From nobody Sun May 24 20:33:04 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E8983364047; Fri, 22 May 2026 23:36:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779492989; cv=none; b=WGCsAaf0F+XJnLPyuFS96ECM1ni9YqG+NDddtNHQ6g6oASNe0gLuS/F24GSxWoTBoPQeKhcWk/K4HwVFgkvcvXxlP/XvjMRpT5JwqmpnyBKuNeZsMdVcKZjXL1FQMshyvuT8dcTKI5tu4nIRQ9+Hmbbb7nF6q2lktQ3MtgvDeTg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779492989; c=relaxed/simple; bh=mfHSl91WC1gD5+msUoAhsg9R2OXHjrwM9fVxUnuTD6g=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=esRFi20Js+q15XewNUOXXrB3WipbZs+mZWyuW5qLCmpgl3r68uRNz5y8B39T+LCMNhswNptsMhXlidmL9CYfZrZcMNg8mQIXJFEBNJ6q5x4ZAFOgs4mMklVXGE9I34RdTgm19V0FAMTiKGVtSZAhpdD0HF4KZRh+VH4cMx6HDFI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=D/EZELT5; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="D/EZELT5" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id D59EA20B7168; Fri, 22 May 2026 16:36:18 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com D59EA20B7168 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779492978; bh=BHMOMfXC+nPX5s7KV/cJnf70L+SLHNnXK7J1WnTDItY=; h=From:To:Subject:Date:In-Reply-To:References:From; b=D/EZELT5Tx5pFNJncZQMzDS47of1TEsZ/X/xgAT6RfzA3t66sqK0fcqT7vSNSuyXR nBPQrn+1/3yM7yXtAIjo3fjUiUyOigujcy2ovRNjwJdRMg3AGJuamZWCEZtJV9LMH1 oSj0mg4M/9KLUU5iBdo57D90IDcta3zFBFvyHI+k= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com Subject: [PATCH net v2 1/2] net: mana: Add NULL guards in teardown path to prevent panic on attach failure Date: Fri, 22 May 2026 16:33:12 -0700 Message-ID: <20260522233555.1099342-2-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260522233555.1099342-1-dipayanroy@linux.microsoft.com> References: <20260522233555.1099342-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network A= dapter (MANA)") Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 70 +++++++++++-------- 1 file changed, 41 insertions(+), 29 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 9afc786b297a..0582803907a8 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -1727,6 +1727,9 @@ static void mana_fence_rqs(struct mana_port_context *= apc) struct mana_rxq *rxq; int err; =20 + if (!apc->rxqs) + return; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { rxq =3D apc->rxqs[rxq_idx]; err =3D mana_fence_rq(apc, rxq); @@ -2858,13 +2861,16 @@ static void mana_destroy_vport(struct mana_port_con= text *apc) struct mana_rxq *rxq; u32 rxq_idx; =20 - for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { - rxq =3D apc->rxqs[rxq_idx]; - if (!rxq) - continue; + if (apc->rxqs) { =20 - mana_destroy_rxq(apc, rxq, true); - apc->rxqs[rxq_idx] =3D NULL; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { + rxq =3D apc->rxqs[rxq_idx]; + if (!rxq) + continue; + + mana_destroy_rxq(apc, rxq, true); + apc->rxqs[rxq_idx] =3D NULL; + } } =20 mana_destroy_txq(apc); @@ -3269,7 +3275,8 @@ static int mana_dealloc_queues(struct net_device *nde= v) if (apc->port_is_up) return -EINVAL; =20 - mana_chn_setxdp(apc, NULL); + if (apc->rxqs) + mana_chn_setxdp(apc, NULL); =20 if (gd->gdma_context->is_pf && !apc->ac->bm_hostmode) mana_pf_deregister_filter(apc); @@ -3287,33 +3294,38 @@ static int mana_dealloc_queues(struct net_device *n= dev) * number of queues. */ =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - tsleep =3D 1000; - while (atomic_read(&txq->pending_sends) > 0 && - time_before(jiffies, timeout)) { - usleep_range(tsleep, tsleep + 1000); - tsleep <<=3D 1; - } - if (atomic_read(&txq->pending_sends)) { - err =3D pcie_flr(to_pci_dev(gd->gdma_context->dev)); - if (err) { - netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", - err, atomic_read(&txq->pending_sends), - txq->gdma_txq_id); + if (apc->tx_qp) { + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + tsleep =3D 1000; + while (atomic_read(&txq->pending_sends) > 0 && + time_before(jiffies, timeout)) { + usleep_range(tsleep, tsleep + 1000); + tsleep <<=3D 1; + } + if (atomic_read(&txq->pending_sends)) { + err =3D + pcie_flr(to_pci_dev(gd->gdma_context->dev)); + if (err) { + netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", + err, + atomic_read(&txq->pending_sends), + txq->gdma_txq_id); + } + break; } - break; } - } =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - while ((skb =3D skb_dequeue(&txq->pending_skbs))) { - mana_unmap_skb(skb, apc); - dev_kfree_skb_any(skb); + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + while ((skb =3D skb_dequeue(&txq->pending_skbs))) { + mana_unmap_skb(skb, apc); + dev_kfree_skb_any(skb); + } + atomic_set(&txq->pending_sends, 0); } - atomic_set(&txq->pending_sends, 0); } + /* We're 100% sure the queues can no longer be woken up, because * we're sure now mana_poll_tx_cq() can't be running. */ --=20 2.43.0 From nobody Sun May 24 20:33:04 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 8677F392820; Fri, 22 May 2026 23:36:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779492989; cv=none; b=lwJhyju9MN4HxzprdGiIJZdPkZbVYpW8iETLxa5LGotgy4RffxyLB8Iu0C33y/XIybpSojXt5HntwLmCWBXRtX7D6/A/YLrgP3TbJba5qseawZv2B0BFAPU2WP8zFIra2x4ttCN526e5uYxqnluGl6IH8ur1WafVVAIdFNRhSNY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779492989; c=relaxed/simple; bh=6WkTC/HbSabZ+JULKTVHSv/7mEown2M+txjSQJP/g+4=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KxkQRiP/Beips8cFOQbDp88n3gjT7qWoQMcHcjCyiDcpfzey1PeUdvlSp8clgyBXuopcKXUMdiIhutxleOKhRB0U2ADMgxKw5edi0jeoE5tdTYl+SphT4CDxMDPEO4RPXvgiQPCScutPcsHgapbmeLtBuDBq7s/yUI5sX2RGDk0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=EGP6BfAX; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="EGP6BfAX" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id EFC6D20B716A; Fri, 22 May 2026 16:36:19 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com EFC6D20B716A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779492980; bh=yUPS4+X1jCtRIosSeKaXW0vT+grEGU2AMILBtNl9IpI=; h=From:To:Subject:Date:In-Reply-To:References:From; b=EGP6BfAX9GHDFKpfc3kVTeAnRiz7r3j5ni5uk231uDmEam4tSuq2RXirkWLELek95 ZR7QUjZ4S0lDZqr/LkdFKq7tWHovVhvNfFuiECilha95LuzpSslh7/D0B9dndcrctJ 2Dr+j4Km1J2p+QQL8pm7S8jKsEEK6QREjCYrlM7k= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com Subject: [PATCH net v2 2/2] net: mana: Skip redundant detach on already-detached port Date: Fri, 22 May 2026 16:33:13 -0700 Message-ID: <20260522233555.1099342-3-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260522233555.1099342-1-dipayanroy@linux.microsoft.com> References: <20260522233555.1099342-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown. Fixes: 3b194343c250 ("net: mana: Implement ndo_tx_timeout and serialize que= ue resets per port.") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 0582803907a8..1e1ad2795c3c 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -3350,6 +3350,12 @@ int mana_detach(struct net_device *ndev, bool from_c= lose) =20 ASSERT_RTNL(); =20 + /* If already detached (indicates detach succeeded but attach failed + * previously). Now skip mana detach and just retry mana_attach. + */ + if (!from_close && !netif_device_present(ndev)) + return 0; + apc->port_st_save =3D apc->port_is_up; apc->port_is_up =3D false; =20 --=20 2.43.0