From nobody Mon May 25 04:33:43 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E44D3379979; Mon, 18 May 2026 19:47:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133642; cv=none; b=dUr2NFATKc+bUuJ3E87y/Si7KlltSvZyzX9mn9RQ4n+/s6io+/xrvAYG7hPPIVQuZIZ1Xrheav0Lz6L5XP+NUqhOC0b8cVct4N18wWtpKqfAz0We1BUo8kbSBp3RiiKh06L+dt9z6MQCKPSEExemIMR+9OOuYblZOm70NEs1oFM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133642; c=relaxed/simple; bh=3+uhNPAe90CZ/8i4LjeoXa8PXzSV6BEbybG8SQ2DHJA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GLOloepadlV1Iam2iUqC+rXFecoN/S5zVVqfwr3t7pBr5s/IiB8KDcHaikS/Z0/JsQsd9UGaJUfPdG2oAP/DovbhVeC7ds0EysfRYKTcvJSLDFrHc3hhyDU/Rnm7SiR9OdZ3dBoTf+cXpEaO8qvFPG5NYS7qHrv6s6CuDqGlTRQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=C1wEeh2z; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="C1wEeh2z" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id D3F3A20B7167; Mon, 18 May 2026 12:47:14 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com D3F3A20B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779133634; bh=VAImdNSenqd/MKvEKpeyBgJGXFRdv09o3V59MmstgwM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=C1wEeh2z23wkcIbk2gpBZxhMpEqzUoGi4QXKAZDJoxIGwwJaHb9raxwChK8EOVcl6 ZJ3VkssdrK5WCDVfw0Ix4BWwbdlHdlEmXfGoU955tdm846DI6KzkgPZxzmfHtvmG/H xz2Y5EThy4GiiIfJc+Wozd9emaNzW0dKIcqW8HMA= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com Subject: [PATCH net 1/2] net: mana: Add NULL guards in teardown path to prevent panic on attach failure Date: Mon, 18 May 2026 12:43:50 -0700 Message-ID: <20260518194654.735580-2-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260518194654.735580-1-dipayanroy@linux.microsoft.com> References: <20260518194654.735580-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network A= dapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 70 +++++++++++-------- 1 file changed, 41 insertions(+), 29 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 9afc786b297a..0582803907a8 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -1727,6 +1727,9 @@ static void mana_fence_rqs(struct mana_port_context *= apc) struct mana_rxq *rxq; int err; =20 + if (!apc->rxqs) + return; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { rxq =3D apc->rxqs[rxq_idx]; err =3D mana_fence_rq(apc, rxq); @@ -2858,13 +2861,16 @@ static void mana_destroy_vport(struct mana_port_con= text *apc) struct mana_rxq *rxq; u32 rxq_idx; =20 - for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { - rxq =3D apc->rxqs[rxq_idx]; - if (!rxq) - continue; + if (apc->rxqs) { =20 - mana_destroy_rxq(apc, rxq, true); - apc->rxqs[rxq_idx] =3D NULL; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { + rxq =3D apc->rxqs[rxq_idx]; + if (!rxq) + continue; + + mana_destroy_rxq(apc, rxq, true); + apc->rxqs[rxq_idx] =3D NULL; + } } =20 mana_destroy_txq(apc); @@ -3269,7 +3275,8 @@ static int mana_dealloc_queues(struct net_device *nde= v) if (apc->port_is_up) return -EINVAL; =20 - mana_chn_setxdp(apc, NULL); + if (apc->rxqs) + mana_chn_setxdp(apc, NULL); =20 if (gd->gdma_context->is_pf && !apc->ac->bm_hostmode) mana_pf_deregister_filter(apc); @@ -3287,33 +3294,38 @@ static int mana_dealloc_queues(struct net_device *n= dev) * number of queues. */ =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - tsleep =3D 1000; - while (atomic_read(&txq->pending_sends) > 0 && - time_before(jiffies, timeout)) { - usleep_range(tsleep, tsleep + 1000); - tsleep <<=3D 1; - } - if (atomic_read(&txq->pending_sends)) { - err =3D pcie_flr(to_pci_dev(gd->gdma_context->dev)); - if (err) { - netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", - err, atomic_read(&txq->pending_sends), - txq->gdma_txq_id); + if (apc->tx_qp) { + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + tsleep =3D 1000; + while (atomic_read(&txq->pending_sends) > 0 && + time_before(jiffies, timeout)) { + usleep_range(tsleep, tsleep + 1000); + tsleep <<=3D 1; + } + if (atomic_read(&txq->pending_sends)) { + err =3D + pcie_flr(to_pci_dev(gd->gdma_context->dev)); + if (err) { + netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", + err, + atomic_read(&txq->pending_sends), + txq->gdma_txq_id); + } + break; } - break; } - } =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - while ((skb =3D skb_dequeue(&txq->pending_skbs))) { - mana_unmap_skb(skb, apc); - dev_kfree_skb_any(skb); + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + while ((skb =3D skb_dequeue(&txq->pending_skbs))) { + mana_unmap_skb(skb, apc); + dev_kfree_skb_any(skb); + } + atomic_set(&txq->pending_sends, 0); } - atomic_set(&txq->pending_sends, 0); } + /* We're 100% sure the queues can no longer be woken up, because * we're sure now mana_poll_tx_cq() can't be running. */ --=20 2.43.0 From nobody Mon May 25 04:33:43 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 580CF37AA74; Mon, 18 May 2026 19:47:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133642; cv=none; b=pHUuikJfccW8bR29ZvlDFpIJYNQheqynVMODaykRCq60oegq50mhGMcpolpJFfDJ4N3JneWt2J6uyQX6v1Mfzy9ixYC8yzP5tf5B1lygBo6cbp3dL2k25CFaXcQHxozylwoPnw/RLedNzH75UYL/ZTiHUIdgC71jPxpH/s+iIIM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133642; c=relaxed/simple; bh=/bI0wvIS4irKNIW0UIRdjGpqzaCoFj0Y8jYQlzdIY1Q=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pA64qKE20mVPNUJql8uxlkwPLZ0fWd3EDW8WF3vhMe8bum7ALflbYtfqfSZZaNoROjQIQuFgndm7f7k/8qWr+nY+pmL+yub2pUL2mgtXKRcIVQQ6Up1O6ko9aguPkD0MGWZDCkCYSC9umZCOI7LuglYM8M1sRX7hDnRwhwLtPm4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=Ch6u7mM1; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="Ch6u7mM1" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id 4362720B7169; Mon, 18 May 2026 12:47:15 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 4362720B7169 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779133635; bh=bwEBs7RhjEVS6uregRRC6XmI5WIqcSFOYgqSBVfJPkw=; h=From:To:Subject:Date:In-Reply-To:References:From; b=Ch6u7mM1x6ZibX8hQFsLuYoPuor8c/sAwiG75n1Rl29ctM8ljFx6cBdCzl9zOQIRa yVXmhP0311OGDtTN0dXGfAUiovyvqVUx8XjLiawGH7630Ef+MvH6BZ7LzHOEnAAkks xHp3RpohJS5Ie8BsORmaMSn89HVnAAV3+encXy5U= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com Subject: [PATCH net 2/2] net: mana: Skip redundant detach in queue reset handler if already detached Date: Mon, 18 May 2026 12:43:51 -0700 Message-ID: <20260518194654.735580-3-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260518194654.735580-1-dipayanroy@linux.microsoft.com> References: <20260518194654.735580-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When mana_per_port_queue_reset_work_handler() runs, it unconditionally calls mana_detach() which attempts to tear down queues that are already freed, leading to NULL pointer dereferences on apc->tx_qp and apc->rxqs. Check netif_device_present() in the reset handler and skip mana_detach() when the port is already in detached state. This avoids the redundant teardown and goes directly to mana_attach() to retry bringing the port back up. Fixes: 3b194343c250 ("net: mana: Implement ndo_tx_timeout and serialize que= ue resets per port.") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 0582803907a8..907efadf6fd6 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -316,12 +316,19 @@ static void mana_per_port_queue_reset_work_handler(st= ruct work_struct *work) goto out; } =20 + /* If already detached (indicates detach succeeded but attach failed + * previously). Now skip mana detach and just retry mana_attach. + */ + if (!netif_device_present(ndev)) + goto attach; + err =3D mana_detach(ndev, false); if (err) { netdev_err(ndev, "mana_detach failed: %d\n", err); goto dealloc_pre_rxbufs; } =20 +attach: err =3D mana_attach(ndev); if (err) netdev_err(ndev, "mana_attach failed: %d\n", err); --=20 2.43.0