github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-25 08:16:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'intel-wired-lan-driver-updates-2026-09-28-idpf-ice-iavf'

Browse Source 
Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2026-09-28 (ice) [part]

For ice:
Xuanqiang Luo resolves a use-after-free issue by changing order of
operations so index is used before being freed.

Bryan Fraschetti restores ordered MMIO writes for ice Tx doorbells
by replacing writel_relaxed() call with writel().

Tristan Madani fixes representor use-after-free by releasing
metadata_dst through dst_release() to ensure it is not freed until
all references are dropped.
====================

Link: https://patch.msgid.link/20260928230429.495442-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-10-02 13:38:09 -07:00
commit 6dc989ea46
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/ethernet/intel/ice/devlink/port.c
View File

@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct ice_dynamic_port *dyn_port)
xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
ice_eswitch_detach_sf(pf, dyn_port);
ice_vsi_free(dyn_port->vsi);
xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
ice_vsi_free(dyn_port->vsi);
kfree(dyn_port);
}

2
drivers/net/ethernet/intel/ice/ice_eswitch.c
View File

@ -95,7 +95,7 @@ ice_eswitch_release_repr(struct ice_pf *pf, struct ice_repr *repr)
return;
ice_vsi_update_security(vsi, ice_vsi_ctx_set_antispoof);
metadata_dst_free(repr->dst);
dst_release(&repr->dst->dst);
repr->dst = NULL;
ice_fltr_add_mac_and_broadcast(vsi, repr->parent_mac,
ICE_FWD_TO_VSI);

4
drivers/net/ethernet/intel/ice/ice_txrx.c
View File

@ -1561,10 +1561,10 @@ ice_tx_map(struct ice_tx_ring *tx_ring, struct ice_tx_buf *first,
}
}
tstamp_ring->next_to_use = j;
writel_relaxed(j, tstamp_ring->tail);
writel(j, tstamp_ring->tail);
} else {
ring_kick:
writel_relaxed(i, tx_ring->tail);
writel(i, tx_ring->tail);
}
return;