RE: [PATCH net-next v6 4/5] net: wangxun: implement soft quiesce for PCIe error recovery

["Jiawen Wu" <jiawenwu@trustnetic.com>]

On Fri, Jun 12, 2026 11:49 PM, Simon Horman wrote:
> On Wed, Jun 10, 2026 at 02:09:16PM +0800, Jiawen Wu wrote:
> > Function wx_soft_quiesce() provide a lightweight shutdown path during
> > PCIe error recovery. It avoids MMIO-dependent operations in PCIe error
> > status.
> >
> > Waiting for the service task to complete may unnecessarily delay PCIe
> > error recovery, especially if the work item is already blocked by the
> > hardware failure that triggered AER. So the service task is not
> > explicitly cancelled in quiesce path. As a measure to block the service
> > task, the checking of WX_STATE_DOWN and WX_STATE_RESETTING is added at
> > the entry of every work item.
> >
> > Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
> > Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> 
> ...
> 
> > diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> > index 44f3e6505246..dcc8b3ae1445 100644
> > --- a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> > +++ b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> > @@ -842,6 +842,27 @@ void wx_ptp_stop(struct wx *wx)
> >  }
> >  EXPORT_SYMBOL(wx_ptp_stop);
> >
> > +void wx_ptp_quiesce(struct wx *wx)
> > +{
> > +	if (!test_and_clear_bit(WX_STATE_PTP_RUNNING, wx->state))
> > +		return;
> > +
> > +	clear_bit(WX_FLAG_PTP_PPS_ENABLED, wx->flags);
> > +
> > +	if (wx->ptp_tx_skb) {
> > +		dev_kfree_skb_any(wx->ptp_tx_skb);
> > +		wx->ptp_tx_skb = NULL;
> > +	}
> 
> AI-generated review of this patch on sashiko.dev flags a potential UAF here:
> 
> 	"Could freeing wx->ptp_tx_skb here cause a use-after-free or
> 	double-free?
> 
> 	"Because ptp_clock_unregister() is called after this block, the PTP
> 	 kworker might still be running.
> 
> 	"If wx_ptp_tx_hwtstamp() reads wx->ptp_tx_skb just before this
> 	 free, it will pass the freed skb to skb_tstamp_tx() and call
> 	 dev_kfree_skb_any() on it again.
> 
> I'd appreciate it if you could look into that.

I will move ptp_clock_unregister() to be executed before we free wx->ptp_tx_skb.

> 
> I believe that the other issues raised in that AI-generated review have
> already been discussed in the context of earlier versions of this
> patch-set.
> 
> > +	clear_bit_unlock(WX_STATE_PTP_TX_IN_PROGRESS, wx->state);
> > +
> > +	if (wx->ptp_clock) {
> > +		ptp_clock_unregister(wx->ptp_clock);
> > +		wx->ptp_clock = NULL;
> > +		dev_info(&wx->pdev->dev, "removed PHC on %s\n", wx->netdev->name);
> > +	}
> > +}
> 
> ...
>