* [PATCH v2 net 1/3] net: hns3: fix vector resource leak in hns3_nic_alloc_vector_data
2026-10-21 12:14 [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver Jijie Shao
@ 2026-10-21 12:14 ` Jijie Shao
2026-10-21 12:14 ` [PATCH v2 net 2/3] net: hns3: fix interface stuck after OOM with full hardware rx queue Jijie Shao
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Jijie Shao @ 2026-10-21 12:14 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, andrew+netdev
Cc: shenjian15, liuyonglong, chenhao418, yangshuaisong, ningwei15,
netdev, linux-kernel, shaojijie
After h->ae_algo->ops->get_vector() has acquired MSI-X vectors, a
subsequent devm_kcalloc failure for priv->tqp_vector jumps to 'out'
and returns without calling put_vector() to release them. The
underlying hclge/hclgevf bookkeeping (num_msi_used, num_msi_left,
vector_status[]) is left inconsistent: the vectors are marked as in
use but hns3_enet never tracks or releases them.
On the reset path this leak accumulates across failed reset attempts,
steadily reducing num_msi_left until get_vector() can no longer
satisfy the requested count, at which point the interface fails to
recover.
Call put_vector() for every vector acquired by get_vector() before
returning an error, and reset priv->vector_num so the dealloc path
cannot dereference a NULL priv->tqp_vector.
Fixes: dd38c72604dc ("net: hns3: fix for coalesce configuration lost during reset")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 47788be64be6..2f3aeade558c 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -4854,7 +4854,7 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
GFP_KERNEL);
if (!priv->tqp_vector) {
ret = -ENOMEM;
- goto out;
+ goto err_put_vector;
}
for (i = 0; i < priv->vector_num; i++) {
@@ -4865,7 +4865,13 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
hns3_vector_coalesce_init(tqp_vector, priv);
}
-out:
+ devm_kfree(&pdev->dev, vector);
+ return 0;
+
+err_put_vector:
+ for (i = 0; i < vector_num; i++)
+ h->ae_algo->ops->put_vector(h, vector[i].vector);
+ priv->vector_num = 0;
devm_kfree(&pdev->dev, vector);
return ret;
}
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2 net 2/3] net: hns3: fix interface stuck after OOM with full hardware rx queue
2026-10-21 12:14 [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver Jijie Shao
2026-10-21 12:14 ` [PATCH v2 net 1/3] net: hns3: fix vector resource leak in hns3_nic_alloc_vector_data Jijie Shao
@ 2026-10-21 12:14 ` Jijie Shao
2026-10-21 12:14 ` [PATCH v2 net 3/3] net: hns3: fix use-after-free in debugfs read during reset/unload Jijie Shao
2026-10-21 12:20 ` [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver netdev-bot+sinfo
3 siblings, 0 replies; 5+ messages in thread
From: Jijie Shao @ 2026-10-21 12:14 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, andrew+netdev
Cc: shenjian15, liuyonglong, chenhao418, yangshuaisong, ningwei15,
netdev, linux-kernel, shaojijie
NAPI polling on hns3 is driven by hardware RX interrupts. Under
memory pressure, RX skb and frag allocations fail, packets are no
longer reaped from the hardware rx ring. Once the ring fills, the
hardware stops generating RX interrupts and NAPI is never scheduled
again -- even after memory becomes available, leaving the interface
deadlocked.
Break the deadlock by adding a software recovery path that re-arms
NAPI via a 250ms delayed_work, independent of hardware interrupts.
A per-vector bitmap tracks which vectors have rings in OOM state;
the work function schedules NAPI for each affected vector. OOM
state is marked at every RX allocation failure site and cleared
when the delayed_work fires.
