From: Carlo Szelinsky <github@szelinsky.de>
To: Simon Horman <horms@kernel.org>
Cc: Oleksij Rempel <o.rempel@pengutronix.de>,
Kory Maincent <kory.maincent@bootlin.com>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Carlo Szelinsky <github@szelinsky.de>
Subject: Re: [PATCH net 1/2] net: pse-pd: disable IRQ before freeing PI data in unregister
Date: Mon, 15 Jun 2026 19:59:49 +0200 [thread overview]
Message-ID: <20260615175949.827693-1-github@szelinsky.de> (raw)
In-Reply-To: <20260601162506.GY2256768@horms.kernel.org>
Hi Simon,
Thanks, this all makes sense.
> > Did I miss a path where the worker reaches pcdev->pi?
>
> I am concerned that this can occur if pse_send_ntf_worker()
> calls pse_control_put(). In which case __pse_control_release()
> may run, which accesses psec->pcdev->pi[psec->id].admin_state_enabled.
You're right, I was wrong. The worker does reach pcdev->pi through
pse_control_put() -> __pse_control_release(). For v2 I'll move
cancel_work_sync(&pcdev->ntf_work) before pse_release_pis() and fix
the patch 1 commit message, which wrongly claims the worker never
touches pcdev->pi.
> I wonder if you may have missed the AI-generated review of it that I
> forwarded.
I did, thanks for the hint. I went over it again more carefully
now. :-) Both [High] points seem to be valid, I'll reply to them inline
on the 2/2 review thread so the discussion stays where it was raised.
> For these last three pre-existing items I think it's best to handle
> them separately.
Agreed, I'll send those on their own later.
Thanks,
Carlo
next prev parent reply other threads:[~2026-06-15 18:07 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-24 22:33 [PATCH net 0/2] net: pse-pd: fix use-after-free of PI array on controller teardown Carlo Szelinsky
2026-05-24 22:33 ` [PATCH net 1/2] net: pse-pd: disable IRQ before freeing PI data in unregister Carlo Szelinsky
2026-05-27 12:55 ` Simon Horman
2026-05-30 10:50 ` Carlo Szelinsky
2026-06-01 16:25 ` Simon Horman
2026-06-15 17:59 ` Carlo Szelinsky [this message]
2026-05-24 22:33 ` [PATCH net 2/2] net: pse-pd: guard against freed PI data on regulator disable Carlo Szelinsky
2026-05-27 12:24 ` Simon Horman
2026-06-15 18:00 ` Carlo Szelinsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260615175949.827693-1-github@szelinsky.de \
--to=github@szelinsky.de \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kory.maincent@bootlin.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.