> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of > Maciej Fijalkowski > Sent: Wednesday, July 1, 2026 5:45 AM > To: [email protected] > Cc: [email protected]; Karlsson, Magnus <[email protected]>; > [email protected]; [email protected]; [email protected]; Kitszel, Przemyslaw > <[email protected]>; Keller, Jacob E > <[email protected]>; > Fijalkowski, Maciej <[email protected]>; Sashiko AI Review > <[email protected]> > Subject: [Intel-wired-lan] [PATCH v5 net 3/7] i40e: make ring pointers > unreachable before freeing via rcu > > Sashiko reports: > *** > > err_config: > > + i40e_vsi_free_q_vectors(vsi); > > +err_qvec: > > i40e_vsi_clear_rings(vsi); > This is a pre-existing issue, but can the sequence in i40e_vsi_clear_rings() > lead to an RCU ordering violation? > In i40e_vsi_clear_rings(), the rings are freed before the array pointers are > nullified: > kfree_rcu(vsi->tx_rings[i], rcu); > WRITE_ONCE(vsi->tx_rings[i], NULL); > Under RCU rules, a pointer must be made unreachable to new readers before it > is handed off to kfree_rcu(). Could a new RCU reader (like > i40e_get_netdev_stats_struct_tx()) fetch the pointer after kfree_rcu() is > invoked, and access freed memory if the grace period expires while the > reader is still active? > *** > > Save the Tx ring pointer before clearing the published ring array slots > and pass the saved pointer to kfree_rcu(). This preserves the intended > RCU ordering, where new readers can no longer discover the ring through > vsi->tx_rings/rx_rings/xdp_rings before the object is queued for > deferred freeing, while avoiding a NULL kfree_rcu() argument after the > slot has already been cleared. Since the Tx pointer is the base of the > per-queue-pair allocation block, re-reading vsi->tx_rings[i] after > WRITE_ONCE(..., NULL) would otherwise turn the free into a no-op and > leak the whole ring block. > > Fixes: 9f65e15b4f98 ("i40e: Move rings from pointer to array to array of > pointers") > Reported-by: Sashiko AI Review <[email protected]> > Signed-off-by: Maciej Fijalkowski <[email protected]> > --- > drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-)
Tested-by: Sunitha Mekala <[email protected]> (A Contingent worker at Intel)
