73 lines
2.9 KiB
Diff
73 lines
2.9 KiB
Diff
From 6427dde01daa725ddd17ac84c033dba89b75011a Mon Sep 17 00:00:00 2001
|
|
From: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
Date: Fri, 29 May 2026 08:33:51 +0000
|
|
Subject: [PATCH] bnxt_en: Fix RSS context delete logic
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-180316
|
|
CVE: CVE-2026-43260
|
|
Backported from tree(s): linux
|
|
|
|
commit e123d9302d223767bd910bfbcfe607bae909f8ac
|
|
Author: Pavan Chebbi <pavan.chebbi@broadcom.com>
|
|
Date: Thu Feb 19 10:53:11 2026 -0800
|
|
|
|
bnxt_en: Fix RSS context delete logic
|
|
|
|
We need to free the corresponding RSS context VNIC
|
|
in FW everytime an RSS context is deleted in driver.
|
|
Commit 667ac333dbb7 added a check to delete the VNIC
|
|
in FW only when netif_running() is true to help delete
|
|
RSS contexts with interface down.
|
|
|
|
Having that condition will make the driver leak VNICs
|
|
in FW whenever close() happens with active RSS contexts.
|
|
On the subsequent open(), as part of RSS context restoration,
|
|
we will end up trying to create extra VNICs for which we
|
|
did not make any reservation. FW can fail this request,
|
|
thereby making us lose active RSS contexts.
|
|
|
|
Suppose an RSS context is deleted already and we try to
|
|
process a delete request again, then the HWRM functions
|
|
will check for validity of the request and they simply
|
|
return if the resource is already freed. So, even for
|
|
delete-when-down cases, netif_running() check is not
|
|
necessary.
|
|
|
|
Remove the netif_running() condition check when deleting
|
|
an RSS context.
|
|
|
|
Reported-by: Jakub Kicinski <kicinski@meta.com>
|
|
Fixes: 667ac333dbb7 ("eth: bnxt: allow deleting RSS contexts when the device is down")
|
|
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
|
|
Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
|
|
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
|
|
Link: https://patch.msgid.link/20260219185313.2682148-2-michael.chan@broadcom.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
|
|
Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
|
|
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
index d212468cf8aa..3a88c43cdf2b 100644
|
|
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
@@ -10734,12 +10734,10 @@ void bnxt_del_one_rss_ctx(struct bnxt *bp, struct bnxt_rss_ctx *rss_ctx,
|
|
struct bnxt_ntuple_filter *ntp_fltr;
|
|
int i;
|
|
|
|
- if (netif_running(bp->dev)) {
|
|
- bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic);
|
|
- for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) {
|
|
- if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID)
|
|
- bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i);
|
|
- }
|
|
+ bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic);
|
|
+ for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) {
|
|
+ if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID)
|
|
+ bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i);
|
|
}
|
|
if (!all)
|
|
return;
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|