Re: [PATCH v2 2/2] ice: clear Flow Director entries before reset cleanup

On Mon, Sep 07, 2026 at 07:52:21PM +0800, Aaron Ma wrote:

Flow Director profiles retain handles to generic flow entries. Reset calls
ice_clear_hw_tbls() to free those entries, but leaves the Flow Director
handles unchanged until replay replaces them.

If rebuild fails before replay completes, later driver removal follows a
stale handle and dereferences a freed flow entry in ice_flow_rem_entry().
KASAN reports a wild access to list poison from
ice_fdir_erase_flow_from_hw().

The failure is reported as:

  KASAN: maybe wild-memory-access in range [0xdead000000000108-...]
  RIP: ice_flow_rem_entry+0xaf/0x170 [ice]
  ice_fdir_erase_flow_from_hw+0x1ee/0x420 [ice]

Clear the Flow Director handles while holding hw->fdir_fltr_lock before
the hardware tables free their entries. A successful replay installs new
handles, while a failed rebuild leaves them invalid for later cleanup.

Fixes: 148beb612031 ("ice: Initialize Flow Director resources")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Aaron Ma <redacted>
---
v1 -> v2:
- Acquire hw->fdir_fltr_lock in ice_fdir_clear_flow_handles() to
  synchronize with concurrent ethtool filter add/del.

Reviewed-by: Simon Horman <horms@kernel.org>