From nobody Mon Jun 8 06:36:11 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82F7748032F for ; Fri, 5 Jun 2026 07:57:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780646245; cv=none; b=V3Md9ACNz645DSHrOIGAOc1MmAZMX/8hLaYEvDy6pAEh3DAmXDeU+OmmQTLBocr6nY7FXC1XhTH3Ya9inpyt6CeLUcFiA53XfDogNLFlmwlMDjRT88Uv9xIQJRAW1v21F8jEN/Jq3lFTd/3RelhFSf+5wc7TEHP+zl69gbYcYmg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780646245; c=relaxed/simple; bh=FyoT6jElRNhZ/XR8me8pCu8SF+rmD4dgSDPDQvZXrZ8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=dGOI9XpCJbHQ3E7ANpSMPHYKoMElPiZhhy0Pi2lAXwXRevCQeyNUewlTQ3o7xE7m6p+a5Iv9hXrY0494RmKCHTDaEVzmPAg9/TGzmUD3/FyyJ64KEDBdmiEa/4AACogBv/ndcCeivaXZ89v/vqHSolg1XPnOXAU3tE/hS7kbgR0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LRoFk0pz; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LRoFk0pz" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36d6bb38b44so1151941a91.0 for ; Fri, 05 Jun 2026 00:57:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780646243; x=1781251043; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=ypRXmfNw4AH7NGaRxQ71Nt3S+wAEO8XxXRpJWlgrK/o=; b=LRoFk0pzEXlI9g+wQcOHkWJgIJz/lZ+546mIf56y3vR0op0BpXZ2K37D5dGWNj2SzJ d3GzsLACru+w6jau1Nzo/VmfH3cDbyt+RMi3Kift9Tl0MN+6414a+DzCpYURezCuHQt+ 72psawsisQ5YnBHMhhm5bYdknDAz4Oa3dplQeQe/+FC57402ZEFeOcOsq33CEuThRTGe q7VJrxGIXM5oH0PG4IPENZ3kTSRQYyW4mHyvFMDzgzsx/anS7khK9AuFRvA5wVrBism5 IOn6CPM8jwouDQRoV7/2ui5ZKMtLJfGDGQgWrtlqUxW2NvP+G09ghB1UNGhl4T5i/Xpc FrcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780646243; x=1781251043; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ypRXmfNw4AH7NGaRxQ71Nt3S+wAEO8XxXRpJWlgrK/o=; b=Xb/x3PKIyPaHpnYZbEhnJdrfldZdDigv3/WQVenW6piH1vCUebyEIARVp3FDTdv3Po ypSNDPtOHORE6RdGpZPmI2LZR4hQ4IBw9dBscsq1cogn9huy5wHTvzGCPohFY1Q8oyi+ Re3niebqLBNEm7Uis+n/uiQLhNyf59K4GXXJE9GNwl+pfLdoMZJ7b2nZK52Sv5N8pMs/ w5Vv+OlTpBApzWed8ChanrR6NdNUmw1otB71YGqcAYoBSesomqxcOQ3JMpd1TbSeFhXe WDI+KHbYhwl832LGZjwb+ubJMPgABLrGSbjve3WTkrNjYGmnlnKVl6U5273tK7c0TtjX gntA== X-Forwarded-Encrypted: i=1; AFNElJ952tAxvg764a0yPiOon9fjPy4bVhBgH5RTknPVDz4tN4iIRf6ITCU70GI0a7UYRl7Jmm3wHKT3QaYHaiE=@vger.kernel.org X-Gm-Message-State: AOJu0YyXh8aYaVdxKzm/yA6EcD3PTy4es5j3xJli3tK5uu3rb6uQU2v1 IgLcmtsVGRyL/k3Cjl/edWC8mUHZQxyBaprl5cvk5APLYp3dmPPySpky X-Gm-Gg: Acq92OHVAKMo+ulxq3tvm2EgTW+Un10DFsoHcWk3cawblLQonkJ7FxK2JloezTVk3AC 9ywrE1Fh5s3CyvuY8xmzwnum3dsXucAo1LzLERnJlvxfQf94q4dJ6M6dOTH95pbSHKjBBPrJvW9 obDsu3NDW77wNpbRJHpe4FM+s1lwRlbfEkVxDOP1Kt0f+Sl0J+jpnq4O22/mBVLnjSzj7rTLZKM vGRz4nmOgJ73fdzWqTeRGEmvu5rvWO1bXVMsVgAaX9YO84Rz0Xw1q8bV7y0OoVCQKsHGjDm0lL/ I9+iHl2ypdeLcecKuY34Au/eYB+mvtlB3AwJKN0KQnt66fJ5VrElR5aTh1BS/fIIFNj0g5HXxRX +v8QqGAdQwZ96kWmmQiWLuF7twyqJUf9EHyb7VJlUVxs5vich1CHPyNmIpKVbqAK9/iSfuEFhzl mfQ/QHilSueRUig7oJmYn87u/q6+mDkT1noBtdlQeDXzwc7EVB41RdEQSXH03ooC7QrxpvkAV0c Q== X-Received: by 2002:a17:90b:3512:b0:36d:b424:4f17 with SMTP id 98e67ed59e1d1-370ee82fa3cmr2367318a91.1.1780646242679; Fri, 05 Jun 2026 00:57:22 -0700 (PDT) Received: from u9dbb0cac493f51.ant.amazon.com ([50.35.61.175]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37133082519sm897559a91.1.2026.06.05.00.57.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 Jun 2026 00:57:22 -0700 (PDT) From: Carlos Fangmeier Date: Fri, 05 Jun 2026 00:56:35 -0700 Subject: [PATCH] net: stmmac: prevent kernel panic during XDP program and XSK pool transitions Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260605-main-v1-1-aed15b1cf1af@gmail.com> X-B4-Tracking: v=1; b=H4sIADKBImoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDMwMT3dzEzDzdNDPLNEtTM5NEc5MkJaDSgqLUtMwKsDHRsRB+cWlSVmp yCUivUm0tAMnGDJdoAAAA X-Change-ID: 20260604-main-f69f9564a74b To: Alexei Starovoitov , Daniel Borkmann , "David S. Miller" , Jakub Kicinski , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Andrew Lunn , Eric Dumazet , Paolo Abeni , Maxime Coquelin , Alexandre Torgue , Ong Boon Leong Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Carlos Fangmeier X-Mailer: b4 0.15.2 stmmac_xdp_set_prog() tears down and rebuilds all DMA channels via