Re: [PATCH net-next v2 11/15] gve: split up notify block allocation and setup paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The management interrupt can trigger a Use-After-Free by queueing work on a destroyed workqueue during device removal.
--

commit 3245301c6f7eba646dce95ef2e71441d61e4f037
Author: Joshua Washington <joshwash@google.com>

gve: split up notify block allocation and setup paths

Before this patch, notify block allocation and setup occurred in the same
method. This all occurred before gve_adminq_configure_device_resources,
which populates the irq_db_indicies array, a DMA region with BAR offsets
for MSI-X vectors. The coming mailbox mode will require notify blocks to be
set up only after receiving the IRQ doorbell offsets. This ordering also
works for admin queue mode, so it is updated to match.

> diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
> index 0e88a04348490..2f92dc8176305 100644
> --- a/drivers/net/ethernet/google/gve/gve_main.c
> +++ b/drivers/net/ethernet/google/gve/gve_main.c
[ ... ]
> @@ -743,6 +752,7 @@ static void gve_teardown_control_plane_resources(struct gve_priv *priv)
>  
>  static void gve_teardown_device(struct gve_priv *priv)
>  {
> +	gve_teardown_notify_blocks(priv);

[Severity: High]
In gve_remove(), the patch series reordered the teardown sequence to call
destroy_workqueue() before gve_teardown_device():

drivers/net/ethernet/google/gve/gve_main.c:gve_remove() {
	...
	unregister_netdev(netdev);
	destroy_workqueue(priv->gve_wq);
	gve_teardown_device(priv);
	...
}

Because gve_teardown_device() (via gve_teardown_notify_blocks()) is what
calls free_irq() to release the management interrupt, the interrupt remains
active while and after the workqueue is destroyed.

If a management interrupt fires during this window, gve_mgmnt_intr() will
execute:

drivers/net/ethernet/google/gve/gve_main.c:gve_mgmnt_intr() {
	...
	queue_work(priv->gve_wq, &priv->service_task);
	return IRQ_HANDLED;
}

Can this sequence trigger a use-after-free by enqueuing work on the destroyed
workqueue?

>  	gve_teardown_control_plane_resources(priv);
>  	gve_adminq_free(priv);
>  	/*

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602235900.3050782-1-hramamurthy@google.com?part=11