> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of > [email protected] > Sent: Tuesday, August 4, 2026 11:51 PM > To: [email protected]; [email protected] > Cc: [email protected]; Nguyen, Anthony L > <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; [email protected]; [email protected]; > [email protected]; [email protected]; [email protected]; > [email protected]; Kwapulinski, Piotr <[email protected]>; > Kubalewski, Arkadiusz <[email protected]>; Loktionov, Aleksandr > <[email protected]>; [email protected]; Xuanqiang Luo > <[email protected]> > Subject: [Intel-wired-lan] [PATCH iwl-net v2 1/5] i40e: serialize Tx > timestamp skb ownership > > From: Xuanqiang Luo <[email protected]> > > The Tx timestamp interrupt, watchdog, transmit error path, and PTP stop path > can all release ptp_tx_skb. The existing in-progress bit serializes slot > reservation, but does not protect the skb pointer. One path can therefore > free the skb while another is still using it, causing a use-after-free or > double free. > > Add ptp_tx_lock to protect the timestamp slot. With all accesses serialized, > use a non-NULL ptp_tx_skb as the single indication that the slot is occupied > and remove the redundant in-progress bit. Publish and claim the skb under the > lock, then complete or free it after unlocking. > > Make the transmit error path claim the slot only when it still points to the > skb whose transmission failed. This prevents delayed error cleanup from > releasing a newer timestamp request after another path recycled the slot. > > Fixes: 0bc0706b46cd ("i40e: check for Tx timestamp timeouts during watchdog") > Signed-off-by: Xuanqiang Luo <[email protected]> > --- > drivers/net/ethernet/intel/i40e/i40e.h | 3 +- > drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + > drivers/net/ethernet/intel/i40e/i40e_ptp.c | 55 ++++++++++++++------- > drivers/net/ethernet/intel/i40e/i40e_txrx.c | 38 ++++++++++---- > 4 files changed, 67 insertions(+), 30 deletions(-)
Tested-by: Alexander Nowlin <[email protected]>
