Re: [PATCH net 3/3] net: hns3: fix use-after-free in debugfs read during reset/unload

[Jijie Shao <shaojijie@huawei.com>]

on 2026/9/20 7:47, Jakub Kicinski wrote:
> On Tue, 15 Sep 2026 21:24:34 +0800 Jijie Shao wrote:
>> @@ -504,22 +524,16 @@ static int hns3_dbg_rx_queue_info(struct seq_file *s, void *data)
>>   	struct hns3_enet_ring *ring;
>>   	u32 i;
>>   
>> -	if (!priv->ring) {
>> -		dev_err(&h->pdev->dev, "priv->ring is NULL\n");
>> -		return -EFAULT;
>> -	}
>> +	guard(mutex)(&priv->ae_handle->dbg_mutex);
>> +	if (hns3_dbg_is_device_busy(priv))
>> +		return -EBUSY;
>>   
>>   	seq_puts(s, "QUEUE_ID  BD_NUM  BD_LEN  TAIL  HEAD  FBDNUM  ");
>>   	seq_puts(s, "PKTNUM     COPYBREAK  RING_EN  RX_RING_EN  BASE_ADDR\n");
> Quoting documentation:
>
>    Using device-managed and cleanup.h constructs
>    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>    
>    Netdev remains skeptical about promises of all "auto-cleanup" APIs,
>    including even ``devm_`` helpers, historically. They are not the preferred
>    style of implementation, merely an acceptable one.
>    
>    Use of ``guard()`` is discouraged within any function longer than 20 lines,
>    ``scoped_guard()`` is considered more readable. Using normal lock/unlock is
>    still (weakly) preferred.
>    
>    Low level cleanup constructs (such as ``__free()``) can be used when building
>    APIs and helpers, especially scoped iterators. However, direct use of
>    ``__free()`` within networking core and drivers is discouraged.
>    Similar guidance applies to declaring variables mid-function.
>    
> See: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Ok, thanks!
Jijie Shao