linux-kernel - Re: [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260105174044.3da6585d@kernel.org>
Date: Mon, 5 Jan 2026 17:40:44 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Fan Gong <gongfan1@...wei.com>
Cc: Zhu Yikai <zhuyikai1@...artners.com>, <netdev@...r.kernel.org>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Paolo
 Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, Andrew Lunn
 <andrew+netdev@...n.ch>, Markus Elfring <Markus.Elfring@....de>, Pavan
 Chebbi <pavan.chebbi@...adcom.com>, ALOK TIWARI <alok.a.tiwari@...cle.com>,
 <linux-kernel@...r.kernel.org>, <linux-doc@...r.kernel.org>, luosifu
 <luosifu@...wei.com>, Xin Guo <guoxin09@...wei.com>, Shen Chenyang
 <shenchenyang1@...ilicon.com>, Zhou Shuai <zhoushuai28@...wei.com>, Wu Like
 <wulike1@...wei.com>, Shi Jing <shijing34@...wei.com>, Luo Yang
 <luoyang82@...artners.com>
Subject: Re: [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing
 with DIM

AI code review points out:

> @@ -150,6 +236,9 @@ int hinic3_qps_irq_init(struct net_device *netdev)
>  			goto err_release_irqs;
>  		}
>
> +		INIT_WORK(&irq_cfg->rxq->dim.work, hinic3_rx_dim_work);
> +		irq_cfg->rxq->dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_CQE;
> +
>  		hinic3_set_msix_auto_mask_state(nic_dev->hwdev,
>  						irq_cfg->msix_entry_idx,
>  						HINIC3_SET_MSIX_AUTO_MASK);
> @@ -164,6 +253,9 @@ int hinic3_qps_irq_init(struct net_device *netdev)
>  		q_id--;
>  		irq_cfg = &nic_dev->q_params.irq_cfg[q_id];
>  		qp_del_napi(irq_cfg);
> +
> +		disable_work_sync(&irq_cfg->rxq->dim.work);
> +
>  		hinic3_set_msix_state(nic_dev->hwdev, irq_cfg->msix_entry_idx,
>  				      HINIC3_MSIX_DISABLE);

The error path in hinic3_qps_irq_init() calls disable_work_sync() to cancel
the DIM work before cleanup. However, hinic3_qps_irq_uninit() does not have
a corresponding cancel_work_sync() or disable_work_sync() call.

The DIM work is scheduled via net_dim()->schedule_work() from hinic3_poll().
If the interface is closed while DIM work is pending or running,
hinic3_rx_dim_work() could access rxq->netdev and rxq->q_id after the
queues have been torn down in hinic3_close_channel()->hinic3_qps_irq_uninit().

Should hinic3_qps_irq_uninit() call cancel_work_sync() for the DIM work
to prevent a potential use-after-free?