qca_debug: Prevent crash on TX ring changes

The qca_spi driver stop and restart the SPI kernel thread
(via ndo_stop & ndo_open) in case of TX ring changes. This is
a big issue because it allows userspace to prevent restart of
the SPI kernel thread (via signals). A subsequent change of
TX ring wrongly assume a valid spi_thread pointer which result
in a crash.

So prevent this by stopping the network traffic handling and
temporary park the SPI thread.

Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231206141222.52029-2-wahrenst@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c
index 6f2fa2a42770aa2743f12cae7bae30408f731088..a5445252b0c4d2bf0200c99cd1f639983f21613b 100644 (file)
--- a/drivers/net/ethernet/qualcomm/qca_debug.c
+++ b/drivers/net/ethernet/qualcomm/qca_debug.c
@@ -263,7 +263,6 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring,
                     struct kernel_ethtool_ringparam *kernel_ring,
                     struct netlink_ext_ack *extack)
 {
-       const struct net_device_ops *ops = dev->netdev_ops;
        struct qcaspi *qca = netdev_priv(dev);
 
        if ((ring->rx_pending) ||
@@ -271,14 +270,14 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring,
            (ring->rx_jumbo_pending))
                return -EINVAL;
 
-       if (netif_running(dev))
-               ops->ndo_stop(dev);
+       if (qca->spi_thread)
+               kthread_park(qca->spi_thread);
 
        qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN);
        qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN);
 
-       if (netif_running(dev))
-               ops->ndo_open(dev);
+       if (qca->spi_thread)
+               kthread_unpark(qca->spi_thread);
 
        return 0;
 }

diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index bec723028e96c9c7f9ec686e497d2eea91a7d8c6..b0fad69bb755fb4a3e538572d2d449e09dd6acf1 100644 (file)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -580,6 +580,18 @@ qcaspi_spi_thread(void *data)
        netdev_info(qca->net_dev, "SPI thread created\n");
        while (!kthread_should_stop()) {
                set_current_state(TASK_INTERRUPTIBLE);
+               if (kthread_should_park()) {
+                       netif_tx_disable(qca->net_dev);
+                       netif_carrier_off(qca->net_dev);
+                       qcaspi_flush_tx_ring(qca);
+                       kthread_parkme();
+                       if (qca->sync == QCASPI_SYNC_READY) {
+                               netif_carrier_on(qca->net_dev);
+                               netif_wake_queue(qca->net_dev);
+                       }
+                       continue;
+               }
+
                if ((qca->intr_req == qca->intr_svc) &&
                    !qca->txr.skb[qca->txr.head])
                        schedule();