diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-10-02 13:38:09 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-02 13:41:12 -0700 |
| commit | 6dc989ea46b96ce170840174b4a38c4a387fb005 (patch) | |
| tree | 7d83c48dea2077d88057ce725c39af0f75e7dfe5 | |
| parent | 8b1f0af1fd5fd113432233ed8a3862ee7c30a84f (diff) | |
| parent | 58858b8f14803a7eeac297b3ce20f3b21bf2ff66 (diff) | |
| download | linux-6dc989ea46b96ce170840174b4a38c4a387fb005.tar.gz linux-6dc989ea46b96ce170840174b4a38c4a387fb005.zip | |
Merge branch 'intel-wired-lan-driver-updates-2026-09-28-idpf-ice-iavf'
Tony Nguyen says:
====================
Intel Wired LAN Driver Updates 2026-09-28 (ice) [part]
For ice:
Xuanqiang Luo resolves a use-after-free issue by changing order of
operations so index is used before being freed.
Bryan Fraschetti restores ordered MMIO writes for ice Tx doorbells
by replacing writel_relaxed() call with writel().
Tristan Madani fixes representor use-after-free by releasing
metadata_dst through dst_release() to ensure it is not freed until
all references are dropped.
====================
Link: https://patch.msgid.link/20260928230429.495442-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/ethernet/intel/ice/devlink/port.c | 2 | ||||
| -rw-r--r-- | drivers/net/ethernet/intel/ice/ice_eswitch.c | 2 | ||||
| -rw-r--r-- | drivers/net/ethernet/intel/ice/ice_txrx.c | 4 |
3 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c b/drivers/net/ethernet/intel/ice/devlink/port.c index 2a2e56777f9f..3ede24649002 100644 --- a/drivers/net/ethernet/intel/ice/devlink/port.c +++ b/drivers/net/ethernet/intel/ice/devlink/port.c @@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct ice_dynamic_port *dyn_port) xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf); ice_eswitch_detach_sf(pf, dyn_port); - ice_vsi_free(dyn_port->vsi); xa_erase(&pf->dyn_ports, dyn_port->vsi->idx); + ice_vsi_free(dyn_port->vsi); kfree(dyn_port); } diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c index b069e6c514fb..6e7bba473898 100644 --- a/drivers/net/ethernet/intel/ice/ice_eswitch.c +++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c @@ -95,7 +95,7 @@ ice_eswitch_release_repr(struct ice_pf *pf, struct ice_repr *repr) return; ice_vsi_update_security(vsi, ice_vsi_ctx_set_antispoof); - metadata_dst_free(repr->dst); + dst_release(&repr->dst->dst); repr->dst = NULL; ice_fltr_add_mac_and_broadcast(vsi, repr->parent_mac, ICE_FWD_TO_VSI); diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c index 31303ab5be17..a2c7c4962882 100644 --- a/drivers/net/ethernet/intel/ice/ice_txrx.c +++ b/drivers/net/ethernet/intel/ice/ice_txrx.c @@ -1561,10 +1561,10 @@ ice_tx_map(struct ice_tx_ring *tx_ring, struct ice_tx_buf *first, } } tstamp_ring->next_to_use = j; - writel_relaxed(j, tstamp_ring->tail); + writel(j, tstamp_ring->tail); } else { ring_kick: - writel_relaxed(i, tx_ring->tail); + writel(i, tx_ring->tail); } return; |