Re: [PATCH net] sfc: fix use-after-free of filter_work in efx_realloc_channels()

[sicong <congei42@163.com>]

At 2026-10-22 22:36:52, "Edward Cree" <ecree.xilinx@gmail.com> wrote:
>The analysis looks correct, but I wonder if rather than placing the
> cancel_delayed_work_sync() inline in efx_realloc_channels(), it should
> be done by efx_remove_channel() (or rolled up with the kfree() into a
> new efx_free_channel(), since it's undoing efx_alloc_channel() rather
> than efx_probe_channel()), to reduce the risk of the same race popping
> up elsewhere.  Consumers of the channels API should not need to know
> that they have to do this 'magic' cancel to safely free a channel,
> that's a layering violation.

Thanks for the review, that makes sense.

I went with efx_free_channel(). It cancels filter_work synchronously
and then frees the channel, and both efx_realloc_channels() and
efx_fini_channels() now use it instead of calling kfree() directly.
The Siena driver gets the same change.

>(Actually, it's a layering violation that filter_work even lives in the
> efx_channel and not its efx_rx_queue, but I never had time to fix that
> and am now not likely to — I commend the idea to future maintainers.)

That seems like a bigger refactor than belongs in a fix for net, so
I've left it out of this patch.

I'll send v2 as a separate thread.

Thanks,
Sicong