On Sat, Apr 18, 2026 at 09:01:15AM +0000, Kohei Enju wrote:
> ice_xdp_setup_prog() unconditionally hot-swaps xdp_prog when
> ICE_VSI_REBUILD_PENDING is set. In the attach path, this can publish a
> new rx_ring->xdp_prog before rx_ring->xdp_ring becomes valid while the
> rebuild is pending. As a result, ice_clean_rx_irq() may dereference
> rx_ring->xdp_ring too early.
>
> With high-volume RX packets, running these commands in parallel
> triggered a KASAN splat [1].
> # ethtool --reset $DEV irq dma filter offload
> # ip link set dev $DEV xdp {obj $OBJ sec xdp,off}
>
> Fix this by rejecting XDP attach while rebuild is pending.
> Keep XDP detach allowed in this window. Detach clears rx_ring->xdp_prog,
> so the RX path will not attempt to access rx_ring->xdp_ring.
>
> [1]
> BUG: KASAN: slab-use-after-free in ice_napi_poll+0x3921/0x41a0
> Read of size 2 at addr ffff88812475b880 by task ksoftirqd/1/23
> [...]
> Call Trace:
> <TASK>
> ice_napi_poll+0x3921/0x41a0
> __napi_poll+0x98/0x520
> net_rx_action+0x8f2/0xfa0
> handle_softirqs+0x1cb/0x7f0
> [...]
> </TASK>
>
> Allocated by task 7246:
> ice_prepare_xdp_rings+0x3de/0x12d0
> ice_xdp+0x61c/0xef0
> dev_xdp_install+0x3c4/0x840
> dev_xdp_attach+0x50a/0x10a0
> dev_change_xdp_fd+0x175/0x210
> [...]
>
> Freed by task 7251:
> __rcu_free_sheaf_prepare+0x5f/0x230
> rcu_free_sheaf+0x1a/0xf0
> rcu_core+0x567/0x1d80
> handle_softirqs+0x1cb/0x7f0
>
> Fixes: 2504b8405768 ("ice: protect XDP configuration with a mutex")
> Signed-off-by: Kohei Enju <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Sashiko has provided some feedback on this patch.
However, I believe the issues it raises are not introduced
by this patch and should not block progress of it.
I'd like to ask if you could take a look over that feedback
and see if any follow-up is appropriate.
Thanks!
