From: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx> There are multiple races of zeroing dsa_ptr in struct net_device (on shutdown/remove) against asynchronous dereferences all over the net code. Widespread pattern is as follows: CPU0 CPU1 if (netdev_uses_dsa()) dev->dsa_ptr = NULL; dev->dsa_ptr->... RCU-protect the dsa_ptr and ajust the documentation where unsafe patterns were mentioned. The first patch has been compiled with ARCH=arm64 and allyesconfig against v6.11-rc6. Backported to v6.1 and tested on arm64 HW with LAN9303 switch (where the issue was initially reproduced), including LOCKDEP and PROVE_RCU. Therefore I will be able to provide v6.1 backport (for -stable purposes) and later v6.8 backport as well. Alexander Sverdlin (2): net: dsa: RCU-protect dsa_ptr in struct net_device docs: net: dsa: RCU protection of dsa_ptr in struct net_device Documentation/networking/dsa/dsa.rst | 18 ++-- drivers/net/dsa/mt7530.c | 3 +- drivers/net/dsa/ocelot/felix.c | 3 +- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +- drivers/net/ethernet/broadcom/bcmsysport.c | 8 +- drivers/net/ethernet/mediatek/airoha_eth.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++-- drivers/net/ethernet/mediatek/mtk_ppe.c | 15 ++- include/linux/netdevice.h | 2 +- include/net/dsa.h | 36 +++++-- include/net/dsa_stubs.h | 6 +- net/bridge/br_input.c | 2 +- net/core/dev.c | 3 +- net/core/flow_dissector.c | 19 ++-- net/dsa/conduit.c | 66 ++++++++----- net/dsa/dsa.c | 19 ++-- net/dsa/port.c | 3 +- net/dsa/tag.c | 3 +- net/dsa/tag.h | 19 ++-- net/dsa/tag_8021q.c | 10 +- net/dsa/tag_brcm.c | 2 +- net/dsa/tag_dsa.c | 8 +- net/dsa/tag_qca.c | 10 +- net/dsa/tag_sja1105.c | 22 +++-- net/dsa/user.c | 104 +++++++++++--------- net/ethernet/eth.c | 2 +- 26 files changed, 249 insertions(+), 161 deletions(-) -- 2.46.0