Commit 3085d4b8 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'bnxt_en-2-bug-fixes' 

Michael Chan says:

====================
bnxt_en: 2 Bug fixes

The first patch fixes a potential memory leak when sending a FW
message for the RoCE driver.  The second patch fixes the potential
issue of DIM modifying the coalescing parameters of a ring that has
been freed.
====================

Link: https://patch.msgid.link/20250104043849.3482067-1-michael.chan@broadcom.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 8c817eb2 40452969

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+33 −5
Original line number Diff line number Diff line
@@ -2897,6 +2897,13 @@ static int bnxt_hwrm_handler(struct bnxt *bp, struct tx_cmp *txcmp) 
	return 0;

}



static bool bnxt_vnic_is_active(struct bnxt *bp)

{

	struct bnxt_vnic_info *vnic = &bp->vnic_info[0];



	return vnic->fw_vnic_id != INVALID_HW_RING_ID && vnic->mru > 0;

}



static irqreturn_t bnxt_msix(int irq, void *dev_instance)

{

	struct bnxt_napi *bnapi = dev_instance;
@@ -3164,7 +3171,7 @@ static int bnxt_poll(struct napi_struct *napi, int budget) 
			break;

		}

	}

	if (bp->flags & BNXT_FLAG_DIM) {

	if ((bp->flags & BNXT_FLAG_DIM) && bnxt_vnic_is_active(bp)) {

		struct dim_sample dim_sample = {};



		dim_update_sample(cpr->event_ctr,
@@ -3295,7 +3302,7 @@ static int bnxt_poll_p5(struct napi_struct *napi, int budget) 
poll_done:

	cpr_rx = &cpr->cp_ring_arr[0];

	if (cpr_rx->cp_ring_type == BNXT_NQ_HDL_TYPE_RX &&

	    (bp->flags & BNXT_FLAG_DIM)) {

	    (bp->flags & BNXT_FLAG_DIM) && bnxt_vnic_is_active(bp)) {

		struct dim_sample dim_sample = {};



		dim_update_sample(cpr->event_ctr,
@@ -7266,6 +7273,26 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp) 
	return rc;

}



static void bnxt_cancel_dim(struct bnxt *bp)

{

	int i;



	/* DIM work is initialized in bnxt_enable_napi().  Proceed only

	 * if NAPI is enabled.

	 */

	if (!bp->bnapi || test_bit(BNXT_STATE_NAPI_DISABLED, &bp->state))

		return;



	/* Make sure NAPI sees that the VNIC is disabled */

	synchronize_net();

	for (i = 0; i < bp->rx_nr_rings; i++) {

		struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];

		struct bnxt_napi *bnapi = rxr->bnapi;



		cancel_work_sync(&bnapi->cp_ring.dim.work);

	}

}



static int hwrm_ring_free_send_msg(struct bnxt *bp,

				   struct bnxt_ring_struct *ring,

				   u32 ring_type, int cmpl_ring_id)
@@ -7366,6 +7393,7 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) 
		}

	}



	bnxt_cancel_dim(bp);

	for (i = 0; i < bp->rx_nr_rings; i++) {

		bnxt_hwrm_rx_ring_free(bp, &bp->rx_ring[i], close_path);

		bnxt_hwrm_rx_agg_ring_free(bp, &bp->rx_ring[i], close_path);
@@ -11309,8 +11337,6 @@ static void bnxt_disable_napi(struct bnxt *bp) 
		if (bnapi->in_reset)

			cpr->sw_stats->rx.rx_resets++;

		napi_disable(&bnapi->napi);

		if (bnapi->rx_ring)

			cancel_work_sync(&cpr->dim.work);

	}

}
@@ -15572,8 +15598,10 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx) 
		bnxt_hwrm_vnic_update(bp, vnic,

				      VNIC_UPDATE_REQ_ENABLES_MRU_VALID);

	}



	/* Make sure NAPI sees that the VNIC is disabled */

	synchronize_net();

	rxr = &bp->rx_ring[idx];

	cancel_work_sync(&rxr->bnapi->cp_ring.dim.work);

	bnxt_hwrm_rx_ring_free(bp, rxr, false);

	bnxt_hwrm_rx_agg_ring_free(bp, rxr, false);

	rxr->rx_next_cons = 0;

drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c

+2 −1
Original line number Diff line number Diff line
@@ -208,7 +208,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev, 


	rc = hwrm_req_replace(bp, req, fw_msg->msg, fw_msg->msg_len);

	if (rc)

		return rc;

		goto drop_req;



	hwrm_req_timeout(bp, req, fw_msg->timeout);

	resp = hwrm_req_hold(bp, req);
@@ -220,6 +220,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev, 


		memcpy(fw_msg->resp, resp, resp_len);

	}

drop_req:

	hwrm_req_drop(bp, req);

	return rc;

}