From: Kohei Enju ice_xdp_setup_prog() unconditionally hot-swaps xdp_prog when ICE_VSI_REBUILD_PENDING is set. In the attach path, this can publish a new rx_ring->xdp_prog before rx_ring->xdp_ring becomes valid while the rebuild is pending. As a result, ice_clean_rx_irq() may dereference rx_ring->xdp_ring too early. With high-volume RX packets, running these commands in parallel triggered a KASAN splat [1]. # ethtool --reset $DEV irq dma filter offload # ip link set dev $DEV xdp {obj $OBJ sec xdp,off} Fix this by rejecting XDP attach while rebuild is pending. Keep XDP detach allowed in this window. Detach clears rx_ring->xdp_prog, so the RX path will not attempt to access rx_ring->xdp_ring. [1] BUG: KASAN: slab-use-after-free in ice_napi_poll+0x3921/0x41a0 Read of size 2 at addr ffff88812475b880 by task ksoftirqd/1/23 [...] Call Trace: ice_napi_poll+0x3921/0x41a0 __napi_poll+0x98/0x520 net_rx_action+0x8f2/0xfa0 handle_softirqs+0x1cb/0x7f0 [...] Allocated by task 7246: ice_prepare_xdp_rings+0x3de/0x12d0 ice_xdp+0x61c/0xef0 dev_xdp_install+0x3c4/0x840 dev_xdp_attach+0x50a/0x10a0 dev_change_xdp_fd+0x175/0x210 [...] Freed by task 7251: __rcu_free_sheaf_prepare+0x5f/0x230 rcu_free_sheaf+0x1a/0xf0 rcu_core+0x567/0x1d80 handle_softirqs+0x1cb/0x7f0 Fixes: 2504b8405768 ("ice: protect XDP configuration with a mutex") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Tested-by: Patryk Holda Signed-off-by: Tony Nguyen --- drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index e2fbe111f849..f5aa31886e37 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -2912,12 +2912,21 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog, } /* hot swap progs and avoid toggling link */ - if (ice_is_xdp_ena_vsi(vsi) == !!prog || - test_bit(ICE_VSI_REBUILD_PENDING, vsi->state)) { + if (ice_is_xdp_ena_vsi(vsi) == !!prog) { ice_vsi_assign_bpf_prog(vsi, prog); return 0; } + if (test_bit(ICE_VSI_REBUILD_PENDING, vsi->state)) { + if (prog) { + NL_SET_ERR_MSG_MOD(extack, "VSI rebuild is pending"); + return -EAGAIN; + } + + ice_vsi_assign_bpf_prog(vsi, NULL); + return 0; + } + if_running = netif_running(vsi->netdev) && !test_and_set_bit(ICE_VSI_DOWN, vsi->state); -- 2.47.1