This supersedes the busy-poll recovery from commit 68752b24f51a
("net: hns3: schedule the polling again when allocation fails"),
which returned budget on allocation failure to keep NAPI polling
and caused CPU spinning under prolonged memory pressure. Now
hns3_clean_rx_ring() returns recv_pkts instead of budget on
allocation failure, letting NAPI exit and the delayed_work take
over. Add rx_oom_cnt ethtool counter, incremented once per OOM
event (on the 0 -> 1 bitmap transition) for diagnostics.
Fixes: 81ae0e0491f3 ("net: hns3: Add skb chain when num of RX buf exceeds MAX_SKB_FRAGS")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
Changes in v2:
- Clear per-vector OOM bitmap when device is DOWN to avoid
spurious napi_schedule() on next up event.
- Move rx_oom_cnt accounting to hns3_ring_set_oom_state() with
test_and_set_bit() for per-event counting.
- Expand changelog: reference commit 68752b24f51a, explain
hns3_clean_rx_ring() return value change, document rx_oom_cnt
per-event counting semantics.
v1: https://lore.kernel.org/all/20260915132434.1141742-3-shaojijie@huawei.com/
---
.../net/ethernet/hisilicon/hns3/hns3_enet.c | 53 ++++++++++++++++++-
.../net/ethernet/hisilicon/hns3/hns3_enet.h | 18 +++++++
.../ethernet/hisilicon/hns3/hns3_ethtool.c | 1 +
3 files changed, 71 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 2f3aeade558c..09f688893aab 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -78,6 +78,8 @@ module_param(page_pool_enabled, bool, 0400);
#define HNS3_MIN_TX_LEN 33U
#define HNS3_MIN_TUN_PKT_LEN 65U
+#define HNS3_OOM_POLL_INTERVAL_MS 250
+
/* hns3_pci_tbl - PCI Device ID Table
*
* Last entry must be all 0s
@@ -3793,6 +3795,7 @@ static int hns3_handle_rx_copybreak(struct sk_buff *skb, int i,
hns3_rl_err(ring_to_netdev(ring),
"failed to allocate rx frag\n");
+ hns3_ring_set_oom_state(ring);
return -ENOMEM;
}
@@ -4162,6 +4165,7 @@ static int hns3_add_frag(struct hns3_enet_ring *ring)
if (unlikely(!new_skb)) {
hns3_rl_err(ring_to_netdev(ring),
"alloc rx fraglist skb fail\n");
+ hns3_ring_set_oom_state(ring);
return -ENXIO;
}
@@ -4451,6 +4455,35 @@ static int hns3_handle_rx_bd(struct hns3_enet_ring *ring)
return 0;
}
+static void hns3_oom_task(struct work_struct *work)
+{
+ struct hns3_nic_priv *priv = container_of(work, struct hns3_nic_priv,
+ oom_task.work);
+ struct net_device *netdev = priv->netdev;
+ struct hnae3_handle *h = priv->ae_handle;
+ u16 i;
+
+ if (test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+ bitmap_zero(priv->oom_vector_bm, priv->vector_num);
+ return;
+ }
+
+ netif_dbg(h, rx_err, netdev, "oom napi_schedule 0x%*pb\n",
+ priv->vector_num, priv->oom_vector_bm);
+ for (i = 0; i < priv->vector_num; i++)
+ if (test_and_clear_bit(i, priv->oom_vector_bm))
+ napi_schedule(&priv->tqp_vector[i].napi);
+}
+
+static void hns3_oom_task_schedule(struct hns3_enet_ring *ring)
+{
+ struct hns3_nic_priv *priv = netdev_priv(ring_to_netdev(ring));
+
+ hns3_ring_set_oom_state(ring);
+ schedule_delayed_work(&priv->oom_task,
+ msecs_to_jiffies(HNS3_OOM_POLL_INTERVAL_MS));
+}
+
