Skip to content

Commit

Permalink
ice: Avoid crash from unnecessary IDA free
Browse files Browse the repository at this point in the history
In the remove path, there is an attempt to free the aux_idx IDA whether
it was allocated or not.  This can potentially cause a crash when
unloading the driver on systems that do not initialize support for RDMA.
But, this free cannot be gated by the status bit for RDMA, since it is
allocated if the driver detects support for RDMA at probe time, but the
driver can enter into a state where RDMA is not supported after the IDA
has been allocated at probe time and this would lead to a memory leak.

Initialize aux_idx to an invalid value and check for a valid value when
unloading to determine if an IDA free is necessary.

Fixes: d25a0fc ("ice: Initialize RDMA support")
Reported-by: Jun Miao <jun.miao@windriver.com>
Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
Tested-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
  • Loading branch information
Dave Ertman authored and Tony Nguyen committed Oct 14, 2021
1 parent ff7e932 commit 73e30a6
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion drivers/net/ethernet/intel/ice/ice_main.c
Original file line number Diff line number Diff line change
Expand Up @@ -4224,6 +4224,9 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
if (!pf)
return -ENOMEM;

/* initialize Auxiliary index to invalid value */
pf->aux_idx = -1;

/* set up for high or low DMA */
err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
if (err)
Expand Down Expand Up @@ -4615,7 +4618,8 @@ static void ice_remove(struct pci_dev *pdev)

ice_aq_cancel_waiting_tasks(pf);
ice_unplug_aux_dev(pf);
ida_free(&ice_aux_ida, pf->aux_idx);
if (pf->aux_idx >= 0)
ida_free(&ice_aux_ida, pf->aux_idx);
set_bit(ICE_DOWN, pf->state);

mutex_destroy(&(&pf->hw)->fdir_fltr_lock);
Expand Down

0 comments on commit 73e30a6

Please sign in to comment.