[PATCH net v3 0/2] sfc: fix use-after-free of aRFS work on ring resize

[Sicong Huang]

This series fixes aRFS work lifetime and state-copying races when
ethtool -G replaces channel structures. Both sfc and Siena are affected.

Patch 1 keeps expiry cancellation inside efx_free_channel() and re-arms
expiry on the surviving channels, including allocation failure and probe
rollback. Patch 2 prevents new insertion requests while the net_device
is detached, waits for pre-detach receive callbacks and insertion work,
and cancels expiry before copying the channels.

Stopping NAPI alone does not stop deferred PTP receive processing from
submitting aRFS requests. The insertion entry point therefore checks
netif_device_present(), paired with synchronize_net() on the resize
path. All insertion work items are initialised once and flushed without
using the in-flight bitmap as a completion test.

Changes in v3:
- Re-arm expiry after channel replacement, including failure paths,
  so it continues without further NAPI polls. (Sashiko, Paolo Abeni)
- Add patch 2 for the insertion-work UAF and expiry-copy race reported
  by Sashiko. Cover deferred receive processing as well as NAPI.
- Retain the original Fixes tag: asynchronous expiry already needed
  flushing before the later change that added periodic re-arming.
- State the discovery method and testing limits.

Changes in v2:
- Introduce efx_free_channel() to encapsulate expiry cancellation in
  the channel deallocation helper. (Edward Cree)
- Add the Fixes tag.

Testing: the modified translation units build with GCC 11 on x86_64,
W=1 and CONFIG_RFS_ACCEL both enabled and disabled. No hardware testing
or runtime reproduction has been performed.

v2: https://lore.kernel.org/netdev/20261023134214.322796-1-congei42@xxxxxxx/
v1: https://lore.kernel.org/netdev/20261022133927.3860186-1-congei42@xxxxxxx/

Sicong Huang (2):
  sfc: fix use-after-free of filter_work in efx_realloc_channels()
  sfc: quiesce aRFS work before copying channels in
    efx_realloc_channels()

 drivers/net/ethernet/sfc/efx_channels.c       | 35 +++++++++++++++++--
 drivers/net/ethernet/sfc/efx_common.c         |  1 +
 drivers/net/ethernet/sfc/rx_common.c          | 30 +++++++++++++++-
 drivers/net/ethernet/sfc/rx_common.h          |  2 ++
 drivers/net/ethernet/sfc/siena/efx_channels.c | 35 +++++++++++++++++--
 drivers/net/ethernet/sfc/siena/efx_common.c   |  1 +
 drivers/net/ethernet/sfc/siena/rx_common.c    | 30 +++++++++++++++-
 drivers/net/ethernet/sfc/siena/rx_common.h    |  2 ++
 8 files changed, 130 insertions(+), 6 deletions(-)


base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
-- 
2.34.1