Re: [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM
flat view
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-01-06 01:40:46
Also in:
linux-doc, lkml
AI code review points out:
quoted hunk ↗ jump to hunk
@@ -150,6 +236,9 @@ int hinic3_qps_irq_init(struct net_device *netdev) goto err_release_irqs; } + INIT_WORK(&irq_cfg->rxq->dim.work, hinic3_rx_dim_work); + irq_cfg->rxq->dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_CQE; + hinic3_set_msix_auto_mask_state(nic_dev->hwdev, irq_cfg->msix_entry_idx, HINIC3_SET_MSIX_AUTO_MASK);@@ -164,6 +253,9 @@ int hinic3_qps_irq_init(struct net_device *netdev) q_id--; irq_cfg = &nic_dev->q_params.irq_cfg[q_id]; qp_del_napi(irq_cfg); + + disable_work_sync(&irq_cfg->rxq->dim.work); + hinic3_set_msix_state(nic_dev->hwdev, irq_cfg->msix_entry_idx, HINIC3_MSIX_DISABLE);
The error path in hinic3_qps_irq_init() calls disable_work_sync() to cancel the DIM work before cleanup. However, hinic3_qps_irq_uninit() does not have a corresponding cancel_work_sync() or disable_work_sync() call. The DIM work is scheduled via net_dim()->schedule_work() from hinic3_poll(). If the interface is closed while DIM work is pending or running, hinic3_rx_dim_work() could access rxq->netdev and rxq->q_id after the queues have been torn down in hinic3_close_channel()->hinic3_qps_irq_uninit(). Should hinic3_qps_irq_uninit() call cancel_work_sync() for the DIM work to prevent a potential use-after-free?