net: ena: fix crash during ena_remove()
authorArthur Kiyanovski <akiyano@amazon.com>
Mon, 19 Nov 2018 10:05:21 +0000 (12:05 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Wed, 15 May 2019 22:07:16 +0000 (23:07 +0100)
commitccd9656cf6d70f2a1a481a8ff80d352a80e7f5a5
treea3d8aad1beb13ec6fa2adefb95157881e848ca3e
parent77bdd0f0c664c6d0496e947b3b0a4b697c86e13a
net: ena: fix crash during ena_remove()

In ena_remove() we have the following stack call:
ena_remove()
  unregister_netdev()
  ena_destroy_device()
    netif_carrier_off()

Calling netif_carrier_off() causes linkwatch to try to handle the
link change event on the already unregistered netdev, which leads
to a read from an unreadable memory address.

This patch switches the order of the two functions, so that
netif_carrier_off() is called on a regiestered netdev.

To accomplish this fix we also had to:
1. Remove the set bit ENA_FLAG_TRIGGER_RESET
2. Add a sanitiy check in ena_close()
both to prevent double device reset (when calling unregister_netdev()
ena_close is called, but the device was already deleted in
ena_destroy_device()).
3. Set the admin_queue running state to false to avoid using it after
device was reset (for example when calling ena_destroy_all_io_queues()
right after ena_com_dev_reset() in ena_down)

Fixes: 944b28aa2982 ("net: ena: fix missing lock during device destruction")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Gbp-Pq: Topic features/all/ena
Gbp-Pq: Name 0017-net-ena-fix-crash-during-ena_remove.patch
drivers/net/ethernet/amazon/ena/ena_netdev.c