Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217324/?format=api
{ "id": 2217324, "url": "http://patchwork.ozlabs.org/api/patches/2217324/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-4-john.cabaj@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260327213732.4049575-4-john.cabaj@canonical.com>", "list_archive_url": null, "date": "2026-03-27T21:37:30", "name": "[SRU,Q:linux-azure,2/4] net: mana: Fix double destroy_workqueue on service rescan PCI path", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "8356e26e2ad1ef0df69421c760ad74b90db4444a", "submitter": { "id": 85032, "url": "http://patchwork.ozlabs.org/api/people/85032/?format=api", "name": "John Cabaj", "email": "john.cabaj@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-4-john.cabaj@canonical.com/mbox/", "series": [ { "id": 497833, "url": "http://patchwork.ozlabs.org/api/series/497833/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=497833", "date": "2026-03-27T21:37:31", "name": "net: mana: Fix use-after-free in reset service rescan path & net: mana: Fix double destroy_workqueue on service rescan PCI path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497833/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217324/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217324/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=FW7PKeoe;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fjDWy54jVz20Hl\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 28 Mar 2026 08:37:49 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w6Es7-0003zW-8G; Fri, 27 Mar 2026 21:37:39 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <john.cabaj@canonical.com>)\n id 1w6Es5-0003yr-Oc\n for kernel-team@lists.ubuntu.com; Fri, 27 Mar 2026 21:37:37 +0000", "from mail-qk1-f198.google.com (mail-qk1-f198.google.com\n [209.85.222.198])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id A0D823F601\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 21:37:37 +0000 (UTC)", "by mail-qk1-f198.google.com with SMTP id\n af79cd13be357-8cfcf23c0e1so701402285a.2\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 14:37:37 -0700 (PDT)", "from smtp.gmail.com\n (h208-73-92-250.mdtnwi.broadband.dynamic.tds.net. [208.73.92.250])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8d027f0e687sm32939685a.18.2026.03.27.14.37.35\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 27 Mar 2026 14:37:35 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1774647457;\n bh=bfprxIbV/4wNRZwJQBbkbK28m+hRKknGaDwWhteq9/0=;\n h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=FW7PKeoeJ+CuDz5HjRPBVn9VEWf9T7GaEQnD8Q3W89tFf8fqNQOdMyMdYsrjFdV+E\n jPIhjjCrKTp8fMvBYS8Q9bS74GcVrByZ3VMJe8uaB3/OocNbyOrwNSSxJ7PPb5agR5\n FzBPYUjEeosTq1BQMxh4fT738//rraqHveXXxyYwEXTWFQhfkS2qRnwdRyIaVkqIte\n cpbbrTWtaeiwMKoXzzd4yTIK5/Ypdg8TD2CZpO4jMmjW+ST8hOIf7cY0PeKqHd7X6n\n btQyKjf9TlwAfQg0azZoPZmLcukvrGk7WMWsnj44zud40IYfZhpcu+r9Ybhjbyds9g\n bBqMZsET9Ax6XPwirTmh25ZYF7WrCUpw4iIt4R+RQ69CV5FAiS/LbLuELklSi20rSR\n aiE8ahAyYkekkP8IsB7jTJ2gocsrIIrxXiP6Y3BH+xgmhPxRrxXBO7NmsSQTXnX/aw\n HC7koihIH9jzYNsAqnf5JKGCSclgByNpCA+v6gjMkF8QyR1+8+8f1jwR5QXD8xhZaN\n 8f5Fngfh0TIZVC2el4UiUtA8MMSju6VqrPDuesA82mxSsQVfYg72iLRmQj3BKVTCz5\n qyHKHzKlSH9uzkRd6W7bAhsO6YVhYIYS16KkPDzhEtKMGMYTKOHFvkkpGlEX7HCuYM\n ce8mQQKrIEC54XqfTtzMFAZg=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774647456; x=1775252256;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=bfprxIbV/4wNRZwJQBbkbK28m+hRKknGaDwWhteq9/0=;\n b=Kxm8Io7Be04RiC6qtU6tVfLml4vwYDdwDwUNcWzN971bBo+0ZMbvfx7Gv/8gsMEa6s\n UGNm2utaaeTZlhU60uxfkug6NZ+tFlJzPJtpGtKGxLjqF6DaTV94AfVdsV8eAmHns5vL\n confxjC5CnVS4lDGQBc1a0ASYN2lSKccAWsPrO/Xv+1U+HilXT04WOFu3dOA7TRUlaUL\n