During queue teardown or channel reconfiguration (e.g. via ethtool -L), ring pointers in wx->rx_ring[] and wx->tx_ring[] can be cleared to NULL and freed asynchronously via kfree_rcu(). Concurrency between interface reconfiguration and background tasks (such as service tasks or dev_get_stats) can result in NULL pointer dereferences or Use-After-Free (UAF) issues when accessing per-queue structures. Specifically: 1. wx_update_stats() accesses per-queue Rx, RSC, and Tx rings without RCU read-side protection, and lacked NULL checks in the RSC accumulation loop. 2. wx_update_xoff_rx_lfc() walks wx->tx_ring[] and modifies ring->state without RCU protection or NULL checks, risking a kernel panic when flow control pause frames are received during queue teardown. 3. Queue assignment in wx_alloc_q_vector() used plain stores without    release barrier semantics needed for lockless RCU readers. Fix these by: 1. Enclosing queue statistics gathering and wx_update_xoff_rx_lfc() inside an rcu_read_lock() / rcu_read_unlock() section in wx_update_stats(). 2. Adding READ_ONCE() and NULL checks when traversing wx->rx_ring[] and    wx->tx_ring[] in wx_update_stats() and wx_update_xoff_rx_lfc(). 3. Using rcu_assign_pointer() when publishing or clearing ring pointers in    wx_alloc_q_vector() and wx_free_q_vector(). Fixes: 46b92e10d631 ("net: libwx: support hardware statistics") Signed-off-by: Mengyuan Lou --- Changelogs: v2: - Moved rcu_read_unlock() after wx_update_xoff_rx_lfc() in wx_update_stats()   to ensure flow control processing remains fully protected within the RCU   read-side critical section. - Replaced WRITE_ONCE() with rcu_assign_pointer() when assigning and clearing   ring pointers in wx_alloc_q_vector() and wx_free_q_vector(), providing   proper release memory barrier semantics for lockless RCU readers. - Added __rcu annotations to tx_ring and rx_ring in struct wx (wx_type.h) to   align with Linux kernel RCU coding standards and fix Sparse warnings. v1: https://lore.kernel.org/netdev/20260813095141.88227-1-mengyuanlou@net-swift.com/ --- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 29 ++++++++++++++++---- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 8 +++--- drivers/net/ethernet/wangxun/libwx/wx_type.h | 4 +-- 3 files changed, 29 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c index 122c4952d203..19ce458f9cc6 100644 --- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c +++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c @@ -2870,8 +2870,13 @@ static void wx_update_xoff_rx_lfc(struct wx *wx) if (!data) return; - for (i = 0; i < wx->num_tx_queues; i++) - clear_bit(WX_HANG_CHECK_ARMED, wx->tx_ring[i]->state); + for (i = 0; i < wx->num_tx_queues; i++) { + struct wx_ring *tx_ring = READ_ONCE(wx->tx_ring[i]); + + if (!tx_ring) + continue; + clear_bit(WX_HANG_CHECK_ARMED, tx_ring->state); + } } /** @@ -2893,10 +2898,13 @@ void wx_update_stats(struct wx *wx) spin_lock(&wx->hw_stats_lock); + rcu_read_lock(); /* gather some stats to the wx struct that are per queue */ for (i = 0; i < wx->num_rx_queues; i++) { - struct wx_ring *rx_ring = wx->rx_ring[i]; + struct wx_ring *rx_ring = READ_ONCE(wx->rx_ring[i]); + if (!rx_ring) + continue; non_eop_descs += rx_ring->rx_stats.non_eop_descs; alloc_rx_buff_failed += rx_ring->rx_stats.alloc_rx_buff_failed; hw_csum_rx_good += rx_ring->rx_stats.csum_good_cnt; @@ -2912,15 +2920,23 @@ void wx_update_stats(struct wx *wx) u64 rsc_flush = 0; for (i = 0; i < wx->num_rx_queues; i++) { - rsc_count += wx->rx_ring[i]->rx_stats.rsc_count; - rsc_flush += wx->rx_ring[i]->rx_stats.rsc_flush; + struct wx_ring *rx_ring = READ_ONCE(wx->rx_ring[i]); + + if (!rx_ring) + continue; + + rsc_count += rx_ring->rx_stats.rsc_count; + rsc_flush += rx_ring->rx_stats.rsc_flush; } wx->rsc_count = rsc_count; wx->rsc_flush = rsc_flush; } for (i = 0; i < wx->num_tx_queues; i++) { - struct wx_ring *tx_ring = wx->tx_ring[i]; + struct wx_ring *tx_ring = READ_ONCE(wx->tx_ring[i]); + + if (!tx_ring) + continue; restart_queue += tx_ring->tx_stats.restart_queue; tx_busy += tx_ring->tx_stats.tx_busy; @@ -2929,6 +2945,7 @@ void wx_update_stats(struct wx *wx) wx->tx_busy = tx_busy; wx_update_xoff_rx_lfc(wx); + rcu_read_unlock(); hwstats->gprc += rd32(wx, WX_RDM_PKT_CNT); hwstats->gptc += rd32(wx, WX_TDM_PKT_CNT); diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c index ed5aad7857bd..4047e5d2bcff 100644 --- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c +++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c @@ -2191,7 +2191,7 @@ static int wx_alloc_q_vector(struct wx *wx, ring->queue_index = txr_idx; /* assign ring to wx */ - wx->tx_ring[txr_idx] = ring; + rcu_assign_pointer(wx->tx_ring[txr_idx], ring); /* update count and index */ txr_count--; @@ -2217,7 +2217,7 @@ static int wx_alloc_q_vector(struct wx *wx, ring->queue_index = rxr_idx; /* assign ring to wx */ - wx->rx_ring[rxr_idx] = ring; + rcu_assign_pointer(wx->rx_ring[rxr_idx], ring); /* update count and index */ rxr_count--; @@ -2245,10 +2245,10 @@ static void wx_free_q_vector(struct wx *wx, int v_idx) struct wx_ring *ring; wx_for_each_ring(ring, q_vector->tx) - wx->tx_ring[ring->queue_index] = NULL; + rcu_assign_pointer(wx->tx_ring[ring->queue_index], NULL); wx_for_each_ring(ring, q_vector->rx) - wx->rx_ring[ring->queue_index] = NULL; + rcu_assign_pointer(wx->rx_ring[ring->queue_index], NULL); wx->q_vector[v_idx] = NULL; netif_napi_del(&q_vector->napi); diff --git a/drivers/net/ethernet/wangxun/libwx/wx_type.h b/drivers/net/ethernet/wangxun/libwx/wx_type.h index 2eba5ab59925..ec75ca116979 100644 --- a/drivers/net/ethernet/wangxun/libwx/wx_type.h +++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h @@ -1359,8 +1359,8 @@ struct wx { u32 tx_ring_count; u32 rx_ring_count; - struct wx_ring *tx_ring[64] ____cacheline_aligned_in_smp; - struct wx_ring *rx_ring[64]; + struct wx_ring __rcu *tx_ring[64] ____cacheline_aligned_in_smp; + struct wx_ring __rcu *rx_ring[64]; struct wx_q_vector *q_vector[64]; int num_rx_pools; int num_rx_queues_per_pool; -- 2.30.1