The PTP auxiliary worker walks every vport and its Rx queues to refresh
the cached PHC time:
idpf_ptp_do_aux_work()
idpf_ptp_update_cached_phctime()
idpf_for_each_vport(adapter, vport)
rsrc = &vport->dflt_qv_rsrc;
for each rsrc->rxq_grps[i]
WRITE_ONCE(rxq->cached_phc_time, systime)
The worker is armed by idpf_ptp_init() during idpf_vc_core_init() and
re-arms itself every 500 ms. This series resolves use-after-free issues
that will happen when the worker attempts to access resources freed by
the driver on teardown and failed init.
Patch 1 introduces rxq_grps_lock and use it to serialize every transition
of rsrc->rxq_grps against the worker. Discovered in testing, the
conditions and trace are included in the patch description.
Patch 2 moves idpf_ptp_release() before deallocating the vports, in the
error path of idpf_init_task(), matching the logic in
idpf_vc_core_deinit(). Discovered while reviewing the fix in patch 1
with respect to other paths that may be problematic for the PTP worker.
The condition was triggered by injecting a failed vport init. Trace is
included in the patch.
For both patches the issues are not HW specific and will manifest for as
long as PTP is enabled by FW.
Emil Tantilov (2):
idpf: fix use-after-free in the PTP auxiliary worker
idpf: release PTP before freeing vports on the init task error path
drivers/net/ethernet/intel/idpf/idpf.h | 5 ++
drivers/net/ethernet/intel/idpf/idpf_lib.c | 9 ++-
drivers/net/ethernet/intel/idpf/idpf_ptp.c | 16 ++++-
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 65 +++++++++++++++------
4 files changed, 73 insertions(+), 22 deletions(-)
--
2.37.3
