Re: [PATCH net-next v6 4/5] net: wangxun: implement soft quiesce for PCIe error recovery
From: Simon Horman <horms@kernel.org>
Date: 2026-06-12 15:49:35
On Wed, Jun 10, 2026 at 02:09:16PM +0800, Jiawen Wu wrote:
Function wx_soft_quiesce() provide a lightweight shutdown path during PCIe error recovery. It avoids MMIO-dependent operations in PCIe error status. Waiting for the service task to complete may unnecessarily delay PCIe error recovery, especially if the work item is already blocked by the hardware failure that triggered AER. So the service task is not explicitly cancelled in quiesce path. As a measure to block the service task, the checking of WX_STATE_DOWN and WX_STATE_RESETTING is added at the entry of every work item. Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Aleksandr Loktionov <redacted>
...
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c index 44f3e6505246..dcc8b3ae1445 100644 --- a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c +++ b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c@@ -842,6 +842,27 @@ void wx_ptp_stop(struct wx *wx) } EXPORT_SYMBOL(wx_ptp_stop); +void wx_ptp_quiesce(struct wx *wx) +{ + if (!test_and_clear_bit(WX_STATE_PTP_RUNNING, wx->state)) + return; + + clear_bit(WX_FLAG_PTP_PPS_ENABLED, wx->flags); + + if (wx->ptp_tx_skb) { + dev_kfree_skb_any(wx->ptp_tx_skb); + wx->ptp_tx_skb = NULL; + }
AI-generated review of this patch on sashiko.dev flags a potential UAF here: "Could freeing wx->ptp_tx_skb here cause a use-after-free or double-free? "Because ptp_clock_unregister() is called after this block, the PTP kworker might still be running. "If wx_ptp_tx_hwtstamp() reads wx->ptp_tx_skb just before this free, it will pass the freed skb to skb_tstamp_tx() and call dev_kfree_skb_any() on it again. I'd appreciate it if you could look into that. I believe that the other issues raised in that AI-generated review have already been discussed in the context of earlier versions of this patch-set.
+ clear_bit_unlock(WX_STATE_PTP_TX_IN_PROGRESS, wx->state);
+
+ if (wx->ptp_clock) {
+ ptp_clock_unregister(wx->ptp_clock);
+ wx->ptp_clock = NULL;
+ dev_info(&wx->pdev->dev, "removed PHC on %s\n", wx->netdev->name);
+ }
+}...