F6x3xsLXHcM3VXPt5/MCTWfSCI+UC2t1U5F4R8CAsCmgerLzDsslXTo08oVqEc9rvkiA\n t+vHn3hohxe68En5/qgdAHCDlvfXIAx9GseZEryRPBynTsbvzipXZhEQuZ+GiRW32eNE\n f0Mw==", "X-Gm-Message-State": "AOJu0YyKlSODBYYxOAI//pmPVc6OK/GxPEitIO8dL9TIzqcmlvIuQ5cF\n aF6Ubkzr3igbqr3xr5dVI3fZ43uy+9C6rJVCNcLj7utftkDMzrN9Zm2aFeSeB04iRFb9gkedo7T\n CVMWF3jx1kIcNWoyNNJ5/Y8FU2tH7WJBpR/IGOnN9sQaKPxYblWxcu2nByshTZiJT5GmrAGyGNh\n kuuyQTWmCOtqNTOQ==", "X-Gm-Gg": "ATEYQzzHeEA/leJi8daVvlwRuuvbMl/mq4bQXDcWH+irm2/FIrxdahxfb49LW5JAxvv\n qVH1lsJSDxSab3o0kAzzAPKJBkyiWdbuF9AdDXRSS1zPMMF4r73aJSLpmsPEx3YykI3mL5tCupb\n fFnzfQw7MkudVK4hjQWil277vh1/1YWJn53vzrfCrDFVhwc0Mi3q9BrfhuYg+uJuOSwU1CykqZa\n ESVQZ2weWN/o8ndyxcC6GA75yxq00EuvsX4hYElt3khBaCDTcS6vOF9/hZzvvJa8Uml4pTQWYu9\n ndNrwCSLGkrDHa6A6J8ZRfAOkWtDZFFepE6yOp/9gyPZmWfWXb71bYGZdXSo0C5h37pGSnZqWeI\n AeQ1ggPzStWCikSGFJtXpZXpxBur1HeXAfV4Ip/GeOl+nT124IOf1wkL1cXXhZhZmfvvwlh/gCY\n 30OOFbbaxTqA==", "X-Received": [ "by 2002:a05:620a:1788:b0:8cf:c75d:2a0b with SMTP id\n af79cd13be357-8d01c593d70mr542614685a.6.1774647456667;\n Fri, 27 Mar 2026 14:37:36 -0700 (PDT)", "by 2002:a05:620a:1788:b0:8cf:c75d:2a0b with SMTP id\n af79cd13be357-8d01c593d70mr542612185a.6.1774647456255;\n Fri, 27 Mar 2026 14:37:36 -0700 (PDT)" ], "From": "John Cabaj <john.cabaj@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][Q:linux-azure][PATCH 2/4] net: mana: Fix double\n destroy_workqueue on service rescan PCI path", "Date": "Fri, 27 Mar 2026 16:37:30 -0500", "Message-ID": "<20260327213732.4049575-4-john.cabaj@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "References": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Dipayaan Roy <dipayanroy@linux.microsoft.com>\n\nBugLink: https://bugs.launchpad.net/bugs/2146588\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc->service_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc->service_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026] <TASK>\n[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026] </TASK>\n\nFixes: 505cc26bcae0 (\"net: mana: Add support for auxiliary device servicing events\")\nReviewed-by: Haiyang Zhang <haiyangz@microsoft.com>\nSigned-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>\nReviewed-by: Simon Horman <horms@kernel.org>\nLink: https://patch.msgid.link/aZ2bzL64NagfyHpg@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>\n(cherry picked from commit f975a0955276579e2176a134366ed586071c7c6a)\nSigned-off-by: John Cabaj <john.cabaj@canonical.com>\n---\n drivers/net/ethernet/microsoft/mana/gdma_main.c | 5 ++++-\n drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +++-\n 2 files changed, 7 insertions(+), 2 deletions(-)", "diff": "diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c\nindex ce13e05f8624..da4f82433bb0 100644\n--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c\n+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c\n@@ -1950,7 +1950,10 @@ static void mana_gd_cleanup(struct pci_dev *pdev)\n \n \tmana_gd_remove_irqs(pdev);\n \n-\tdestroy_workqueue(gc->service_wq);\n+\tif (gc->service_wq) {\n+\t\tdestroy_workqueue(gc->service_wq);\n+\t\tgc->service_wq = NULL;\n+\t}\n \tdev_dbg(&pdev->dev, \"mana gdma cleanup successful\\n\");\n }\n \ndiff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c\nindex 69547d65386e..67bab34c1582 100644\n--- a/drivers/net/ethernet/microsoft/mana/mana_en.c\n+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c\n@@ -3709,7 +3709,9 @@ void mana_rdma_remove(struct gdma_dev *gd)\n \t}\n \n \tWRITE_ONCE(gd->rdma_teardown, true);\n-\tflush_workqueue(gc->service_wq);\n+\n+\tif (gc->service_wq)\n+\t\tflush_workqueue(gc->service_wq);\n \n \tif (gd->adev)\n \t\tremove_adev(gd);\n", "prefixes": [ "SRU", "Q:linux-azure", "2/4" ] }