[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20241104174312.GG2118587@kernel.org>
Date: Mon, 4 Nov 2024 17:43:12 +0000
From: Simon Horman <horms@...nel.org>
To: Jijie Shao <shaojijie@...wei.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
pabeni@...hat.com, andrew+netdev@...n.ch, shenjian15@...wei.com,
salil.mehta@...wei.com, liuyonglong@...wei.com,
wangpeiyang1@...wei.com, chenhao418@...wei.com,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: hns3: fix kernel crash when uninstalling driver
On Fri, Nov 01, 2024 at 05:15:07PM +0800, Jijie Shao wrote:
> From: Peiyang Wang <wangpeiyang1@...wei.com>
>
> When the driver is uninstalled and the VF is disabled concurrently, a
> kernel crash occurs. The reason is that the two actions call function
> pci_disable_sriov(). The num_VFs is checked to determine whether to
> release the corresponding resources. During the second calling, num_VFs
> is not 0 and the resource release function is called. However, the
> corresponding resource has been released during the first invoking.
> Therefore, the problem occurs:
>
> [15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
> ...
> [15278.131557][T50670] Call trace:
> [15278.134686][T50670] klist_put+0x28/0x12c
> [15278.138682][T50670] klist_del+0x14/0x20
> [15278.142592][T50670] device_del+0xbc/0x3c0
> [15278.146676][T50670] pci_remove_bus_device+0x84/0x120
> [15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80
> [15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c
> [15278.162485][T50670] sriov_disable+0x50/0x11c
> [15278.166829][T50670] pci_disable_sriov+0x24/0x30
> [15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
> [15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge]
> [15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230
> [15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30
> [15278.193848][T50670] invoke_syscall+0x50/0x11c
> [15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164
> [15278.203837][T50670] do_el0_svc+0x34/0xcc
> [15278.207834][T50670] el0_svc+0x20/0x30
>
> For details, see the following figure.
>
> rmmod hclge disable VFs
> ----------------------------------------------------
> hclge_exit() sriov_numvfs_store()
> ... device_lock()
> pci_disable_sriov() hns3_pci_sriov_configure()
> pci_disable_sriov()
> sriov_disable()
> sriov_disable() if !num_VFs :
> if !num_VFs : return;
> return; sriov_del_vfs()
> sriov_del_vfs() ...
> ... klist_put()
> klist_put() ...
> ... num_VFs = 0;
> num_VFs = 0; device_unlock();
>
> In this patch, when driver is removing, we get the device_lock()
> to protect num_VFs, just like sriov_numvfs_store().
>
> Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
> Signed-off-by: Peiyang Wang <wangpeiyang1@...wei.com>
> Signed-off-by: Jijie Shao <shaojijie@...wei.com>
Reviewed-by: Simon Horman <horms@...nel.org>
Powered by blists - more mailing lists