* [PATCH iwl-net v3 1/3] ice: Convert ctrl_pf pointer in struct ice_adapter to RCU
2026-06-01 9:19 [PATCH iwl-net v3 0/3] Rework ctrl_pf pointer usage in struct ice_adapter Sergey Temerkhanov
@ 2026-06-01 9:19 ` Sergey Temerkhanov
2026-07-13 6:38 ` [Intel-wired-lan] " Rinitha, SX
2026-06-01 9:19 ` [PATCH iwl-net v3 2/3] ice: Zero out the PTP control PF pointer at ice_adapter cleanup Sergey Temerkhanov
2026-06-01 9:19 ` [PATCH iwl-net v3 3/3] ice: Cache struct ice_hw pointer for split register reads Sergey Temerkhanov
2 siblings, 1 reply; 7+ messages in thread
From: Sergey Temerkhanov @ 2026-06-01 9:19 UTC (permalink / raw)
To: intel-wired-lan; +Cc: netdev
Use RCU to ensure the consistent state of the control PF global
pointer contained in struct ice_adapter. Enforce RCU usage on
the callers.
Fix a potential invalid pointer return due a TOCTOU issue
Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices")
Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Tested-by: Frederick Lawler <fred@cloudflare.com>
---
drivers/net/ethernet/intel/ice/ice.h | 10 +-
drivers/net/ethernet/intel/ice/ice_adapter.h | 2 +-
drivers/net/ethernet/intel/ice/ice_ptp.c | 99 +++++++++++++-------
drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 9 ++
4 files changed, 84 insertions(+), 36 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index f9a43daf04fe..c4ae5f9e095c 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -40,6 +40,7 @@
#include <linux/cpu_rmap.h>
#include <linux/dim.h>
#include <linux/gnss.h>
+#include <linux/rcupdate.h>
#include <net/pkt_cls.h>
#include <net/pkt_sched.h>
#include <net/tc_act/tc_mirred.h>
@@ -1160,14 +1161,19 @@ static inline bool ice_pf_src_tmr_owned(struct ice_pf *pf)
* ice_get_primary_hw - Get pointer to primary ice_hw structure
* @pf: pointer to PF structure
*
+ * The function must be called from an RCU read-side critical section.
+ * hw is embedded in struct ice_pf, so it is protected by the RCU.
+ *
* Return: A pointer to ice_hw structure with access to timesync
* register space.
*/
static inline struct ice_hw *ice_get_primary_hw(struct ice_pf *pf)
{
- if (!pf->adapter->ctrl_pf)
+ struct ice_pf *ctrl_pf = rcu_dereference(pf->adapter->ctrl_pf);
+
+ if (!ctrl_pf)
return &pf->hw;
else
- return &pf->adapter->ctrl_pf->hw;
+ return &ctrl_pf->hw;
}
#endif /* _ICE_H_ */
diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.h b/drivers/net/ethernet/intel/ice/ice_adapter.h
index e95266c7f20b..349d49d57f11 100644
--- a/drivers/net/ethernet/intel/ice/ice_adapter.h
+++ b/drivers/net/ethernet/intel/ice/ice_adapter.h
@@ -42,7 +42,7 @@ struct ice_adapter {
/* For access to GLCOMM_QTX_CNTX_CTL register */
spinlock_t txq_ctx_lock;
- struct ice_pf *ctrl_pf;
+ struct ice_pf __rcu *ctrl_pf;
struct ice_port_list ports;
u64 index;
};
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 07e621813ff5..348fc73607b5 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (C) 2021, Intel Corporation. */
+#include <linux/rcupdate.h>
#include "ice.h"
#include "ice_lib.h"
#include "ice_trace.h"
@@ -54,11 +55,35 @@ static const struct ice_ptp_pin_desc ice_pin_desc_dpll[] = {
{ SDP3, { 3, -1 }, { 0, 0 }},
};
+/**
+ * ice_get_ctrl_pf - Get the control PF for a given PF
+ * @pf: The PF pointer to look up at
+ *
+ * The control PF is the PF which owns the PTP clock for the adapter.
+ * Only the control PF is allowed to perform certain operations on the
+ * PTP clock such as adjusting the time or configuring the pins.
+ *
+ * This function must be called from an RCU read-side critical section.
+ *
+ * Return: Pointer to the control PF, or NULL if not found
+ */
static struct ice_pf *ice_get_ctrl_pf(struct ice_pf *pf)
{
- return !pf->adapter ? NULL : pf->adapter->ctrl_pf;
+ return !pf->adapter ? NULL : rcu_dereference(pf->adapter->ctrl_pf);
}
+/**
+ * ice_get_ctrl_ptp - Get the PTP structure for the control PF
+ * @pf: The PF pointer to look up at
+ *
+ * The control PF is the PF which owns the PTP clock for the adapter.
