From: Shay Drory shayd@nvidia.com

mainline inclusion from mainline-v6.11-rc2 commit 1b75da22ed1e6171e261bc9265370162553d5393 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALCRV CVE: CVE-2024-43866

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-------------------------------------------

There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access.

Hence, drain health WQ on shutdown callback.

Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver") Fixes: d2aa060d40fa ("net/mlx5: Cancel health poll before sending panic teardown command") Signed-off-by: Shay Drory shayd@nvidia.com Reviewed-by: Moshe Shemesh moshe@nvidia.com Signed-off-by: Tariq Toukan tariqt@nvidia.com Reviewed-by: Wojciech Drewek wojciech.drewek@intel.com Link: https://patch.msgid.link/20240730061638.1831002-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski kuba@kernel.org

Conflicts: drivers/net/ethernet/mellanox/mlx5/core/main.c [The conflict occurs because the commit 8324a02c342a("net/mlx5: Add exit route when waiting for FW") and 1958fc2f0712("net/mlx5: SF, Add auxiliary device driver") are not merged] Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com --- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c index 35e11cb883c9..d4712fbc7856 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -1524,7 +1524,6 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev) /* Panic tear down fw command will stop the PCI bus communication * with the HCA, so the health polll is no longer needed. */ - mlx5_drain_health_wq(dev); mlx5_stop_health_poll(dev, false);

ret = mlx5_cmd_fast_teardown_hca(dev); @@ -1558,6 +1557,7 @@ static void shutdown(struct pci_dev *pdev) int err;

mlx5_core_info(dev, "Shutdown was called\n"); + mlx5_drain_health_wq(dev); err = mlx5_try_fast_unload(dev); if (err) mlx5_unload_one(dev, false);