[PATCH] net/bnxt: fix deadlock in mgr timer cb

[PATCH] net/bnxt: fix deadlock in mgr timer cb

[Weiguo Li]

The function 'ulp_ha_mgr_timer_cb' acquires a lock on the context
entry at the beginning with bnxt_ulp_cntxt_entry_acquire(). This lock
is expected to be released by bnxt_ulp_cntxt_entry_release() at the
end of the function.

However, the second early return statement in the function could
potentially bypass the lock release. To fix this issue, add
bnxt_ulp_cntxt_entry_release() before the return statement.

Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper)
CC: stable@dpdk.org

Signed-off-by: Weiguo Li <liweiguo@xencore.cn>
---
 drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
index f3f5bda890..852deef3b4 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
@@ -253,6 +253,7 @@ ulp_ha_mgr_timer_cb(void *arg)
 
 	myclient_cnt = bnxt_ulp_cntxt_num_shared_clients_get(ulp_ctx);
 	if (myclient_cnt == 0) {
+		bnxt_ulp_cntxt_entry_release();
 		BNXT_TF_DBG(ERR,
 			    "PANIC Client Count is zero kill timer\n.");
 		return;
-- 
2.34.1

Re: [PATCH] net/bnxt: fix deadlock in mgr timer cb

[Ajit Khaparde]

[-- Attachment #1: Type: text/plain, Size: 1503 bytes --]

On Fri, Nov 3, 2023 at 9:07 PM Weiguo Li <liwg06@foxmail.com> wrote:
>
> The function 'ulp_ha_mgr_timer_cb' acquires a lock on the context
> entry at the beginning with bnxt_ulp_cntxt_entry_acquire(). This lock
> is expected to be released by bnxt_ulp_cntxt_entry_release() at the
> end of the function.
>
> However, the second early return statement in the function could
> potentially bypass the lock release. To fix this issue, add
> bnxt_ulp_cntxt_entry_release() before the return statement.
>
> Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper)
> CC: stable@dpdk.org
>
> Signed-off-by: Weiguo Li <liweiguo@xencore.cn>

Acked-by: Ajit Khaparde <ajit.khaparde@broadcom.com>

Fixed up the author and signed-off-by mismatch and merged in
brcm-next-net for-next-net branch.

> ---
>  drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> index f3f5bda890..852deef3b4 100644
> --- a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> +++ b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
> @@ -253,6 +253,7 @@ ulp_ha_mgr_timer_cb(void *arg)
>
>         myclient_cnt = bnxt_ulp_cntxt_num_shared_clients_get(ulp_ctx);
>         if (myclient_cnt == 0) {
> +               bnxt_ulp_cntxt_entry_release();
>                 BNXT_TF_DBG(ERR,
>                             "PANIC Client Count is zero kill timer\n.");
>                 return;
> --
> 2.34.1
>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4218 bytes --]