+ * Only the control PF is allowed to perform certain operations on the
+ * PTP clock such as adjusting the time or configuring the pins.
+ *
+ * This function must be called from an RCU read-side critical section.
+ *
+ * Return: Pointer to the PTP structure of the control PF, or NULL if not found
+ */
static struct ice_ptp *ice_get_ctrl_ptp(struct ice_pf *pf)
{
struct ice_pf *ctrl_pf = ice_get_ctrl_pf(pf);
@@ -207,39 +232,42 @@ u64 ice_ptp_read_src_clk_reg(struct ice_pf *pf,
u32 hi, lo, lo2;
u8 tmr_idx;
- if (!ice_is_primary(hw))
- hw = ice_get_primary_hw(pf);
-
- tmr_idx = ice_get_ptp_src_clock_index(hw);
- guard(spinlock)(&pf->adapter->ptp_gltsyn_time_lock);
- /* Read the system timestamp pre PHC read */
- ptp_read_system_prets(sts);
-
- if (hw->mac_type == ICE_MAC_E830) {
- u64 clk_time = rd64(hw, E830_GLTSYN_TIME_L(tmr_idx));
+ scoped_guard(rcu) {
+ if (!ice_is_primary(hw))
+ hw = ice_get_primary_hw(pf);
- /* Read the system timestamp post PHC read */
- ptp_read_system_postts(sts);
-
- return clk_time;
- }
+ tmr_idx = ice_get_ptp_src_clock_index(hw);
+ guard(spinlock)(&pf->adapter->ptp_gltsyn_time_lock);
+ /* Read the system timestamp pre PHC read */
+ ptp_read_system_prets(sts);
- lo = rd32(hw, GLTSYN_TIME_L(tmr_idx));
+ if (hw->mac_type == ICE_MAC_E830) {
+ u64 clk_time = rd64(hw, E830_GLTSYN_TIME_L(tmr_idx));
- /* Read the system timestamp post PHC read */
- ptp_read_system_postts(sts);
+ /* Read the system timestamp post PHC read */
+ ptp_read_system_postts(sts);
- hi = rd32(hw, GLTSYN_TIME_H(tmr_idx));
- lo2 = rd32(hw, GLTSYN_TIME_L(tmr_idx));
+ return clk_time;
+ }
- if (lo2 < lo) {
- /* if TIME_L rolled over read TIME_L again and update
- * system timestamps
- */
- ptp_read_system_prets(sts);
lo = rd32(hw, GLTSYN_TIME_L(tmr_idx));
+
+ /* Read the system timestamp post PHC read */
ptp_read_system_postts(sts);
+
hi = rd32(hw, GLTSYN_TIME_H(tmr_idx));
+ lo2 = rd32(hw, GLTSYN_TIME_L(tmr_idx));
+
+ if (lo2 < lo) {
+ /* if TIME_L rolled over read TIME_L again and update
+ * system timestamps
+ */
+ ptp_read_system_prets(sts);
+ lo = rd32(hw, GLTSYN_TIME_L(tmr_idx));
+ ptp_read_system_postts(sts);
+ hi = rd32(hw, GLTSYN_TIME_H(tmr_idx));
+ }
+
}
return ((u64)hi << 32) | lo;
@@ -3076,18 +3104,19 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)
static void ice_ptp_setup_adapter(struct ice_pf *pf)
{
- pf->adapter->ctrl_pf = pf;
+ rcu_assign_pointer(pf->adapter->ctrl_pf, pf);
}
static int ice_ptp_setup_pf(struct ice_pf *pf)
{
- struct ice_ptp *ctrl_ptp = ice_get_ctrl_ptp(pf);
struct ice_ptp *ptp = &pf->ptp;
- if (!ctrl_ptp) {
- dev_info(ice_pf_to_dev(pf),
- "PTP unavailable: no controlling PF\n");
- return -EOPNOTSUPP;
+ scoped_guard(rcu) {
+ if (!ice_get_ctrl_ptp(pf)) {
+ dev_info(ice_pf_to_dev(pf),
+ "PTP unavailable: no controlling PF\n");
+ return -EOPNOTSUPP;
+ }
}
if (pf->hw.mac_type == ICE_MAC_UNKNOWN)
@@ -3123,11 +3152,15 @@ static void ice_ptp_cleanup_pf(struct ice_pf *pf)
*/
int ice_ptp_clock_index(struct ice_pf *pf)
{
- struct ice_ptp *ctrl_ptp = ice_get_ctrl_ptp(pf);
+ struct ice_ptp *ctrl_ptp;
struct ptp_clock *clock;
+ guard(rcu)();
+
+ ctrl_ptp = ice_get_ctrl_ptp(pf);
if (!ctrl_ptp)
return -1;
+
clock = ctrl_ptp->clock;
return clock ? ptp_clock_index(clock) : -1;
