On 5/28/25 10:28 AM, Jinjian Song wrote:
> When driver handles the napi rx polling requests, the netdev might
> have been released by the dellink logic triggered by the disconnect
> operation on user plane. However, in the logic of processing skb in
> polling, an invalid netdev is still being used, which causes a panic.
>
> BUG: kernel NULL pointer dereference, address: 00000000000000f1
> Oops: 0000 [#1] PREEMPT SMP NOPTI
> RIP: 0010:dev_gro_receive+0x3a/0x620
> [...]
> Call Trace:
> <IRQ>
> ? __die_body+0x68/0xb0
> ? page_fault_oops+0x379/0x3e0
> ? exc_page_fault+0x4f/0xa0
> ? asm_exc_page_fault+0x22/0x30
> ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]
> ? dev_gro_receive+0x3a/0x620
> napi_gro_receive+0xad/0x170
> t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]
> t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]
> net_rx_action+0x103/0x470
> irq_exit_rcu+0x13a/0x310
> sysvec_apic_timer_interrupt+0x56/0x90
> </IRQ>
>
> Fixes: 5545b7b9f294 ("net: wwan: t7xx: Add NAPI support")
> Signed-off-by: Jinjian Song <jinjian.song@xxxxxxxxxxx>
> ---
> drivers/net/wwan/t7xx/t7xx_netdev.c | 19 ++++++++++---------
> 1 file changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c
> index 91fa082e9cab..48007384c030 100644
> --- a/drivers/net/wwan/t7xx/t7xx_netdev.c
> +++ b/drivers/net/wwan/t7xx/t7xx_netdev.c
> @@ -172,7 +172,7 @@ static void t7xx_ccmni_start(struct t7xx_ccmni_ctrl *ctlb)
> int i;
>
> for (i = 0; i < ctlb->nic_dev_num; i++) {
> - ccmni = ctlb->ccmni_inst[i];
> + ccmni = READ_ONCE(ctlb->ccmni_inst[i]);
> if (!ccmni)
> continue;
>
> @@ -192,7 +192,7 @@ static void t7xx_ccmni_pre_stop(struct t7xx_ccmni_ctrl *ctlb)
> int i;
>
> for (i = 0; i < ctlb->nic_dev_num; i++) {
> - ccmni = ctlb->ccmni_inst[i];
> + ccmni = READ_ONCE(ctlb->ccmni_inst[i]);
> if (!ccmni)
> continue;
>
> @@ -210,7 +210,7 @@ static void t7xx_ccmni_post_stop(struct t7xx_ccmni_ctrl *ctlb)
> t7xx_ccmni_disable_napi(ctlb);
>
> for (i = 0; i < ctlb->nic_dev_num; i++) {
> - ccmni = ctlb->ccmni_inst[i];
> + ccmni = READ_ONCE(ctlb->ccmni_inst[i]);
> if (!ccmni)
> continue;
>
> @@ -302,7 +302,7 @@ static int t7xx_ccmni_wwan_newlink(void *ctxt, struct net_device *dev, u32 if_id
> ccmni->ctlb = ctlb;
> ccmni->dev = dev;
> atomic_set(&ccmni->usage, 0);
> - ctlb->ccmni_inst[if_id] = ccmni;
> + WRITE_ONCE(ctlb->ccmni_inst[if_id], ccmni);
>
> ret = register_netdevice(dev);
> if (ret)
> @@ -321,9 +321,10 @@ static void t7xx_ccmni_wwan_dellink(void *ctxt, struct net_device *dev, struct l
> if (if_id >= ARRAY_SIZE(ctlb->ccmni_inst))
> return;
>
> - if (WARN_ON(ctlb->ccmni_inst[if_id] != ccmni))
> + if (WARN_ON(READ_ONCE(ctlb->ccmni_inst[if_id]) != ccmni))
READ_ONCE is only needed when the the lock protecting ctlb->ccmni_inst
is not held. It's not needed here, and likely in pre/post stop operations.
/P
