[PATCH v4 net 0/4] net: hns3: fix multiple bugs in reset/error paths

[Jijie Shao]

This series contains four bug fixes for the HNS3 driver, all related
to resource lifecycle management on reset, driver unload, or error
paths.

Patch 1 fixes a vector resource leak in the error path of
hns3_nic_alloc_vector_data, where a devm_kcalloc failure after
successful get_vector() leaves allocated vectors unreleased.

Patch 2 fixes a page_pool leak in the error path of
hns3_alloc_ring_memory, where an hns3_alloc_ring_buffers() failure
for an RX ring frees the descriptor ring but not the page_pool
allocated just before.

Patch 3 fixes an interface stall that occurs when the hardware RX
queue is full and memory allocation fails.  Without an RX interrupt,
NAPI is never scheduled and the queue cannot drain.  A delayed work
re-arms NAPI polling on affected rings to break the deadlock.

Patch 4 fixes a use-after-free in debugfs read callbacks that can
access priv->ring and ring->desc while reset, driver unload, or
ethtool ring resize is freeing those resources.  A mutex is added
to synchronize debugfs readers against resource teardown.

---
Changes in v4:
  - Patch 1: correct the reason for resetting priv->vector_num, as
    reported by Sashiko.  hns3_nic_dealloc_vector_data() is not
    reachable after hns3_nic_alloc_vector_data() fails, so the reset
    is not protecting that path; it keeps the count from describing
    vectors that were already handed back.
  - Patch 2: name hns3_fini_ring() instead of the non-existent
    hns3_free_ring_memory(), and drop "mirroring" because the destroy
    order differs.  The pool is destroyed before the descriptor ring
    here, which is safe because hns3_alloc_ring_buffers() has already
    detached every buffer.
  - Patch 3:
    * Allocate rx_ring_oom_bm in hns3_init_all_ring() only after every
      ring has been set up, and free it in hns3_uninit_all_ring().
      This fixes the leak and the NULL bitmap dereference reported for
      hns3_set_ringparam(), which calls hns3_init_all_ring() without a
      matching hns3_uninit_all_ring(); the allocation is reused when
      the pointer is already set.
    * Cancel the delayed work in hns3_nic_uninit_vector_data() instead
      of hns3_nic_net_down(), so every teardown path cancels it before
      the bitmap is freed.  This closes the use-after-free reported
      for the self-test and external loopback paths, which set DOWN
      without going through hns3_nic_net_down().
    * Drop the cancel and bitmap_zero from hns3_nic_net_down().  A
      pending work that runs while DOWN is set zeroes the bitmap and
      exits, and one that runs after the interface is brought back up
      only schedules a single extra poll round.
    * Always attempt the exit refill in hns3_clean_rx_ring(), so the
      descriptors cleaned by this poll stay armed and the head pointer
      is written as before.
    * Document why rx_oom_cnt is not the standard rx-alloc-fail
      counter, as requested in review.
  - Patch 4: describe both writer paths (client_uninit/reset_uninit vs
    set_ringparam) explicitly, note the -EBUSY user-visible change, and
    return -EBUSY from hns3_dbg_page_pool_info() instead of -EFAULT so
    that sibling readers agree.
v3: https://lore.kernel.org/all/20261030095633.377289-1-shaojijie@xxxxxxxxxx/
Changes in v3:
  - Patch 1: simplify commit message; drop the accumulated-leak
    consequence paragraph and clarify that the vector_num reset avoids
    a NULL deref in hns3_nic_dealloc_vector_data().
  - Patch 2: new patch, fixes a page_pool leak in the error path of
    hns3_alloc_ring_memory().
  - Patch 3: rework the OOM bitmap from per-vector to per-ring,
    indexed by ring->queue_index.  Add cancel_delayed_work_sync() in
    hns3_nic_net_down() after hns3_disable_irqs_and_tqps().  Remove
    the OOM marking in hns3_handle_rx_copybreak() since the packet is
    still delivered via the original page.
  - Patch 4: add Fixes tag for the ring resize path.  Add per-ring
    page_pool NULL check at hns3_dump_page_pool_info() entry.
v2: https://lore.kernel.org/all/20261021121426.3096838-1-shaojijie@xxxxxxxxxx/
Changes in v2:
Patch 1:
  - No change.
Patch 2:
  - Clear per-vector OOM bitmap when device is DOWN to avoid
    spurious napi_schedule() on next up event.
  - Move rx_oom_cnt accounting to hns3_ring_set_oom_state() with
    test_and_set_bit() for per-event counting.
Patch 3:
  - Drop hclge_debugfs.c changes; mutex only protects enet-layer.
  - Replace guard(mutex) with explicit mutex_lock/unlock.
  - Remove redundant NULL checks; unify -EPERM to -EBUSY.
v1: https://lore.kernel.org/all/20260915132434.1141742-1-shaojijie@xxxxxxxxxx/
---

Jijie Shao (4):
  net: hns3: fix vector resource leak in hns3_nic_alloc_vector_data
  net: hns3: fix page_pool leak in hns3_alloc_ring_memory error path
  net: hns3: fix interface stuck after OOM with full hardware rx queue
  net: hns3: fix use-after-free in debugfs read during reset/unload

 drivers/net/ethernet/hisilicon/hns3/hnae3.h   |   1 +
 .../ethernet/hisilicon/hns3/hns3_debugfs.c    | 127 +++++++++++-------
 .../net/ethernet/hisilicon/hns3/hns3_enet.c   |  80 ++++++++++-
 .../net/ethernet/hisilicon/hns3/hns3_enet.h   |  18 +++
 .../ethernet/hisilicon/hns3/hns3_ethtool.c    |   3 +
 5 files changed, 179 insertions(+), 50 deletions(-)


base-commit: 8d5ce4751fad9499ea408163af7f410f18a85782
-- 
2.43.0