int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
void (*rx_fn)(struct hns3_enet_ring *, struct sk_buff *))
{
@@ -4472,6 +4505,9 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
/* Poll one pkt */
err = hns3_handle_rx_bd(ring);
+ if (unlikely(err == -ENOMEM))
+ failure = true;
+
/* Do not get FE for the packet or failed to alloc skb */
if (unlikely(!ring->skb || err == -ENXIO)) {
goto out;
@@ -4493,7 +4529,10 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
failure = failure ||
hns3_nic_alloc_rx_buffers(ring, unused_count);
- return failure ? budget : recv_pkts;
+ if (unlikely(failure || hns3_ring_is_oom_state(ring)))
+ hns3_oom_task_schedule(ring);
+
+ return recv_pkts;
}
static void hns3_update_rx_int_coalesce(struct hns3_enet_tqp_vector *tqp_vector)
@@ -4788,6 +4827,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
hns3_nic_common_poll);
}
+ INIT_DELAYED_WORK(&priv->oom_task, hns3_oom_task);
return 0;
map_ring_fail:
@@ -4865,9 +4905,18 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
hns3_vector_coalesce_init(tqp_vector, priv);
}
+ priv->oom_vector_bm = bitmap_zalloc(vector_num, GFP_KERNEL);
+ if (!priv->oom_vector_bm) {
+ ret = -ENOMEM;
+ goto err_free_tqp_vector;
+ }
+
devm_kfree(&pdev->dev, vector);
return 0;
+err_free_tqp_vector:
+ devm_kfree(&pdev->dev, priv->tqp_vector);
+ priv->tqp_vector = NULL;
err_put_vector:
for (i = 0; i < vector_num; i++)
h->ae_algo->ops->put_vector(h, vector[i].vector);
@@ -4889,6 +4938,7 @@ static void hns3_nic_uninit_vector_data(struct hns3_nic_priv *priv)
struct hns3_enet_tqp_vector *tqp_vector;
int i;
+ cancel_delayed_work_sync(&priv->oom_task);
for (i = 0; i < priv->vector_num; i++) {
tqp_vector = &priv->tqp_vector[i];
@@ -4920,6 +4970,7 @@ static void hns3_nic_dealloc_vector_data(struct hns3_nic_priv *priv)
struct pci_dev *pdev = h->pdev;
int i, ret;
+ bitmap_free(priv->oom_vector_bm);
for (i = 0; i < priv->vector_num; i++) {
struct hns3_enet_tqp_vector *tqp_vector;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index 933e3527ed82..f71162af2da7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -449,6 +449,7 @@ struct ring_stats {
u64 non_reuse_pg;
u64 frag_alloc_err;
u64 frag_alloc;
+ u64 rx_oom_cnt;
};
__le16 csum;
};
@@ -585,6 +586,8 @@ struct hns3_nic_priv {
struct hns3_enet_tqp_vector *tqp_vector;
u16 vector_num;
u8 max_non_tso_bd_num;
+ struct delayed_work oom_task;
+ unsigned long *oom_vector_bm;
u64 tx_timeout_count;
@@ -711,6 +714,21 @@ static inline unsigned int hns3_page_order(struct hns3_enet_ring *ring)
#define hns3_rl_usec_to_reg(int_rl) ((int_rl) >> 2)
#define hns3_rl_round_down(int_rl) round_down(int_rl, 4)
+static inline void hns3_ring_set_oom_state(struct hns3_enet_ring *ring)
+{
+ struct hns3_nic_priv *priv = netdev_priv(ring_to_netdev(ring));
+
+ if (!test_and_set_bit(ring->tqp_vector->idx, priv->oom_vector_bm))
+ hns3_ring_stats_update(ring, rx_oom_cnt);
+}
+
+static inline bool hns3_ring_is_oom_state(struct hns3_enet_ring *ring)
+{
+ struct hns3_nic_priv *priv = netdev_priv(ring_to_netdev(ring));
+
