From: Jakub Kicinski <kuba@kernel•org>
To: Fan Gong <gongfan1@huawei•com>
Cc: Zhu Yikai <zhuyikai1@h-partners•com>, <netdev@vger•kernel.org>,
"David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Paolo Abeni <pabeni@redhat•com>, Simon Horman <horms@kernel•org>,
Andrew Lunn <andrew+netdev@lunn•ch>,
Markus Elfring <Markus.Elfring@web•de>,
Pavan Chebbi <pavan.chebbi@broadcom•com>,
ALOK TIWARI <alok.a.tiwari@oracle•com>,
<linux-kernel@vger•kernel.org>, <linux-doc@vger•kernel.org>,
luosifu <luosifu@huawei•com>, Xin Guo <guoxin09@huawei•com>,
Shen Chenyang <shenchenyang1@hisilicon•com>,
Zhou Shuai <zhoushuai28@huawei•com>, Wu Like <wulike1@huawei•com>,
Shi Jing <shijing34@huawei•com>,
Luo Yang <luoyang82@h-partners•com>
Subject: Re: [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM
Date: Mon, 5 Jan 2026 17:40:44 -0800 [thread overview]
Message-ID: <20260105174044.3da6585d@kernel.org> (raw)
In-Reply-To: <4c3ebb442eacab854679702873e6b72091f78a7b.1767495881.git.zhuyikai1@h-partners.com>
AI code review points out:
> @@ -150,6 +236,9 @@ int hinic3_qps_irq_init(struct net_device *netdev)
> goto err_release_irqs;
> }
>
> + INIT_WORK(&irq_cfg->rxq->dim.work, hinic3_rx_dim_work);
> + irq_cfg->rxq->dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_CQE;
> +
> hinic3_set_msix_auto_mask_state(nic_dev->hwdev,
> irq_cfg->msix_entry_idx,
> HINIC3_SET_MSIX_AUTO_MASK);
> @@ -164,6 +253,9 @@ int hinic3_qps_irq_init(struct net_device *netdev)
> q_id--;
> irq_cfg = &nic_dev->q_params.irq_cfg[q_id];
> qp_del_napi(irq_cfg);
> +
> + disable_work_sync(&irq_cfg->rxq->dim.work);
> +
> hinic3_set_msix_state(nic_dev->hwdev, irq_cfg->msix_entry_idx,
> HINIC3_MSIX_DISABLE);
The error path in hinic3_qps_irq_init() calls disable_work_sync() to cancel
the DIM work before cleanup. However, hinic3_qps_irq_uninit() does not have
a corresponding cancel_work_sync() or disable_work_sync() call.
The DIM work is scheduled via net_dim()->schedule_work() from hinic3_poll().
If the interface is closed while DIM work is pending or running,
hinic3_rx_dim_work() could access rxq->netdev and rxq->q_id after the
queues have been torn down in hinic3_close_channel()->hinic3_qps_irq_uninit().
Should hinic3_qps_irq_uninit() call cancel_work_sync() for the DIM work
to prevent a potential use-after-free?
next prev parent reply other threads:[~2026-01-06 1:40 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-05 3:13 [PATCH net-next v08 0/9] net: hinic3: PF initialization Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 1/9] hinic3: Add PF framework Fan Gong
2026-01-06 1:39 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 2/9] hinic3: Add PF management interfaces Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 3/9] hinic3: Add .ndo_tx_timeout and .ndo_get_stats64 Fan Gong
2026-01-06 1:39 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 4/9] hinic3: Add .ndo_set_features and .ndo_fix_features Fan Gong
2026-01-06 1:40 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 5/9] hinic3: Add .ndo_features_check Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 6/9] hinic3: Add .ndo_vlan_rx_add/kill_vid and .ndo_validate_addr Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM Fan Gong
2026-01-06 1:40 ` Jakub Kicinski [this message]
2026-01-05 3:13 ` [PATCH net-next v08 8/9] hinic3: Add mac filter ops Fan Gong
2026-01-06 1:41 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 9/9] hinic3: Add HW event handler Fan Gong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260105174044.3da6585d@kernel.org \
--to=kuba@kernel$(echo .)org \
--cc=Markus.Elfring@web$(echo .)de \
--cc=alok.a.tiwari@oracle$(echo .)com \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=gongfan1@huawei$(echo .)com \
--cc=guoxin09@huawei$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=linux-doc@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=luosifu@huawei$(echo .)com \
--cc=luoyang82@h-partners$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pavan.chebbi@broadcom$(echo .)com \
--cc=shenchenyang1@hisilicon$(echo .)com \
--cc=shijing34@huawei$(echo .)com \
--cc=wulike1@huawei$(echo .)com \
--cc=zhoushuai28@huawei$(echo .)com \
--cc=zhuyikai1@h-partners$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox