Re: [RFC PATCH net-next 3/7] arm64: dts: airoha: add EN7581 SOE node

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Dereferencing `x->xso.dev` without a NULL check in `xfrm_output` can lead to a kernel panic.
--

commit c38a10fca161e28cf54507d8d670ee75e47687df
Author: Jihong Min <hurryman2212@gmail.com>

xfrm: allow packet offload drivers to own transmit

This commit adds an optional xdo_dev_packet_xmit() callback for packet
offload drivers. It allows devices to perform driver-specific transmit
preparation instead of continuing through the regular XFRM output path.
Drivers implementing this callback will consume the skb and return the
final transmit status.

> diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
> index cc35c2fcbbe09..9f11559b02210 100644
> --- a/net/xfrm/xfrm_output.c
> +++ b/net/xfrm/xfrm_output.c
> @@ -770,6 +770,17 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
>  	}
>  
>  	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
> +#ifdef CONFIG_XFRM_OFFLOAD
> +		const struct xfrmdev_ops *ops;
> +#endif
> +
> +#ifdef CONFIG_XFRM_OFFLOAD
> +		ops = x->xso.dev->xfrmdev_ops;

[Severity: High]
Is it possible for x->xso.dev to be NULL here?

During device unregistration, xfrm_dev_state_free() clears xso->dev to NULL
(via WRITE_ONCE) before updating xso->type to XFRM_DEV_OFFLOAD_UNSPECIFIED.
Because xfrm_output() processes packets concurrently without locking, could
a data race occur where the transmit path observes xso.type as
XFRM_DEV_OFFLOAD_PACKET but then reads xso.dev as NULL?

If this happens, wouldn't evaluating ops = x->xso.dev->xfrmdev_ops cause a
NULL pointer dereference regression?

The adjacent xfrm_dev_offload_ok() function seems to anticipate this
concurrent modification by explicitly checking for a NULL dev. Should a
similar NULL check be added here?

> +		/* Callback validates, consumes skb and returns final TX status. */
> +		if (ops && ops->xdo_dev_packet_xmit)
> +			return ops->xdo_dev_packet_xmit(skb, x);
> +#endif
> +
>  		if (!xfrm_dev_offload_ok(skb, x)) {
>  			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
>  			kfree_skb(skb);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260614040032.1567994-1-hurryman2212@gmail.com?part=3