Re: [PATCH net] net: airoha: Fix potential use-after-free in airoha_ppe_deinit()

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <[email protected]>:

On Wed, 8 Jul 2026 19:16:16 +0800 you wrote:
> airoha_ppe_deinit() replaces the NPU pointer with NULL via
> rcu_replace_pointer() but does not wait for existing RCU readers
> to exit before calling ppe_deinit() and airoha_npu_put(). This can
> cause a use-after-free if a reader in an RCU read-side critical
> section still holds a reference to the NPU when it is freed.
> 
> The init path (airoha_ppe_init) already calls synchronize_rcu()
> after rcu_assign_pointer(), but the deinit path introduced in
> commit 6abcf751bc08 ("net: airoha: Fix schedule while atomic in
> airoha_ppe_deinit()") omitted the matching barrier when switching
> from rcu_read_lock()/rcu_dereference() to rcu_replace_pointer().
> 
> [...]

Here is the summary with links:
  - [net] net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
    https://git.kernel.org/netdev/net/c/2484568a335c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html