Re: [PATCH net v2] net: libwx: protect ring accesses with RCU

[Simon Horman <horms@kernel.org>]

On Tue, Aug 18, 2026 at 06:08:41PM +0800, Mengyuan Lou wrote:
> During queue teardown or channel reconfiguration (e.g. via ethtool -L),
> ring pointers in wx->rx_ring[] and wx->tx_ring[] can be cleared to NULL
> and freed asynchronously via kfree_rcu().
> 
> Concurrency between interface reconfiguration and background tasks
> (such as service tasks or dev_get_stats) can result in NULL pointer
> dereferences or Use-After-Free (UAF) issues when accessing per-queue
> structures. Specifically:
> 1. wx_update_stats() accesses per-queue Rx, RSC, and Tx rings without
>    RCU read-side protection, and lacked NULL checks in the RSC
>    accumulation loop.
> 2. wx_update_xoff_rx_lfc() walks wx->tx_ring[] and modifies ring->state
>    without RCU protection or NULL checks, risking a kernel panic when
>    flow control pause frames are received during queue teardown.
> 3. Queue assignment in wx_alloc_q_vector() used plain stores without
>    release barrier semantics needed for lockless RCU readers.
> 
> Fix these by:
> 1. Enclosing queue statistics gathering and wx_update_xoff_rx_lfc() inside
>    an rcu_read_lock() / rcu_read_unlock() section in wx_update_stats().
> 2. Adding READ_ONCE() and NULL checks when traversing wx->rx_ring[] and
>    wx->tx_ring[] in wx_update_stats() and wx_update_xoff_rx_lfc().
> 3. Using rcu_assign_pointer() when publishing or clearing ring pointers in
>    wx_alloc_q_vector() and wx_free_q_vector().
> 
> Fixes: 46b92e10d631 ("net: libwx: support hardware statistics")
> Signed-off-by: Mengyuan Lou <mengyuanlou@net-swift.com>
> ---
> Changelogs:
> v2:
> - Moved rcu_read_unlock() after wx_update_xoff_rx_lfc() in wx_update_stats()
>   to ensure flow control processing remains fully protected within the RCU
>   read-side critical section.
> - Replaced WRITE_ONCE() with rcu_assign_pointer() when assigning and clearing
>   ring pointers in wx_alloc_q_vector() and wx_free_q_vector(), providing
>   proper release memory barrier semantics for lockless RCU readers.
> - Added __rcu annotations to tx_ring and rx_ring in struct wx (wx_type.h) to
>   align with Linux kernel RCU coding standards and fix Sparse warnings.
> v1: https://lore.kernel.org/netdev/20260813095141.88227-1-mengyuanlou@net-swift.com/

Although this patch does apply to net now (at least in my local testing),
the CI failed to do so the time it ran.

So I think this needs to be reposted.