RE: [PATCH v2 2/2] ice: clear Flow Director entries before reset cleanup

[Singh, Ayush1X]

> -----Original Message-----
> From: Aaron Ma <aaron.ma@xxxxxxxxxxxxx> 
> Sent: 07 September 2026 17:22
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; Andrew Lunn <andrew+netdev@xxxxxxx>; David S. Miller <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>; Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx
> Cc: Henry Tieman <henry.w.tieman@xxxxxxxxx>; moderated list:INTEL ETHERNET DRIVERS <intel-wired-lan@xxxxxxxxxxxxxxxx>
> Subject: [PATCH v2 2/2] ice: clear Flow Director entries before reset cleanup
>
> Flow Director profiles retain handles to generic flow entries. Reset calls
> ice_clear_hw_tbls() to free those entries, but leaves the Flow Director handles unchanged until replay replaces them.
>
> If rebuild fails before replay completes, later driver removal follows a stale handle and dereferences a freed flow entry in ice_flow_rem_entry().
KASAN reports a wild access to list poison from ice_fdir_erase_flow_from_hw().
>
> The failure is reported as:
>
> KASAN: maybe wild-memory-access in range [0xdead000000000108-...]
> RIP: ice_flow_rem_entry+0xaf/0x170 [ice]
> ice_fdir_erase_flow_from_hw+0x1ee/0x420 [ice]
>
> Clear the Flow Director handles while holding hw->fdir_fltr_lock before the hardware tables free their entries. A successful replay installs new handles, while a failed rebuild leaves them invalid for later cleanup.
>
> Fixes: 148beb612031 ("ice: Initialize Flow Director resources")
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@xxxxxxxxx>
> Signed-off-by: Aaron Ma <aaron.ma@xxxxxxxxxxxxx>
> ---
> v1 -> v2:
> - Acquire hw->fdir_fltr_lock in ice_fdir_clear_flow_handles() to
> synchronize with concurrent ethtool filter add/del.
>
> drivers/net/ethernet/intel/ice/ice.h          |  1 +
> .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 +++++++++++++++++++
> drivers/net/ethernet/intel/ice/ice_main.c     |  2 ++
> 3 files changed, 29 insertions(+)
>

Tested-by: Ayush Singh < ayush1x.singh@xxxxxxxxx > (A Contingent worker at Intel)