL;
 
+	if (!p_ll2_conn)
+		return rc;
+
 	spin_lock_irqsave(&p_tx->lock, flags);
 	if (p_tx->b_completing_packet) {
 		rc = -EBUSY;
@@ -500,7 +503,16 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
 	unsigned long flags = 0;
 	int rc = 0;
 
+	if (!p_ll2_conn)
+		return rc;
+
 	spin_lock_irqsave(&p_rx->lock, flags);
+
+	if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) {
+		spin_unlock_irqrestore(&p_rx->lock, flags);
+		return 0;
+	}
+
 	cq_new_idx = le16_to_cpu(*p_rx->p_fw_cons);
 	cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
 
@@ -821,6 +833,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
 	struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie;
 	int rc;
 
+	if (!p_ll2_conn)
+		return 0;
+
 	if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
 		return 0;
 
@@ -844,6 +859,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
 	u16 new_idx = 0, num_bds = 0;
 	int rc;
 
+	if (!p_ll2_conn)
+		return 0;
+
 	if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
 		return 0;
 
@@ -1728,6 +1746,8 @@ int qed_ll2_post_rx_buffer(void *cxt,
 	if (!p_ll2_conn)
 		return -EINVAL;
 	p_rx = &p_ll2_conn->rx_queue;
+	if (p_rx->set_prod_addr == NULL)
+		return -EIO;
 
 	spin_lock_irqsave(&p_rx->lock, flags);
 	if (!list_empty(&p_rx->free_descq))
@@ -1742,7 +1762,7 @@ int qed_ll2_post_rx_buffer(void *cxt,
 		}
 	}
 
-	/* If we're lacking entires, let's try to flush buffers to FW */
+	/* If we're lacking entries, let's try to flush buffers to FW */
 	if (!p_curp || !p_curb) {
 		rc = -EBUSY;
 		p_curp = NULL;
@@ -2589,7 +2609,6 @@ static int qed_ll2_start(struct qed_dev *cdev, struct qed_ll2_params *params)
 			DP_NOTICE(cdev, "Failed to add an LLH filter\n");
 			goto err3;
 		}
-
 	}
 
 	ether_addr_copy(cdev->ll2_mac_address, params->ll2_mac_address);
-- 
2.22.0

Re: [PATCH] qed: qed ll2 race condition fixes

[Jakub Kicinski]

On Wed, 11 Aug 2021 19:28:55 +0300 Shai Malin wrote:
> @@ -1728,6 +1746,8 @@ int qed_ll2_post_rx_buffer(void *cxt,
>  	if (!p_ll2_conn)
>  		return -EINVAL;
>  	p_rx = &p_ll2_conn->rx_queue;
> +	if (p_rx->set_prod_addr == NULL)
> +		return -EIO;

Please use !p_rx->set_prod_addr as suggested by checkpatch

RE: [EXT] Re: [PATCH] qed: qed ll2 race condition fixes

[Shai Malin]

On Thu, 12 Aug 2021 at 01:51, Jakub Kicinski wrote: 
> On Wed, 11 Aug 2021 19:28:55 +0300 Shai Malin wrote:
> > @@ -1728,6 +1746,8 @@ int qed_ll2_post_rx_buffer(void *cxt,
> >  	if (!p_ll2_conn)
> >  		return -EINVAL;
> >  	p_rx = &p_ll2_conn->rx_queue;
> > +	if (p_rx->set_prod_addr == NULL)
> > +		return -EIO;
> 
> Please use !p_rx->set_prod_addr as suggested by checkpatch

Sure, will be fixed in V2.