From: Simon Horman <horms@kernel.org>
To: David CARLIER <devnexen@gmail.com>
Cc: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com,
intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH net v2] idpf: handle NULL adev in idpf_idc_vdev_mtu_event
Date: Wed, 20 May 2026 19:26:31 +0100 [thread overview]
Message-ID: <20260520182631.GD988238@horms.kernel.org> (raw)
In-Reply-To: <CA+XhMqxFmJm_fQ9aqRmwbG10+Bs8RgJ5kAff9-qtcrvgmfFMug@mail.gmail.com>
On Tue, May 19, 2026 at 09:19:23PM +0100, David CARLIER wrote:
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
>
> Thanks for relaying this, Simon.
>
> The scenario this patch fixes is sequential, not concurrent:
> idpf_idc_vport_dev_ctrl(adapter, false) has already returned and
> vdev_info->adev is NULL by the time ndo_change_mtu reaches
> idpf_idc_vdev_mtu_event(). The original code dereferenced
> vdev_info->adev in device_lock() before the NULL check and oopses
> deterministically; READ_ONCE() + early-return resolves that.
>
> A truly concurrent idpf_idc_vport_dev_ctrl(_, false) racing an
> in-flight MTU event is a separate, pre-existing window: the original
> code took no reference between reading vdev_info->adev and
> dereferencing it either, so this patch neither introduces nor widens
> it. I haven't constructed a concrete interleaving against auxiliary-bus
> teardown and have no report of it triggering.
>
> Happy to post a follow-up bracketing the handler with
> get_device()/put_device() if you'd prefer, but I'd rather keep this
> one scoped to the Fixes: target.
Hi David,
Thanks for the clarification.
I agree we can treat concurrency as a separate issue.
WARNING: multiple messages have this Message-ID (diff)
From: Simon Horman <horms@kernel.org>
To: David CARLIER <devnexen@gmail.com>
Cc: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com,
intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [Intel-wired-lan] [PATCH net v2] idpf: handle NULL adev in idpf_idc_vdev_mtu_event
Date: Wed, 20 May 2026 19:26:31 +0100 [thread overview]
Message-ID: <20260520182631.GD988238@horms.kernel.org> (raw)
In-Reply-To: <CA+XhMqxFmJm_fQ9aqRmwbG10+Bs8RgJ5kAff9-qtcrvgmfFMug@mail.gmail.com>
On Tue, May 19, 2026 at 09:19:23PM +0100, David CARLIER wrote:
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
>
> Thanks for relaying this, Simon.
>
> The scenario this patch fixes is sequential, not concurrent:
> idpf_idc_vport_dev_ctrl(adapter, false) has already returned and
> vdev_info->adev is NULL by the time ndo_change_mtu reaches
> idpf_idc_vdev_mtu_event(). The original code dereferenced
> vdev_info->adev in device_lock() before the NULL check and oopses
> deterministically; READ_ONCE() + early-return resolves that.
>
> A truly concurrent idpf_idc_vport_dev_ctrl(_, false) racing an
> in-flight MTU event is a separate, pre-existing window: the original
> code took no reference between reading vdev_info->adev and
> dereferencing it either, so this patch neither introduces nor widens
> it. I haven't constructed a concrete interleaving against auxiliary-bus
> teardown and have no report of it triggering.
>
> Happy to post a follow-up bracketing the handler with
> get_device()/put_device() if you'd prefer, but I'd rather keep this
> one scoped to the Fixes: target.
Hi David,
Thanks for the clarification.
I agree we can treat concurrency as a separate issue.
next prev parent reply other threads:[~2026-05-20 18:26 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-14 18:30 [PATCH net v2] idpf: handle NULL adev in idpf_idc_vdev_mtu_event David Carlier
2026-05-14 18:30 ` [Intel-wired-lan] " David Carlier
2026-05-15 11:54 ` Loktionov, Aleksandr
2026-05-15 11:54 ` Loktionov, Aleksandr
2026-05-19 19:57 ` Simon Horman
2026-05-19 19:57 ` [Intel-wired-lan] " Simon Horman
2026-05-19 20:19 ` David CARLIER
2026-05-19 20:19 ` [Intel-wired-lan] " David CARLIER
2026-05-20 18:26 ` Simon Horman [this message]
2026-05-20 18:26 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260520182631.GD988238@horms.kernel.org \
--to=horms@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=anthony.l.nguyen@intel.com \
--cc=davem@davemloft.net \
--cc=devnexen@gmail.com \
--cc=edumazet@google.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=przemyslaw.kitszel@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.