• Somnath Kotur's avatar
    bnxt_en: Check abort error state in bnxt_half_open_nic() · 11a39259
    Somnath Kotur authored
    bnxt_half_open_nic() is called during during ethtool self test and is
    protected by rtnl_lock.  Firmware reset can be happening at the same
    time.  Only critical portions of the entire firmware reset sequence
    are protected by the rtnl_lock.  It is possible that bnxt_half_open_nic()
    can be called when the firmware reset sequence is aborting.  In that
    case, bnxt_half_open_nic() needs to check if the ABORT_ERR flag is set
    and abort if it is.  The ethtool self test will fail but the NIC will be
    brought to a consistent IF_DOWN state.
    
    Without this patch, if bnxt_half_open_nic() were to continue in this
    error state, it may crash like this:
    
      bnxt_en 0000:82:00.1 enp130s0f1np1: FW reset in progress during close, FW reset will be aborted
      Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      ...
      Process ethtool (pid: 333327, stack limit = 0x0000000046476577)
      Call trace:
      bnxt_alloc_mem+0x444/0xef0 [bnxt_en]
      bnxt_half_open_nic+0x24/0xb8 [bnxt_en]
      bnxt_self_test+0x2dc/0x390 [bnxt_en]
      ethtool_self_test+0xe0/0x1f8
      dev_ethtool+0x1744/0x22d0
      dev_ioctl+0x190/0x3e0
      sock_ioctl+0x238/0x480
      do_vfs_ioctl+0xc4/0x758
      ksys_ioctl+0x84/0xb8
      __arm64_sys_ioctl+0x28/0x38
      el0_svc_handler+0xb0/0x180
      el0_svc+0x8/0xc
    
    Fixes: a1301f08 ("bnxt_en: Check abort error state in bnxt_open_nic().")
    Signed-off-by: default avatarSomnath Kotur <somnath.kotur@broadcom.com>
    Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    11a39259
bnxt.c 358 KB