> -----Original Message----- > From: Aaron Ma <[email protected]> > Sent: 07 September 2026 17:22 > To: Nguyen, Anthony L <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Andrew Lunn <[email protected]>; David S. > Miller <[email protected]>; Eric Dumazet <[email protected]>; Jakub > Kicinski <[email protected]>; Paolo Abeni <[email protected]>; > [email protected]; [email protected] > Cc: Henry Tieman <[email protected]>; moderated list:INTEL ETHERNET > DRIVERS <[email protected]> > Subject: [PATCH v2 2/2] ice: clear Flow Director entries before reset cleanup > > Flow Director profiles retain handles to generic flow entries. Reset calls > ice_clear_hw_tbls() to free those entries, but leaves the Flow Director > handles unchanged until replay replaces them. > > If rebuild fails before replay completes, later driver removal follows a > stale handle and dereferences a freed flow entry in ice_flow_rem_entry(). KASAN reports a wild access to list poison from ice_fdir_erase_flow_from_hw(). > > The failure is reported as: > > KASAN: maybe wild-memory-access in range [0xdead000000000108-...] > RIP: ice_flow_rem_entry+0xaf/0x170 [ice] > ice_fdir_erase_flow_from_hw+0x1ee/0x420 [ice] > > Clear the Flow Director handles while holding hw->fdir_fltr_lock before the > hardware tables free their entries. A successful replay installs new handles, > while a failed rebuild leaves them invalid for later cleanup. > > Fixes: 148beb612031 ("ice: Initialize Flow Director resources") > Reviewed-by: Przemek Kitszel <[email protected]> > Signed-off-by: Aaron Ma <[email protected]> > --- > v1 -> v2: > - Acquire hw->fdir_fltr_lock in ice_fdir_clear_flow_handles() to > synchronize with concurrent ethtool filter add/del. > > drivers/net/ethernet/intel/ice/ice.h | 1 + > .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 +++++++++++++++++++ > drivers/net/ethernet/intel/ice/ice_main.c | 2 ++ > 3 files changed, 29 insertions(+) >
Tested-by: Ayush Singh < [email protected] > (A Contingent worker at Intel)
