net: hns3: fix kernel crash problem in concurrent scenario

When link status change, the nic driver need to notify the roce
driver to handle this event, but at this time, the roce driver
may uninit, then cause kernel crash.

To fix the problem, when link status change, need to check
whether the roce registered, and when uninit, need to wait link
update finish.

Fixes: 45e92b7e4e27 ("net: hns3: add calling roce callback function when link status change")
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 43cc6ee4d87db087afcf0c56685243bf02a9ae70..82574ce0194fbaceab0b78b4159ff68b6cc4ae29 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3086,9 +3086,7 @@ static void hclge_push_link_status(struct hclge_dev *hdev)
 
 static void hclge_update_link_status(struct hclge_dev *hdev)
 {
-       struct hnae3_handle *rhandle = &hdev->vport[0].roce;
        struct hnae3_handle *handle = &hdev->vport[0].nic;
-       struct hnae3_client *rclient = hdev->roce_client;
        struct hnae3_client *client = hdev->nic_client;
        int state;
        int ret;
@@ -3112,8 +3110,15 @@ static void hclge_update_link_status(struct hclge_dev *hdev)
 
                client->ops->link_status_change(handle, state);
                hclge_config_mac_tnl_int(hdev, state);
-               if (rclient && rclient->ops->link_status_change)
-                       rclient->ops->link_status_change(rhandle, state);
+
+               if (test_bit(HCLGE_STATE_ROCE_REGISTERED, &hdev->state)) {
+                       struct hnae3_handle *rhandle = &hdev->vport[0].roce;
+                       struct hnae3_client *rclient = hdev->roce_client;
+
+                       if (rclient && rclient->ops->link_status_change)
+                               rclient->ops->link_status_change(rhandle,
+                                                                state);
+               }
 
                hclge_push_link_status(hdev);
        }
@@ -11319,6 +11324,12 @@ clear_roce:
        return ret;
 }
 
+static bool hclge_uninit_need_wait(struct hclge_dev *hdev)
+{
+       return test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) ||
+              test_bit(HCLGE_STATE_LINK_UPDATING, &hdev->state);
+}
+
 static void hclge_uninit_client_instance(struct hnae3_client *client,
                                         struct hnae3_ae_dev *ae_dev)
 {
@@ -11327,7 +11338,7 @@ static void hclge_uninit_client_instance(struct hnae3_client *client,
 
        if (hdev->roce_client) {
                clear_bit(HCLGE_STATE_ROCE_REGISTERED, &hdev->state);
-               while (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+               while (hclge_uninit_need_wait(hdev))
                        msleep(HCLGE_WAIT_RESET_DONE);
 
                hdev->roce_client->ops->uninit_instance(&vport->roce, 0);