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
index 40181431f4ca..9ea72d5f59cc 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (C) 2021, Intel Corporation. */
+#include <linux/cleanup.h>
#include <linux/delay.h>
#include <linux/iopoll.h>
#include "ice_common.h"
@@ -351,6 +352,8 @@ void ice_ptp_src_cmd(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd)
struct ice_pf *pf = container_of(hw, struct ice_pf, hw);
u32 cmd_val = ice_ptp_tmr_cmd_to_src_reg(hw, cmd);
+ guard(rcu)();
+
if (!ice_is_primary(hw))
hw = ice_get_primary_hw(pf);
@@ -383,6 +386,8 @@ static void ice_ptp_exec_tmr_cmd(struct ice_hw *hw)
dev_warn(ice_hw_to_dev(hw), "Failed to flush SBQ: %d\n", err);
}
+ guard(rcu)();
+
if (!ice_is_primary(hw))
hw = ice_get_primary_hw(pf);
@@ -1952,6 +1957,8 @@ static int ice_read_phy_and_phc_time_eth56g(struct ice_hw *hw, u8 port,
zo = rd32(hw, GLTSYN_SHTIME_0(tmr_idx));
lo = rd32(hw, GLTSYN_SHTIME_L(tmr_idx));
} else {
+ guard(rcu)();
+
zo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_0(tmr_idx));
lo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_L(tmr_idx));
}
@@ -2121,6 +2128,8 @@ int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port)
lo = rd32(hw, GLTSYN_INCVAL_L(tmr_idx));
hi = rd32(hw, GLTSYN_INCVAL_H(tmr_idx));
} else {
+ guard(rcu)();
+
lo = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_L(tmr_idx));
hi = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_H(tmr_idx));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH iwl-net v3 2/3] ice: Zero out the PTP control PF pointer at ice_adapter cleanup
2026-06-01 9:19 [PATCH iwl-net v3 0/3] Rework ctrl_pf pointer usage in struct ice_adapter Sergey Temerkhanov
2026-06-01 9:19 ` [PATCH iwl-net v3 1/3] ice: Convert ctrl_pf pointer in struct ice_adapter to RCU Sergey Temerkhanov
@ 2026-06-01 9:19 ` Sergey Temerkhanov
2026-07-13 6:38 ` [Intel-wired-lan] " Rinitha, SX
2026-06-01 9:19 ` [PATCH iwl-net v3 3/3] ice: Cache struct ice_hw pointer for split register reads Sergey Temerkhanov
2 siblings, 1 reply; 7+ messages in thread
From: Sergey Temerkhanov @ 2026-06-01 9:19 UTC (permalink / raw)
To: intel-wired-lan; +Cc: netdev
Zero out the ctrl_pf pointer in ice_adapter when the control PF is removed.
This prevents potential dangling pointer dereference when accessing
PTP-related structures from other PFs of the same adapter.
Fixes: e800654e85b5b ("ice: Use ice_adapter for PTP shared data instead of auxdev")
Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reported-by: Frederick Lawler <fred@cloudflare.com>
Closes: https://lkml.indiana.edu/2507.3/01388.html
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Tested-by: Frederick Lawler <fred@cloudflare.com>
---
drivers/net/ethernet/intel/ice/ice_ptp.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 348fc73607b5..5f14f58f4343 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -3107,6 +3107,18 @@ static void ice_ptp_setup_adapter(struct ice_pf *pf)
rcu_assign_pointer(pf->adapter->ctrl_pf, pf);
}
+static void ice_ptp_cleanup_adapter(struct ice_pf *pf)
+{
+ /* Zero out adapter->ctrl_pf pointer when the ctrl_pf itself
+ * is being removed to prevent any secondary PFs from accessing
+ * it after it is deleted.
