Re: [PATCH net v3] net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue

[Kevin Hao <haokexin@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1471 bytes --]

On Tue, Jan 27, 2026 at 07:08:36PM -0800, Jakub Kicinski wrote:
> On Tue, 27 Jan 2026 16:02:07 +0800 Kevin Hao wrote:
> > To resolve this issue, we opt to execute the actual processing within
> > a work queue, following the approach used by the icssg-prueth driver.
> 
> Code looks good now, but why are you creating a workqueue for this one
> work? Can't you use the system wq and just cancel it sync where you had
> the wq destroy?

This implementation was adapted from the icssg-prueth driver. After reviewing
the git history, I found no explicit rationale for using a dedicated workqueue.
In my opinion, if we were to use the system wq and rely on cancel_work_sync()
before unregister_netdev(), a race condition could arise between these two calls.
Specifically, cpsw_ndo_set_rx_mode_work() might be scheduled during this interval
and run after the net device is unregistered, leading to a use-after-free bug.

While reviewing the code, I noticed that in the current implementation, we may
need to move the destroy_workqueue() call after unregister_netdev(). Otherwise,
there is a risk of encountering a use-after-free bug related to the dedicated workqueue.

> 
> BTW you're fixing drivers/net/ethernet/ti/cpsw_new.c I think
> drivers/net/ethernet/ti/cpsw.c has an identical bug, no?

Yes, as noted in the patch comment area, I plan to address the same issue in
drivers/net/ethernet/ti/cpsw.c once this patch is approved.

Thanks,
Kevin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]