| Newsgroups |
org.kernel.vger.netdev |
| Message-ID |
<[email protected]> |
> 2026年8月21日 02:29，Simon Horman <[email protected]> 写道：
>
> On Tue, Aug 18, 2026 at 06:08:41PM +0800, Mengyuan Lou wrote:
>> During queue teardown or channel reconfiguration (e.g. via ethtool -L),
>> ring pointers in wx->rx_ring[] and wx->tx_ring[] can be cleared to NULL
>> and freed asynchronously via kfree_rcu().
>>
>> Concurrency between interface reconfiguration and background tasks
>> (such as service tasks or dev_get_stats) can result in NULL pointer
>> dereferences or Use-After-Free (UAF) issues when accessing per-queue
>> structures. Specifically:
>> 1. wx_update_stats() accesses per-queue Rx, RSC, and Tx rings without
>> RCU read-side protection, and lacked NULL checks in the RSC
>> accumulation loop.
>> 2. wx_update_xoff_rx_lfc() walks wx->tx_ring[] and modifies ring->state
>> without RCU protection or NULL checks, risking a kernel panic when
>> flow control pause frames are received during queue teardown.
>> 3. Queue assignment in wx_alloc_q_vector() used plain stores without
>> release barrier semantics needed for lockless RCU readers.
>>
>> Fix these by:
>> 1. Enclosing queue statistics gathering and wx_update_xoff_rx_lfc() inside
>> an rcu_read_lock() / rcu_read_unlock() section in wx_update_stats().
>> 2. Adding READ_ONCE() and NULL checks when traversing wx->rx_ring[] and
>> wx->tx_ring[] in wx_update_stats() and wx_update_xoff_rx_lfc().
>> 3. Using rcu_assign_pointer() when publishing or clearing ring pointers in
>> wx_alloc_q_vector() and wx_free_q_vector().
>>
>> Fixes: 46b92e10d631 ("net: libwx: support hardware statistics")
>> Signed-off-by: Mengyuan Lou <[email protected]>
>> ---
>> Changelogs:
>> v2:
>> - Moved rcu_read_unlock() after wx_update_xoff_rx_lfc() in wx_update_stats()
>> to ensure flow control processing remains fully protected within the RCU
>> read-side critical section.
>> - Replaced WRITE_ONCE() with rcu_assign_pointer() when assigning and clearing
>> ring pointers in wx_alloc_q_vector() and wx_free_q_vector(), providing
>> proper release memory barrier semantics for lockless RCU readers.
>> - Added __rcu annotations to tx_ring and rx_ring in struct wx (wx_type.h) to
>> align with Linux kernel RCU coding standards and fix Sparse warnings.
>> v1: https://lore.kernel.org/netdev/[email protected]/
>
> Although this patch does apply to net now (at least in my local testing),
> the CI failed to do so the time it ran.
>
> So I think this needs to be reposted.
Yeah， some conflicts about
net: wangxun: add Tx timeout process
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=22d95e93c05b0e4af35b94cef004254306a63a2b
Has merged into net, so I can repost it.