[PATCH net-next 3/7] net: mana: free HWC comp_buf after destroying the EQ

[Long Li]

mana_hwc_destroy_cq() freed hwc_cq->comp_buf before destroying the CQ and
EQ.  comp_buf is dereferenced by mana_hwc_comp_event(), which the EQ
interrupt handler invokes; freeing it while the EQ was still registered
let a late handler touch freed memory.

Destroy the CQ and EQ first -- the EQ teardown deregisters the IRQ and
fences in-flight handlers -- then free comp_buf and hwc_cq.

Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network 
Adapter (MANA)")
Signed-off-by: Long Li <lon...@microsoft.com>
---
 drivers/net/ethernet/microsoft/mana/hw_channel.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c 
b/drivers/net/ethernet/microsoft/mana/hw_channel.c
index 3f011ebbe7b3..2239fdeda57c 100644
--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
+++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
@@ -384,14 +384,20 @@ static void mana_hwc_comp_event(void *ctx, struct 
gdma_queue *q_self)
 
 static void mana_hwc_destroy_cq(struct gdma_context *gc, struct hwc_cq *hwc_cq)
 {
-       kfree(hwc_cq->comp_buf);
-
        if (hwc_cq->gdma_cq)
                mana_gd_destroy_queue(gc, hwc_cq->gdma_cq);
 
+       /* comp_buf is reached only by mana_hwc_comp_event(), which the
+        * EQ handler invokes via cq_table[id].  The CQ destroy above
+        * already cleared that slot and ran synchronize_rcu(), so no
+        * handler can reach comp_buf once it returns.  Destroying the EQ
+        * here additionally tears down the IRQ (defense in depth) before
+        * comp_buf and hwc_cq are freed below.
+        */
        if (hwc_cq->gdma_eq)
                mana_gd_destroy_queue(gc, hwc_cq->gdma_eq);
 
+       kfree(hwc_cq->comp_buf);
        kfree(hwc_cq);
 }
 
-- 
2.43.0