+ return test_bit(ring->tqp_vector->idx, priv->oom_vector_bm);
+}
+
void hns3_ethtool_set_ops(struct net_device *netdev);
int hns3_set_channels(struct net_device *netdev,
struct ethtool_channels *ch);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index e7318f236315..392653635bda 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -62,6 +62,7 @@ static const struct hns3_stats hns3_rxq_stats[] = {
HNS3_TQP_STAT("non_reuse_pg", non_reuse_pg),
HNS3_TQP_STAT("frag_alloc_err", frag_alloc_err),
HNS3_TQP_STAT("frag_alloc", frag_alloc),
+ HNS3_TQP_STAT("rx_oom_cnt", rx_oom_cnt),
};
#define HNS3_PRIV_FLAGS_LEN ARRAY_SIZE(hns3_priv_flags)
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2 net 3/3] net: hns3: fix use-after-free in debugfs read during reset/unload
2026-10-21 12:14 [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver Jijie Shao
2026-10-21 12:14 ` [PATCH v2 net 1/3] net: hns3: fix vector resource leak in hns3_nic_alloc_vector_data Jijie Shao
2026-10-21 12:14 ` [PATCH v2 net 2/3] net: hns3: fix interface stuck after OOM with full hardware rx queue Jijie Shao
@ 2026-10-21 12:14 ` Jijie Shao
2026-10-21 12:20 ` [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver netdev-bot+sinfo
3 siblings, 0 replies; 5+ messages in thread
From: Jijie Shao @ 2026-10-21 12:14 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, andrew+netdev
Cc: shenjian15, liuyonglong, chenhao418, yangshuaisong, ningwei15,
netdev, linux-kernel, shaojijie
The seq_file refactoring of hns3 debugfs removed the per-file entry
state checks. Without them, debugfs show callbacks can access
priv->ring, priv->tqp_vector, and ring->desc while these resources
are being freed by reset, driver unload, or ethtool ring resize.
Plain state-bit checks leave a TOCTOU window between check and use.
Fix by adding a mutex (dbg_mutex) to struct hnae3_handle, used by
enet-layer debugfs callbacks. Readers acquire the mutex, then check
device state per iteration -- this lets an in-flight reader exit
promptly when reset begins mid-dump, keeping reset latency bounded
by one iteration, and also rejects a reader that arrives after the
writer has finished tearing down resources (priv->ring is NULL by
then). Writers clear INITED first to signal readers, then acquire
the mutex before freeing resources. The dbg_uninit() call stays
outside the mutex to avoid deadlock with debugfs_remove_recursive.
Fixes: eced3d1c41db ("net: hns3: use seq_file for files in queue/ in debugfs")
Closes: https://lore.kernel.org/all/a0853cd9-cab5-441d-b181-8ba97f2f58b0@huawei.com/
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
Changes in v2:
- Drop hclge_debugfs.c changes; mutex only protects enet-layer
debugfs callbacks.
- Replace guard(mutex) with explicit mutex_lock/unlock and
"goto unlock" error-path labels.
- Remove redundant if (!priv->ring) checks in
hns3_dbg_rx_queue_info() and hns3_dbg_tx_queue_info().
- Unify per-iteration return values from -EPERM to -EBUSY.
- Reorder local variables to reverse-Christmas-tree order.
- Reword changelog to drop the "PF-layer" description.
