Re: [PATCH net v2] net: libwx: protect ring accesses with RCU

["mengyuanlou@net-swift.com" <mengyuanlou@net-swift.com>]

> 2026年8月21日 02:29，Simon Horman <horms@kernel.org> 写道：
> 
> On Tue, Aug 18, 2026 at 06:08:41PM +0800, Mengyuan Lou wrote:
>> During queue teardown or channel reconfiguration (e.g. via ethtool -L),
>> ring pointers in wx->rx_ring[] and wx->tx_ring[] can be cleared to NULL
>> and freed asynchronously via kfree_rcu().
>> 
>> Concurrency between interface reconfiguration and background tasks
>> (such as service tasks or dev_get_stats) can result in NULL pointer
>> dereferences or Use-After-Free (UAF) issues when accessing per-queue
>> structures. Specifically:
>> 1. wx_update_stats() accesses per-queue Rx, RSC, and Tx rings without
>>   RCU read-side protection, and lacked NULL checks in the RSC
>>   accumulation loop.
>> 2. wx_update_xoff_rx_lfc() walks wx->tx_ring[] and modifies ring->state
>>   without RCU protection or NULL checks, risking a kernel panic when
>>   flow control pause frames are received during queue teardown.
>> 3. Queue assignment in wx_alloc_q_vector() used plain stores without
>>    release barrier semantics needed for lockless RCU readers.
>> 
>> Fix these by:
>> 1. Enclosing queue statistics gathering and wx_update_xoff_rx_lfc() inside
>>   an rcu_read_lock() / rcu_read_unlock() section in wx_update_stats().
>> 2. Adding READ_ONCE() and NULL checks when traversing wx->rx_ring[] and
>>    wx->tx_ring[] in wx_update_stats() and wx_update_xoff_rx_lfc().
>> 3. Using rcu_assign_pointer() when publishing or clearing ring pointers in
>>    wx_alloc_q_vector() and wx_free_q_vector().
>> 
>> Fixes: 46b92e10d631 ("net: libwx: support hardware statistics")
>> Signed-off-by: Mengyuan Lou <mengyuanlou@net-swift.com>
>> ---
>> Changelogs:
>> v2:
>> - Moved rcu_read_unlock() after wx_update_xoff_rx_lfc() in wx_update_stats()
>>   to ensure flow control processing remains fully protected within the RCU
>>   read-side critical section.
>> - Replaced WRITE_ONCE() with rcu_assign_pointer() when assigning and clearing
>>   ring pointers in wx_alloc_q_vector() and wx_free_q_vector(), providing
>>   proper release memory barrier semantics for lockless RCU readers.
>> - Added __rcu annotations to tx_ring and rx_ring in struct wx (wx_type.h) to
>>   align with Linux kernel RCU coding standards and fix Sparse warnings.
>> v1: https://lore.kernel.org/netdev/20260813095141.88227-1-mengyuanlou@net-swift.com/
> 
> Although this patch does apply to net now (at least in my local testing),
> the CI failed to do so the time it ran.
> 
> So I think this needs to be reposted.

Yeah， some conflicts about 
net: wangxun: add Tx timeout process
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=22d95e93c05b0e4af35b94cef004254306a63a2b
Has merged into net, so I can repost it.