Akiva Goldberger 8fae72ddcf net/mlx5: Discard command completions in internal error ... [ Upstream commit db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 ] Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 Fixes: 51d138c2610a ("net/mlx5: Fix health error state handling") Signed-off-by: Akiva Goldberger <agoldberger@nvidia.com> Reviewed-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://lore.kernel.org/r/20240509112951.590184-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-19 12:26:57 +01:00
..
appletalk
arcnet	arcnet: restoring support for multiple Sohard Arcnet cards	2024-11-18 12:11:39 +01:00
bonding	bonding: remove print in bond_verify_device_path	2024-11-18 12:13:23 +01:00
caif
can	can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()	2024-11-18 11:42:49 +01:00
dropdump
dsa	net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341	2024-11-19 11:32:43 +01:00
ethernet	net/mlx5: Discard command completions in internal error	2024-11-19 12:26:57 +01:00
fddi
fjes	fjes: fix memleaks in fjes_hw_setup	2024-11-18 12:13:01 +01:00
hamradio
hippi
hyperv	hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed	2024-11-18 23:19:52 +01:00
ieee802154	net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()	2024-11-18 10:58:29 +01:00
ipa
ipvlan	ipvlan: add ipvlan_route_v6_outbound() helper	2024-11-18 11:43:19 +01:00
mdio
netdevsim
pcs
phy	net: phy: dp83822: Fix RGMII TX delay configuration	2024-11-19 08:44:49 +01:00
plip
ppp	ppp_async: limit MRU to 64K	2024-11-18 12:13:25 +01:00
slip
team	team: Fix use-after-free when an option instance allocation fails	2024-11-18 12:11:57 +01:00
usb	net: usb: smsc95xx: stop lying about skb->truesize	2024-11-19 12:26:57 +01:00
vmxnet3
vxlan	vxlan: drop packets from invalid src-address	2024-11-19 11:32:36 +01:00
wan
wimax
wireguard	wireguard: netlink: access device through ctx instead of peer	2024-11-19 09:22:37 +01:00
wireless	wifi: mwl8k: initialize cmd->addr[] properly	2024-11-19 12:26:56 +01:00
xen-netback	xen-netback: properly sync TX responses	2024-11-18 12:13:30 +01:00
bareudp.c
dummy.c
eql.c
geneve.c	geneve: fix header validation in geneve[6]_xmit_skb	2024-11-19 11:32:19 +01:00
gtp.c	net: gtp: Fix Use-After-Free in gtp_dellink	2024-11-19 11:32:37 +01:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c	macvlan: Don't propagate promisc change to lower dev in passthru	2024-11-18 11:43:20 +01:00
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c	tun: limit printing rate when illegal packet received by tun dev	2024-11-19 11:32:21 +01:00
veth.c
virtio_net.c	virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings	2024-11-18 12:13:20 +01:00
vrf.c
vsockmon.c
xen-netfront.c