v1: https://lore.kernel.org/all/20260915132434.1141742-4-shaojijie@huawei.com/
---
drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 +
.../ethernet/hisilicon/hns3/hns3_debugfs.c | 124 +++++++++++-------
.../net/ethernet/hisilicon/hns3/hns3_enet.c | 7 +
.../ethernet/hisilicon/hns3/hns3_ethtool.c | 2 +
4 files changed, 88 insertions(+), 46 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index 4286af9239b0..e94cc33da864 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -944,6 +944,7 @@ struct hnae3_handle {
u8 netdev_flags;
struct dentry *hnae3_dbgfs;
+ struct mutex dbg_mutex; /* protect debugfs against reset/unload */
/* Network interface message level enabled bits */
u32 msg_enable;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index 1347edac7699..40d715924e58 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -389,6 +389,12 @@ static const char * const dim_state_str[] = { "START", "IN_PROG", "APPLY" };
static const char * const
dim_tune_stat_str[] = { "ON_TOP", "TIRED", "RIGHT", "LEFT" };
+static bool hns3_dbg_is_device_busy(struct hns3_nic_priv *priv)
+{
+ return !test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
+ test_bit(HNS3_NIC_STATE_RESETTING, &priv->state);
+}
+
static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector,
struct seq_file *s, int i, bool is_tx)
{
@@ -434,7 +440,7 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector,
}
}
-static void hns3_dump_coal_info(struct seq_file *s, bool is_tx)
+static int hns3_dump_coal_info(struct seq_file *s, bool is_tx)
{
struct hnae3_handle *h = hnae3_seq_file_to_handle(s);
struct hns3_enet_tqp_vector *tqp_vector;
@@ -448,18 +454,34 @@ static void hns3_dump_coal_info(struct seq_file *s, bool is_tx)
seq_puts(s, "HW_GL HW_QL\n");
for (i = 0; i < priv->vector_num; i++) {
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv))
+ return -EBUSY;
+
tqp_vector = &priv->tqp_vector[i];
hns3_get_coal_info(tqp_vector, s, i, is_tx);
}
+
+ return 0;
}
static int hns3_dbg_coal_info(struct seq_file *s, void *data)
{
- hns3_dump_coal_info(s, true);
+ struct hnae3_handle *h = hnae3_seq_file_to_handle(s);
+ struct hns3_nic_priv *priv = h->priv;
+ int ret;
+
+ mutex_lock(&priv->ae_handle->dbg_mutex);
+ ret = hns3_dump_coal_info(s, true);
+ if (ret)
+ goto unlock;
+
seq_puts(s, "\n");
- hns3_dump_coal_info(s, false);
+ ret = hns3_dump_coal_info(s, false);
- return 0;
+unlock:
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return ret;
}
static void hns3_dump_rx_queue_info(struct hns3_enet_ring *ring,
@@ -504,27 +526,22 @@ static int hns3_dbg_rx_queue_info(struct seq_file *s, void *data)
struct hns3_enet_ring *ring;
u32 i;
- if (!priv->ring) {
- dev_err(&h->pdev->dev, "priv->ring is NULL\n");
- return -EFAULT;
- }
-
+ mutex_lock(&priv->ae_handle->dbg_mutex);
seq_puts(s, "QUEUE_ID BD_NUM BD_LEN TAIL HEAD FBDNUM ");
seq_puts(s, "PKTNUM COPYBREAK RING_EN RX_RING_EN BASE_ADDR\n");
for (i = 0; i < h->kinfo.num_tqps; i++) {
- /* Each cycle needs to determine whether the instance is reset,
- * to prevent reference to invalid memory. And need to ensure
- * that the following code is executed within 100ms.
- */
- if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
- test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
- return -EPERM;
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv)) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return -EBUSY;
+ }
ring = &priv->ring[(u32)(i + h->kinfo.num_tqps)];
hns3_dump_rx_queue_info(ring, s, i);
}
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
return 0;
}
@@ -569,27 +586,22 @@ static int hns3_dbg_tx_queue_info(struct seq_file *s, void *data)
struct hns3_enet_ring *ring;
u32 i;
- if (!priv->ring) {
- dev_err(&h->pdev->dev, "priv->ring is NULL\n");
- return -EFAULT;
- }
-
+ mutex_lock(&priv->ae_handle->dbg_mutex);
seq_puts(s, "QUEUE_ID BD_NUM TC TAIL HEAD FBDNUM OFFSET ");
seq_puts(s, "PKTNUM RING_EN TX_RING_EN BASE_ADDR\n");
for (i = 0; i < h->kinfo.num_tqps; i++) {
- /* Each cycle needs to determine whether the instance is reset,
- * to prevent reference to invalid memory. And need to ensure
- * that the following code is executed within 100ms.
