Re: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure

[Ferruh Yigit <ferruh.yigit@amd.com>]

On 10/27/2024 8:43 AM, Morten Brørup wrote:
>> From: Roger B Melton [mailto:rmelton@cisco.com]
>> Sent: Saturday, 26 October 2024 16.34
>>
>> Problem:
>>
>> If vxmnet3_dev_configure() fails, applications may call
>> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
>> hw->shared structure is allocated the close will lead to a segv.
>>
>> Root Cause:
>>
>> This crash is due to incorrect adapter_stopped state in the
>> vmxnet3 dev_private structure. When dev_private is allocated,
>> adapter_stopped will be 0 (FALSE).  eth_vmxnet3_dev_init() does not
>> set it to TRUE, so it will remain FALSE until a successful
>> vmxnet3_dev_start() followed by a vmxnet3_dev_stop().  When
>> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
>> vmxnet3_dev_stop() will check the adapter_stopped state in the
>> vmxnet3 shared data, find it is FALSE and will proceed to stop the
>> device, calling vmxnet3_disable_all_intrs().
>> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
>> resulting in the segv.
>>
>> Solution:
>>
>> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
>> processing.
>>
>> Signed-off-by: Roger B Melton <rmelton@cisco.com>
> 
> Acked-by: Morten Brørup <mb@smartsharesystems.com>
> 

 Fixes: dfaff37fc46d ("vmxnet3: import new vmxnet3 poll mode driver
implementation")
 Cc: stable@dpdk.org

Applied to dpdk-next-net/main, thanks.