stmmac_xdp_release()/stmmac_xdp_open() without pausing the netdev TX path. Similarly, stmmac_xdp_enable_pool() and stmmac_xdp_disable_pool() reconfigure individual queue DMA rings while TX remains active. If the kernel transmits a frame during these windows =E2=80=94 for example = an MLD report queued by the IPv6 stack =E2=80=94 stmmac_xmit() calls dwmac4_set_addr() against an MMIO register whose mapping has been torn down, triggering a level-3 translation fault: Unable to handle kernel paging request at virtual address ffff8000840ec000 pc : dwmac4_set_addr+0x8/0x18 lr : stmmac_xmit+0x64c/0xb60 Call trace: dwmac4_set_addr+0x8/0x18 dev_hard_start_xmit+0xb0/0x220 sch_direct_xmit+0x108/0x3f0 __dev_queue_xmit+0x844/0xd00 ip6_finish_output2+0x2d8/0x610 mld_sendpack+0x180/0x2e0 mld_ifc_work+0x1dc/0x480 The existing netif_tx_disable() in stmmac_xdp_release() is not sufficient because stmmac_xdp_open() re-enables TX via netif_tx_start_all_queues() before the caller regains control, leaving a window where the freshly rebuilt rings can race with pending TX work. Fix this by wrapping each reconfiguration path with netif_tx_disable()/netif_tx_wake_all_queues(): - stmmac_xdp_set_prog(): hold TX disabled across the full stmmac_xdp_release() + stmmac_xdp_open() sequence, only waking TX after stmmac_xdp_open() returns. - stmmac_xdp_enable_pool(): disable TX before tearing down the queue, re-enable after the queue is rebuilt and NAPI is active. - stmmac_xdp_disable_pool(): same pattern around the pool teardown and queue rebuild. Tested on Cortex-A55 (stmmac/dwmac4, kernel 6.6.60) with AF_XDP zero-copy and IPv6 active =E2=80=94 no panics observed across repeated XDP attach/detach and XSK pool setup/teardown cycles. Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket") Signed-off-by: Carlos Fangmeier --- drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c b/drivers/net= /ethernet/stmicro/stmmac/stmmac_xdp.c index d7e4db7224b0..a6611aee687f 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c @@ -34,6 +34,7 @@ static int stmmac_xdp_enable_pool(struct stmmac_priv *pri= v, need_update =3D netif_running(priv->dev) && stmmac_xdp_is_enabled(priv); =20 if (need_update) { + netif_tx_disable(priv->dev); napi_disable(&ch->rx_napi); napi_disable(&ch->tx_napi); stmmac_disable_rx_queue(priv, queue); @@ -46,6 +47,7 @@ static int stmmac_xdp_enable_pool(struct stmmac_priv *pri= v, stmmac_enable_rx_queue(priv, queue); stmmac_enable_tx_queue(priv, queue); napi_enable(&ch->rxtx_napi); + netif_tx_wake_all_queues(priv->dev); =20 err =3D stmmac_xsk_wakeup(priv->dev, queue, XDP_WAKEUP_RX); if (err) @@ -72,6 +74,7 @@ static int stmmac_xdp_disable_pool(struct stmmac_priv *pr= iv, u16 queue) need_update =3D netif_running(priv->dev) && stmmac_xdp_is_enabled(priv); =20 if (need_update) { + netif_tx_disable(priv->dev); napi_disable(&ch->rxtx_napi); stmmac_disable_rx_queue(priv, queue); stmmac_disable_tx_queue(priv, queue); @@ -87,6 +90,7 @@ static int stmmac_xdp_disable_pool(struct stmmac_priv *pr= iv, u16 queue) stmmac_enable_tx_queue(priv, queue); napi_enable(&ch->rx_napi); napi_enable(&ch->tx_napi); + netif_tx_wake_all_queues(priv->dev); } =20 return 0; @@ -121,8 +125,10 @@ int stmmac_xdp_set_prog(struct stmmac_priv *priv, stru= ct bpf_prog *prog, xdp_features_clear_redirect_target(dev); =20 need_update =3D !!priv->xdp_prog !=3D !!prog; - if (if_running && need_update) + if (if_running && need_update) { + netif_tx_disable(dev); stmmac_xdp_release(dev); + } =20 old_prog =3D xchg(&priv->xdp_prog, prog); if (old_prog) @@ -131,8 +137,10 @@ int stmmac_xdp_set_prog(struct stmmac_priv *priv, stru= ct bpf_prog *prog, /* Disable RX SPH for XDP operation */ priv->sph_active =3D priv->sph_capable && !stmmac_xdp_is_enabled(priv); =20 - if (if_running && need_update) + if (if_running && need_update) { stmmac_xdp_open(dev); + netif_tx_wake_all_queues(dev); + } =20 if (prog) xdp_features_set_redirect_target(dev, false); --- base-commit: 4aacf509e537a711fa71bca9f234e5eb6968850e change-id: 20260604-main-f69f9564a74b Best regards, -- =20 Carlos Fangmeier