net/bnxt: fix deadlock in mgr timer cb
Checks
Commit Message
The function 'ulp_ha_mgr_timer_cb' acquires a lock on the context
entry at the beginning with bnxt_ulp_cntxt_entry_acquire(). This lock
is expected to be released by bnxt_ulp_cntxt_entry_release() at the
end of the function.
However, the second early return statement in the function could
potentially bypass the lock release. To fix this issue, add
bnxt_ulp_cntxt_entry_release() before the return statement.
Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper)
CC: stable@dpdk.org
Signed-off-by: Weiguo Li <liweiguo@xencore.cn>
---
drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c | 1 +
1 file changed, 1 insertion(+)
Comments
On Fri, Nov 3, 2023 at 9:07 PM Weiguo Li <liwg06@foxmail.com> wrote:
>
> The function 'ulp_ha_mgr_timer_cb' acquires a lock on the context
> entry at the beginning with bnxt_ulp_cntxt_entry_acquire(). This lock
> is expected to be released by bnxt_ulp_cntxt_entry_release() at the
> end of the function.
>
> However, the second early return statement in the function could
> potentially bypass the lock release. To fix this issue, add
> bnxt_ulp_cntxt_entry_release() before the return statement.
>
> Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper)
> CC: stable@dpdk.org
>
> Signed-off-by: Weiguo Li <liweiguo@xencore.cn>
Acked-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Fixed up the author and signed-off-by mismatch and merged in
brcm-next-net for-next-net branch.
> ---
> drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> index f3f5bda890..852deef3b4 100644
> --- a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> +++ b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> @@ -253,6 +253,7 @@ ulp_ha_mgr_timer_cb(void *arg)
>
> myclient_cnt = bnxt_ulp_cntxt_num_shared_clients_get(ulp_ctx);
> if (myclient_cnt == 0) {
> + bnxt_ulp_cntxt_entry_release();
> BNXT_TF_DBG(ERR,
> "PANIC Client Count is zero kill timer\n.");
> return;
> --
> 2.34.1
>
@@ -253,6 +253,7 @@ ulp_ha_mgr_timer_cb(void *arg)
myclient_cnt = bnxt_ulp_cntxt_num_shared_clients_get(ulp_ctx);
if (myclient_cnt == 0) {
+ bnxt_ulp_cntxt_entry_release();
BNXT_TF_DBG(ERR,
"PANIC Client Count is zero kill timer\n.");
return;