net: hns3: fix debugfs concurrency issue between kfree buffer and read

[ Upstream commit c295160b1d95e885f1af4586a221cb221d232d10 ]

Now in hns3_dbg_uninit(), there may be concurrency between
kfree buffer and read, it may result in memory error.

Moving debugfs_remove_recursive() in front of kfree buffer to ensure
they don't happen at the same time.

Fixes: 5e69ea7ee2a6 ("net: hns3: refactor the debugfs process")
Signed-off-by: Hao Chen <chenhao418@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index 69d1549e63a9808ab87fc1a0e027073436d64bcf..00eed9835cb55ccca65fb0a7cb08ac88221d3624 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -1406,9 +1406,9 @@ int hns3_dbg_init(struct hnae3_handle *handle)
        return 0;
 
 out:
-       mutex_destroy(&handle->dbgfs_lock);
        debugfs_remove_recursive(handle->hnae3_dbgfs);
        handle->hnae3_dbgfs = NULL;
+       mutex_destroy(&handle->dbgfs_lock);
        return ret;
 }
 
@@ -1416,6 +1416,9 @@ void hns3_dbg_uninit(struct hnae3_handle *handle)
 {
        u32 i;
 
+       debugfs_remove_recursive(handle->hnae3_dbgfs);
+       handle->hnae3_dbgfs = NULL;
+
        for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++)
                if (handle->dbgfs_buf[i]) {
                        kvfree(handle->dbgfs_buf[i]);
@@ -1423,8 +1426,6 @@ void hns3_dbg_uninit(struct hnae3_handle *handle)
                }
 
        mutex_destroy(&handle->dbgfs_lock);
-       debugfs_remove_recursive(handle->hnae3_dbgfs);
-       handle->hnae3_dbgfs = NULL;
 }
 
 void hns3_dbg_register_debugfs(const char *debugfs_dir_name)