On Sat, Oct 17, 2026 at 12:06:45PM +0000, [email protected] wrote:
> Does this sequence still leave a use-after-free regression for Ethernet and
> RDMA queues during teardown?
Thanks for the report. This is a pre-existing individual-CQ lifetime
issue, rather than a regression introduced by this HWC series.
mana_gd_destroy_cq() clears the slot, but mana_gd_destroy_queue() can free
the CQ while an EQ reader still holds its pointer. The later EQ-side RCU
grace period does not protect the earlier CQ free.
I checked unmodified net-next at 98c2ad4f5d80 on October 17. Its MANA
Ethernet, RDMA and header subtrees are identical to the series base,
05b5019b01fb. The Ethernet CQ reader/teardown ordering is also already
present at upstream commit 02fed6d92bad ("net: mana: add msix index sharing
between EQs"), from December 2023, well before this series.
The HWC-specific teardown addressed by this patch is different: after
acknowledged HWC teardown, it unpublishes the CQ table and waits for
existing IRQ-side RCU readers before freeing the HWC queues. Individual
Ethernet and RDMA CQ lifetime handling remains separate, as stated in the
patch description.
I agree that the reported issue should be addressed in a separate fix to
the existing per-CQ teardown paths, independently of this HWC series.
Thanks,
Wei