- */
- if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
- test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
- return -EPERM;
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv)) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return -EBUSY;
+ }
ring = &priv->ring[i];
hns3_dump_tx_queue_info(ring, s, i);
}
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
return 0;
}
@@ -604,14 +616,23 @@ static int hns3_dbg_queue_map(struct seq_file *s, void *data)
seq_puts(s, "local_queue_id global_queue_id vector_id\n");
+ mutex_lock(&priv->ae_handle->dbg_mutex);
for (i = 0; i < h->kinfo.num_tqps; i++) {
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv)) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return -EBUSY;
+ }
+
if (!priv->ring || !priv->ring[i].tqp_vector)
continue;
+
seq_printf(s, "%-16u%-17u%d\n", i,
h->ae_algo->ops->get_global_queue_id(h, i),
priv->ring[i].tqp_vector->vector_irq);
}
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
return 0;
}
@@ -661,8 +682,11 @@ static int hns3_dbg_rx_bd_info(struct seq_file *s, void *private)
ring = &priv->ring[data->qid + data->handle->kinfo.num_tqps];
for (i = 0; i < ring->desc_num; i++) {
- desc = &ring->desc[i];
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv))
+ return -EBUSY;
+ desc = &ring->desc[i];
hns3_dump_rx_bd_info(priv, desc, s, i);
}
@@ -706,8 +730,11 @@ static int hns3_dbg_tx_bd_info(struct seq_file *s, void *private)
ring = &priv->ring[data->qid];
for (i = 0; i < ring->desc_num; i++) {
- desc = &ring->desc[i];
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv))
+ return -EBUSY;
+ desc = &ring->desc[i];
hns3_dump_tx_bd_info(desc, s, i);
}
@@ -796,13 +823,9 @@ static int hns3_dbg_page_pool_info(struct seq_file *s, void *data)
struct hns3_enet_ring *ring;
u32 i;
- if (!priv->ring) {
- dev_err(&h->pdev->dev, "priv->ring is NULL\n");
- return -EFAULT;
- }
-
- if (!priv->ring[h->kinfo.num_tqps].page_pool) {
- dev_err(&h->pdev->dev, "page pool is not initialized\n");
+ mutex_lock(&priv->ae_handle->dbg_mutex);
+ if (!priv->ring || !priv->ring[h->kinfo.num_tqps].page_pool) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
return -EFAULT;
}
@@ -810,14 +833,17 @@ static int hns3_dbg_page_pool_info(struct seq_file *s, void *data)
seq_puts(s, "POOL_SIZE(PAGE_NUM) ORDER NUMA_ID MAX_LEN\n");
for (i = 0; i < h->kinfo.num_tqps; i++) {
- if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
- test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
- return -EPERM;
+ /* Per-iteration check bounds reset latency to one iteration. */
+ if (hns3_dbg_is_device_busy(priv)) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return -EBUSY;
+ }
ring = &priv->ring[(u32)(i + h->kinfo.num_tqps)];
hns3_dump_page_pool_info(ring, s, i);
}
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
return 0;
}
@@ -826,17 +852,23 @@ static int hns3_dbg_bd_info_show(struct seq_file *s, void *private)
struct hns3_dbg_data *data = s->private;
struct hnae3_handle *h = data->handle;
struct hns3_nic_priv *priv = h->priv;
+ int ret;
- if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
- test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
- return -EBUSY;
+ mutex_lock(&priv->ae_handle->dbg_mutex);
+ if (!priv->ring) {
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return -EFAULT;
+ }
if (data->cmd == HNAE3_DBG_CMD_TX_BD)
- return hns3_dbg_tx_bd_info(s, private);