+ */
+ if (cmpxchg(&pf->adapter->ctrl_pf,
+ (struct ice_pf __rcu *)pf, NULL) ==
+ (struct ice_pf __rcu *)pf)
+ synchronize_rcu();
+}
+
static int ice_ptp_setup_pf(struct ice_pf *pf)
{
struct ice_ptp *ptp = &pf->ptp;
@@ -3386,6 +3398,8 @@ void ice_ptp_init(struct ice_pf *pf)
err_clean_pf:
mutex_destroy(&ptp->port.ps_lock);
ice_ptp_cleanup_pf(pf);
+
+ ice_ptp_cleanup_adapter(pf);
err_exit:
/* If we registered a PTP clock, release it */
if (pf->ptp.clock) {
@@ -3414,6 +3428,7 @@ void ice_ptp_release(struct ice_pf *pf)
if (pf->ptp.state != ICE_PTP_READY) {
mutex_destroy(&pf->ptp.port.ps_lock);
ice_ptp_cleanup_pf(pf);
+ ice_ptp_cleanup_adapter(pf);
if (pf->ptp.clock) {
ptp_clock_unregister(pf->ptp.clock);
pf->ptp.clock = NULL;
@@ -3428,6 +3443,8 @@ void ice_ptp_release(struct ice_pf *pf)
ice_ptp_cleanup_pf(pf);
+ ice_ptp_cleanup_adapter(pf);
+
ice_ptp_release_tx_tracker(pf, &pf->ptp.port.tx);
ice_ptp_disable_all_extts(pf);
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH iwl-net v3 3/3] ice: Cache struct ice_hw pointer for split register reads
2026-06-01 9:19 [PATCH iwl-net v3 0/3] Rework ctrl_pf pointer usage in struct ice_adapter Sergey Temerkhanov
2026-06-01 9:19 ` [PATCH iwl-net v3 1/3] ice: Convert ctrl_pf pointer in struct ice_adapter to RCU Sergey Temerkhanov
2026-06-01 9:19 ` [PATCH iwl-net v3 2/3] ice: Zero out the PTP control PF pointer at ice_adapter cleanup Sergey Temerkhanov
@ 2026-06-01 9:19 ` Sergey Temerkhanov
2026-07-13 6:38 ` [Intel-wired-lan] " Rinitha, SX
2 siblings, 1 reply; 7+ messages in thread
From: Sergey Temerkhanov @ 2026-06-01 9:19 UTC (permalink / raw)
To: intel-wired-lan; +Cc: netdev
Cache the primary ice_hw pointer to ensure consistency between
calls (both parts of a value will be read from the same NAC).
ice_get_primary_hw() will never return NULL, but during the
ctrl_pf cleanup there may be a case when one call will return
the pointer to the ctrl_pf->hw and the subsequent one - to the
pf->hw which generally are not the same.
Struct ice_hw is embedded in the struct ice_pf so it is protected
by the same critical section - no additional synchronization is
needed.
Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices")
Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Tested-by: Frederick Lawler <fred@cloudflare.com>
---
drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
index 9ea72d5f59cc..a2b7f709f3c0 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -4,6 +4,7 @@
#include <linux/cleanup.h>
#include <linux/delay.h>
#include <linux/iopoll.h>
+#include "ice.h"
#include "ice_common.h"
#include "ice_ptp_hw.h"
#include "ice_ptp_consts.h"
@@ -1957,10 +1958,14 @@ static int ice_read_phy_and_phc_time_eth56g(struct ice_hw *hw, u8 port,
zo = rd32(hw, GLTSYN_SHTIME_0(tmr_idx));
lo = rd32(hw, GLTSYN_SHTIME_L(tmr_idx));
} else {
+ struct ice_hw *pri_hw;
+
guard(rcu)();
- zo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_0(tmr_idx));
- lo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_L(tmr_idx));
+ pri_hw = ice_get_primary_hw(pf);
+
+ zo = rd32(pri_hw, GLTSYN_SHTIME_0(tmr_idx));
+ lo = rd32(pri_hw, GLTSYN_SHTIME_L(tmr_idx));
}
*phc_time = (u64)lo << 32 | zo;
@@ -2128,10 +2133,14 @@ int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port)
lo = rd32(hw, GLTSYN_INCVAL_L(tmr_idx));
hi = rd32(hw, GLTSYN_INCVAL_H(tmr_idx));
} else {
+ struct ice_hw *pri_hw;
+
guard(rcu)();
- lo = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_L(tmr_idx));
- hi = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_H(tmr_idx));
+ pri_hw = ice_get_primary_hw(pf);
+
+ lo = rd32(pri_hw, GLTSYN_INCVAL_L(tmr_idx));
+ hi = rd32(pri_hw, GLTSYN_INCVAL_H(tmr_idx));
}
incval = (u64)hi << 32 | lo;
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread