From nobody Sat Jul 25 01:34:41 2026 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF9E44071F8 for ; Tue, 21 Jul 2026 06:21:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784614877; cv=none; b=msddiRdZbMmQDSLDyVw/ksfcpafn0lG+RIkxjkuSD7KFI9bVBCh9yb4WtNhQgGyVmwT0RYsMDKZZgWFezHH2XjRPzvQZkRa4E/QnOD+Ba/HR2e5na6m/TQ1HONzfO5TDiqEux0oWwf3aHSU+RyBcALmozk+NA2J5WP4e5zLlN9c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784614877; c=relaxed/simple; bh=Z5JtswQaHr1Y7GmBpKLV/7trzctnR3N3Z+5orguOzWU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AqT3NYUg9GveLMJpNl8gryi42jjXBvS+jUxU54eEm272l57XwEMevf2x2x32HPStzl4F9QrvL7vPXsTdBbYGU3c939wt36n1Fnx1wEVNSCEqkMyqNWBbBZqcWGjGHLvmWrfOOEHL5hvX/vl7y+0yk3xu5DQn+ADIgm0pBQS6FTE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cmkp+bax; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cmkp+bax" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8485b358552so11785879b3a.2 for ; Mon, 20 Jul 2026 23:21:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784614875; x=1785219675; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=jozBZSV92V3+3MNH1S/1bqlBdEbp9HS15y2+rq2hqt8=; b=cmkp+bax3sLzMrPbQzoRKz2RfrJiVq98Un2c5da2i8Eqn6CYm5dvn4N8w4u9B/NkA3 yGekHVvVs92B2IccyjfD1O0vHxWryNJSYiQ07FSMwErb4El2sI2S7c+/klTENzSawmq+ wsPhVxcuzYwt6b+8w1+5Qx33TLvkwM8ZqHBJVYWglT6jgscdICAtKdIPDxB/iDEwDgd5 edBRo/knxsFELoNxwSCfaxWzjFGHUjvShBeuAWpHarDUB+dBfzmiz6lr4Ez0JP0bSSm5 rEmifAnMuKmlyoMuYltR6VZ4xv2aVFLURuVprXfOYwH1867PQ4bwrOf+Zc/r+jQIYWZY uPEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784614875; x=1785219675; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jozBZSV92V3+3MNH1S/1bqlBdEbp9HS15y2+rq2hqt8=; b=AljriDD3MXImNoZrOorc9RSjO5MS9J4UB0IhbuKuEUtzTwDjVF6rW4J/a6e0HHEu3x pqRj/xraKCIAISOyP+QNQC4CII/PW2DiHHAdmpDT87QgpfRzOQlwI5+49MHodAaX1b1I HMRrn7gSKyEToXK4gl9ViMeI/dc9Zb8eubvwPRnggKl7Oghh1p6R5p+Ocy0JvGPbHgcO /iURLXmUkYZ6OadHBGsJZ/5c2YOk5dASgxjZFvJz+XnWnbList+aXM6PMN01zZqNlRfW 995YCN2lzohoRUO7Mja520Hi3it21tQb1YtMsNOfMKuTJIYmIcIiUSTKKAax4mF3vbK6 l3XA== X-Forwarded-Encrypted: i=1; AHgh+RoGQwLgqsN8y1amkCv2+7DrOuak3YecAvA2br1Bh95wmfFWiK7vbdhlfTs92hZDU5y/FeWyFN3c7hfjEdE=@vger.kernel.org X-Gm-Message-State: AOJu0YytNIC/IcUhHSZ0UfyvmGVdqanasEBcL/kmu/knoGIwXPFN1x2G rNT64tNeVy6dzVUVaLTLkisFcYx/1B610z2Fw+tBlYXuYsw69CfNSOk= X-Gm-Gg: AR+sD1000DkJIbdascPxhSsMII7d9a4NzI35PiNYAk8H8W9TT2ASfKOpjMhCaIYwxSt 2texoEtMhpnFr11zvyg7X77hm7PKXmPsOcR3byrzmmGuhMECPxIQU09PmhQWx/Q6m3HKLdJrCu/ 8+7e2h5GQaiqoUszmLNM+oh/CqoQSuXW+7an0TbYwnVs9VAztGsWb1z8OEaMkCUxGx/vepna5WP NXAVRtwIyi24itrybwWJeXIRdrWa6XJ15Flc9FeOdddSWyVJ9iPN5Wd0xWfLbXKFlajNIMKTzwv rhhNtNAIXmhyimX5uo4f4l9+f81hCv8tyfJoR+RY4cn+3/eRP6v+mORW8hTO3hpYOz0wx2POAsg 9C99X8oMOZG3GsbTx0D7O9C1RPXurOsX6r3PNF8yiW3R3AvqKuWyWWtytm67hW3mz9HmQ3Koddx qG/p6FefComVD7/g+r66PIRYsUqUuayj+tKIb7Vd6WQvBJg0NCTrHwB+IomdAOoSDHdAtGqv84a T0U2a6kPlEodqjv7aNOdarWDoB0rgXxZgQZ2Ah1 X-Received: by 2002:aa7:88d3:0:b0:845:c0db:3924 with SMTP id d2e1a72fcca58-84c2928b6a4mr16155187b3a.24.1784614874820; Mon, 20 Jul 2026 23:21:14 -0700 (PDT) Received: from localhost.localdomain ([14.5.152.27]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c4b640050sm4017004b3a.45.2026.07.20.23.21.11 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 20 Jul 2026 23:21:14 -0700 (PDT) From: Myeonghun Pak To: Ido Schimmel , Petr Machata Cc: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Myeonghun Pak , Ijae Kim Subject: [PATCH net] mlxsw: pci: Quiesce EQ tasklet and CQ NAPI before teardown Date: Tue, 21 Jul 2026 15:21:05 +0900 Message-ID: <20260721062105.55014-1-mhun512@gmail.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mlxsw_pci_eq_irq_handler() schedules the EQ tasklet. The tasklet reads the EQ ring and schedules CQ NAPI instances. The CQ poll callbacks, in turn, dereference the RDQ or SDQ associated with the CQ. mlxsw_pci_fini() unregisters the IRQ and immediately tears down the asynchronous queues in RDQ, SDQ, CQ, EQ order. free_irq() waits for IRQ handlers, but not for a tasklet already scheduled by one. In addition, mlxsw_pci_cq_fini() disables each CQ NAPI only after all RDQs and SDQs have been freed. A pending tasklet or NAPI poll can therefore access freed queue storage. Kill the EQ tasklet after free_irq() so it cannot schedule any more CQ NAPI instances. Disable all CQ NAPI instances before freeing the first descriptor queue, ensuring their poll callbacks have completed. Track the enabled state per CQ to avoid disabling a NAPI instance twice when the CQ is later destroyed, while preserving the partial initialization unwind. Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- Found by static analysis on v7.2-rc2; not tested on hardware. drivers/net/ethernet/mellanox/mlxsw/pci.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethern= et/mellanox/mlxsw/pci.c index 0da85d36647d..feeb32134d2a 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/pci.c +++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c @@ -86,6 +86,7 @@ struct mlxsw_pci_queue { enum mlxsw_pci_cqe_v v; struct mlxsw_pci_queue *dq; struct napi_struct napi; + bool napi_enabled; struct page_pool *page_pool; } cq; struct { @@ -989,6 +990,15 @@ static void mlxsw_pci_cq_napi_teardown(struct mlxsw_pc= i_queue *q) netif_napi_del(&q->u.cq.napi); } =20 +static void mlxsw_pci_cq_napi_disable(struct mlxsw_pci_queue *q) +{ + if (!q->u.cq.napi_enabled) + return; + + napi_disable(&q->u.cq.napi); + q->u.cq.napi_enabled =3D false; +} + static int mlxsw_pci_cq_page_pool_init(struct mlxsw_pci_queue *q, enum mlxsw_pci_cq_type cq_type) { @@ -1064,6 +1074,7 @@ static int mlxsw_pci_cq_init(struct mlxsw_pci *mlxsw_= pci, char *mbox, goto err_page_pool_init; =20 napi_enable(&q->u.cq.napi); + q->u.cq.napi_enabled =3D truea mlxsw_pci_queue_doorbell_consumer_ring(mlxsw_pci, q); mlxsw_pci_queue_doorbell_arm_consumer_ring(mlxsw_pci, q); return 0; @@ -1078,7 +1089,7 @@ static void mlxsw_pci_cq_fini(struct mlxsw_pci *mlxsw= _pci, { enum mlxsw_pci_cq_type cq_type =3D mlxsw_pci_cq_type(mlxsw_pci, q); =20 - napi_disable(&q->u.cq.napi); + mlxsw_pci_cq_napi_disable(q); mlxsw_pci_cq_page_pool_fini(q, cq_type); mlxsw_pci_cq_napi_teardown(q); mlxsw_cmd_hw2sw_cq(mlxsw_pci->core, q->num); @@ -1439,6 +1450,14 @@ err_cqs_init: =20 static void mlxsw_pci_aqs_fini(struct mlxsw_pci *mlxsw_pci) { + struct mlxsw_pci_queue_type_group *queue_group; + int i; + + queue_group =3D mlxsw_pci_queue_type_group_get(mlxsw_pci, + MLXSW_PCI_QUEUE_TYPE_CQ); + for (i =3D 0; i < queue_group->count; i++) + mlxsw_pci_cq_napi_disable(&queue_group->q[i]); + mlxsw_pci_queue_group_fini(mlxsw_pci, &mlxsw_pci_rdq_ops); mlxsw_pci_queue_group_fini(mlxsw_pci, &mlxsw_pci_sdq_ops); mlxsw_pci_queue_group_fini(mlxsw_pci, &mlxsw_pci_cq_ops); @@ -2089,6 +2108,7 @@ static void mlxsw_pci_fini(void *bus_priv) struct mlxsw_pci *mlxsw_pci =3D bus_priv; =20 free_irq(pci_irq_vector(mlxsw_pci->pdev, 0), mlxsw_pci); + tasklet_kill(&mlxsw_pci_eq_get(mlxsw_pci)->u.eq.tasklet); mlxsw_pci_aqs_fini(mlxsw_pci); mlxsw_pci_napi_devs_fini(mlxsw_pci); mlxsw_pci_fw_area_fini(mlxsw_pci); --=20 2.47.1