From nobody Mon Jun 8 23:55:57 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 143BB3DD863; Mon, 25 May 2026 08:12:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779696750; cv=none; b=mtFWtDZqmnrZMN8gIMFusSZCW+gZ+hwcR6aR6wssMUDQY40Q08IEqo9V7uJZRebNFn/i941cOvDwVmkA4SXwo4KehwWt5nsVgMhfU0I/yqpulDYss9K4j/ML32h3YBqF8Fdvw0NdtIZEa9nimwQL59cEW8lm7dxXQPIv1VzPm78= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779696750; c=relaxed/simple; bh=3+uhNPAe90CZ/8i4LjeoXa8PXzSV6BEbybG8SQ2DHJA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ekIUQyx8cGCsBWzeDYIWZCt0IWm+3JGyAXWndWkZU204SXDDI2iIqIbSTfEnBQG9OAKxEoHYtTRLgN+qfxXne6tAzuLcrM99InmJx99z2VryqQTPJSciaQYh4B4tJ9DUfp0+osB/qMRoh2kNOEBnyPQbopOQ8LHFHt4gGpPt9p4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=rvavsk6f; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="rvavsk6f" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id 4F66520B7167; Mon, 25 May 2026 01:12:06 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 4F66520B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779696726; bh=VAImdNSenqd/MKvEKpeyBgJGXFRdv09o3V59MmstgwM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=rvavsk6f8hxfAyRxvKgQ4fajDaIQfSXxKqLyfdPvIIuEh3eQwYoB5voNKlvcYLiMs ND2b1XrCY+Sp+dUs/N3fysQT+okVNam4V+NiwZehLmehuqGI/x0B+cXwxniwbM4mLr nMyWzCXjOqC15o9Wq3BKZ4F3iUTvmoL+pBj/9IGg= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com, pavan.chebbi@broadcom.com Subject: [PATCH net v3 1/2] net: mana: Add NULL guards in teardown path to prevent panic on attach failure Date: Mon, 25 May 2026 01:08:24 -0700 Message-ID: <20260525081129.1230035-2-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260525081129.1230035-1-dipayanroy@linux.microsoft.com> References: <20260525081129.1230035-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network A= dapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 70 +++++++++++-------- 1 file changed, 41 insertions(+), 29 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 9afc786b297a..0582803907a8 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -1727,6 +1727,9 @@ static void mana_fence_rqs(struct mana_port_context *= apc) struct mana_rxq *rxq; int err; =20 + if (!apc->rxqs) + return; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { rxq =3D apc->rxqs[rxq_idx]; err =3D mana_fence_rq(apc, rxq); @@ -2858,13 +2861,16 @@ static void mana_destroy_vport(struct mana_port_con= text *apc) struct mana_rxq *rxq; u32 rxq_idx; =20 - for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { - rxq =3D apc->rxqs[rxq_idx]; - if (!rxq) - continue; + if (apc->rxqs) { =20 - mana_destroy_rxq(apc, rxq, true); - apc->rxqs[rxq_idx] =3D NULL; + for (rxq_idx =3D 0; rxq_idx < apc->num_queues; rxq_idx++) { + rxq =3D apc->rxqs[rxq_idx]; + if (!rxq) + continue; + + mana_destroy_rxq(apc, rxq, true); + apc->rxqs[rxq_idx] =3D NULL; + } } =20 mana_destroy_txq(apc); @@ -3269,7 +3275,8 @@ static int mana_dealloc_queues(struct net_device *nde= v) if (apc->port_is_up) return -EINVAL; =20 - mana_chn_setxdp(apc, NULL); + if (apc->rxqs) + mana_chn_setxdp(apc, NULL); =20 if (gd->gdma_context->is_pf && !apc->ac->bm_hostmode) mana_pf_deregister_filter(apc); @@ -3287,33 +3294,38 @@ static int mana_dealloc_queues(struct net_device *n= dev) * number of queues. */ =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - tsleep =3D 1000; - while (atomic_read(&txq->pending_sends) > 0 && - time_before(jiffies, timeout)) { - usleep_range(tsleep, tsleep + 1000); - tsleep <<=3D 1; - } - if (atomic_read(&txq->pending_sends)) { - err =3D pcie_flr(to_pci_dev(gd->gdma_context->dev)); - if (err) { - netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", - err, atomic_read(&txq->pending_sends), - txq->gdma_txq_id); + if (apc->tx_qp) { + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + tsleep =3D 1000; + while (atomic_read(&txq->pending_sends) > 0 && + time_before(jiffies, timeout)) { + usleep_range(tsleep, tsleep + 1000); + tsleep <<=3D 1; + } + if (atomic_read(&txq->pending_sends)) { + err =3D + pcie_flr(to_pci_dev(gd->gdma_context->dev)); + if (err) { + netdev_err(ndev, "flr failed %d with %d pkts pending in txq %u\n", + err, + atomic_read(&txq->pending_sends), + txq->gdma_txq_id); + } + break; } - break; } - } =20 - for (i =3D 0; i < apc->num_queues; i++) { - txq =3D &apc->tx_qp[i].txq; - while ((skb =3D skb_dequeue(&txq->pending_skbs))) { - mana_unmap_skb(skb, apc); - dev_kfree_skb_any(skb); + for (i =3D 0; i < apc->num_queues; i++) { + txq =3D &apc->tx_qp[i].txq; + while ((skb =3D skb_dequeue(&txq->pending_skbs))) { + mana_unmap_skb(skb, apc); + dev_kfree_skb_any(skb); + } + atomic_set(&txq->pending_sends, 0); } - atomic_set(&txq->pending_sends, 0); } + /* We're 100% sure the queues can no longer be woken up, because * we're sure now mana_poll_tx_cq() can't be running. */ --=20 2.43.0 From nobody Mon Jun 8 23:55:57 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 3E0093DC4D0; Mon, 25 May 2026 08:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779696746; cv=none; b=dc3jEqiWhY6Pz010+rl+X74ySb1p9KC6fiXWMaWTx96KX3lSMJVk27TME+mxTpiRx3uasbOypj7s3JTz98jmVbub04khMdHxnUeH6D9tm3lQfL90CVlHsKl6FiMR/IR/JEOtjKWXrf6D4QB50EB1ffzl/LjYXs5CWVNO3ONci3Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779696746; c=relaxed/simple; bh=6WkTC/HbSabZ+JULKTVHSv/7mEown2M+txjSQJP/g+4=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u6HHm0E4Vt5P/Y1eyLGjGcBi3QXuyh3QGBRPv1RxbxrrxoNDq0AZrTGv/jgOxUvP7dXmTFlC6JWZGkn/Qxv1GwPAsyid1QPnZD9jFrFczrIfGBv9oTuL2I3Vtuf0C3AkIq6v1OF/KVDPNXEo1Yv9hi/2NZKhgOiBd6YjcZEbUq8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=hmK/apTH; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="hmK/apTH" Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id B383C20B716A; Mon, 25 May 2026 01:12:06 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com B383C20B716A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1779696726; bh=yUPS4+X1jCtRIosSeKaXW0vT+grEGU2AMILBtNl9IpI=; h=From:To:Subject:Date:In-Reply-To:References:From; b=hmK/apTH1yvHX75Q8xyzDXBjsGpewpzVO5hns7qygOg6Apto41dcjcuyrZT9z5moz bKk0iSKuqoc7fbLGb0zyqHkNCXxTTIb2L90c7O5MyU/pLLBUXRE3d6qmoZSgivRlzw hWqB92wZVd5Q8ptA7ISAq2U/OApJ89wK+jJpfIb4= From: Dipayaan Roy To: kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, leon@kernel.org, longli@microsoft.com, kotaranov@microsoft.com, horms@kernel.org, shradhagupta@linux.microsoft.com, ssengar@linux.microsoft.com, ernis@linux.microsoft.com, shirazsaleem@microsoft.com, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, stephen@networkplumber.org, jacob.e.keller@intel.com, dipayanroy@microsoft.com, leitao@debian.org, kees@kernel.org, john.fastabend@gmail.com, hawk@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, sdf@fomichev.me, yury.norov@gmail.com, pavan.chebbi@broadcom.com Subject: [PATCH net v3 2/2] net: mana: Skip redundant detach on already-detached port Date: Mon, 25 May 2026 01:08:25 -0700 Message-ID: <20260525081129.1230035-3-dipayanroy@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260525081129.1230035-1-dipayanroy@linux.microsoft.com> References: <20260525081129.1230035-1-dipayanroy@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown. Fixes: 3b194343c250 ("net: mana: Implement ndo_tx_timeout and serialize que= ue resets per port.") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy --- drivers/net/ethernet/microsoft/mana/mana_en.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/et= hernet/microsoft/mana/mana_en.c index 0582803907a8..1e1ad2795c3c 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -3350,6 +3350,12 @@ int mana_detach(struct net_device *ndev, bool from_c= lose) =20 ASSERT_RTNL(); =20 + /* If already detached (indicates detach succeeded but attach failed + * previously). Now skip mana detach and just retry mana_attach. + */ + if (!from_close && !netif_device_present(ndev)) + return 0; + apc->port_st_save =3D apc->port_is_up; apc->port_is_up =3D false; =20 --=20 2.43.0