+ ret = hns3_dbg_tx_bd_info(s, private);
else if (data->cmd == HNAE3_DBG_CMD_RX_BD)
- return hns3_dbg_rx_bd_info(s, private);
+ ret = hns3_dbg_rx_bd_info(s, private);
+ else
+ ret = -EOPNOTSUPP;
- return -EOPNOTSUPP;
+ mutex_unlock(&priv->ae_handle->dbg_mutex);
+ return ret;
}
DEFINE_SHOW_ATTRIBUTE(hns3_dbg_bd_info);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 09f688893aab..aa5332e4dd29 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -5450,6 +5450,7 @@ static int hns3_client_init(struct hnae3_handle *handle)
priv->min_tx_copybreak = 0;
priv->min_tx_spare_buf_size = 0;
set_bit(HNS3_NIC_STATE_DOWN, &priv->state);
+ mutex_init(&handle->dbg_mutex);
handle->msg_enable = netif_msg_init(debug, DEFAULT_MSG_LEVEL);
@@ -5563,6 +5564,7 @@ static int hns3_client_init(struct hnae3_handle *handle)
priv->ring = NULL;
out_get_ring_cfg:
priv->ae_handle = NULL;
+ mutex_destroy(&handle->dbg_mutex);
free_netdev(netdev);
return ret;
}
@@ -5586,6 +5588,7 @@ static void hns3_client_uninit(struct hnae3_handle *handle, bool reset)
hns3_free_rx_cpu_rmap(netdev);
+ mutex_lock(&handle->dbg_mutex);
hns3_nic_uninit_irq(priv);
hns3_clear_all_ring(handle, true);
@@ -5597,9 +5600,11 @@ static void hns3_client_uninit(struct hnae3_handle *handle, bool reset)
hns3_uninit_all_ring(priv);
hns3_put_ring_config(priv);
+ mutex_unlock(&handle->dbg_mutex);
out_netdev_free:
hns3_dbg_uninit(handle);
+ mutex_destroy(&handle->dbg_mutex);
free_netdev(netdev);
}
@@ -5876,6 +5881,7 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle)
return 0;
}
+ mutex_lock(&handle->dbg_mutex);
hns3_free_rx_cpu_rmap(netdev);
hns3_nic_uninit_irq(priv);
hns3_clear_all_ring(handle, true);
@@ -5888,6 +5894,7 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle)
hns3_uninit_all_ring(priv);
hns3_put_ring_config(priv);
+ mutex_unlock(&handle->dbg_mutex);
return 0;
}
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 392653635bda..cb6a23085be4 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -1258,6 +1258,7 @@ static int hns3_set_ringparam(struct net_device *ndev,
if (if_running)
ndev->netdev_ops->ndo_stop(ndev);
+ mutex_lock(&h->dbg_mutex);
hns3_change_all_ring_bd_num(priv, new_ringparam.tx_desc_num,
new_ringparam.rx_desc_num);
hns3_change_rx_buf_len(ndev, new_ringparam.rx_buf_len);
@@ -1276,6 +1277,7 @@ static int hns3_set_ringparam(struct net_device *ndev,
for (i = 0; i < h->kinfo.num_tqps * 2; i++)
hns3_fini_ring(&tmp_rings[i]);
}
+ mutex_unlock(&h->dbg_mutex);
kfree(tmp_rings);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver
2026-10-21 12:14 [PATCH v2 net 0/3] net: hns3: three fixes for hns3 driver Jijie Shao
` (2 preceding siblings ...)
2026-10-21 12:14 ` [PATCH v2 net 3/3] net: hns3: fix use-after-free in debugfs read during reset/unload Jijie Shao
@ 2026-10-21 12:20 ` netdev-bot+sinfo
3 siblings, 0 replies; 5+ messages in thread
From: netdev-bot+sinfo @ 2026-10-21 12:20 UTC (permalink / raw)
To: Jijie Shao
Cc: davem, edumazet, kuba, pabeni, andrew+netdev, shenjian15,
liuyonglong, chenhao418, yangshuaisong, ningwei15, netdev,
linux-kernel
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
- What hardware the change was tested on. For driver fixes please
mention the device (and if relevant firmware version) used for
testing, or say that the change was not tested on real hardware.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 5+ messages in thread