From: Kohei Enju <[email protected]> 
Sent: Sunday, August 31, 2025 10:33 PM

>The error path of ixgbe_recovery_probe() has two memory bugs.
>
>For non-E610 adapters, the function jumps to clean_up_probe without
>calling devlink_free(), leaking the devlink instance and its embedded
>adapter structure.
>
>For E610 adapters, devlink_free() is called at shutdown_aci, but
>clean_up_probe then accesses adapter->state, sometimes triggering
>use-after-free because adapter is embedded in devlink. This UAF is
>similar to the one recently reported in ixgbe_remove(). (Link)
>
>Fix both issues by moving devlink_free() after adapter->state access,
>aligning with the cleanup order in ixgbe_probe().
>
>Link: 
>https://lore.kernel.org/intel-wired-lan/[email protected]/
>Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
>Signed-off-by: Kohei Enju <[email protected]>
>---
>Cc: Koichiro Den <[email protected]>
>---
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 
>b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>index ff6e8ebda5ba..08368e2717c2 100644
>--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>@@ -11510,10 +11510,10 @@ static int ixgbe_recovery_probe(struct ixgbe_adapter 
>*adapter)
> shutdown_aci:
>       mutex_destroy(&adapter->hw.aci.lock);
>       ixgbe_release_hw_control(adapter);
>-      devlink_free(adapter->devlink);
> clean_up_probe:
>       disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
>       free_netdev(netdev);
>+      devlink_free(adapter->devlink);
>       pci_release_mem_regions(pdev);
>       if (disable_dev)
>               pci_disable_device(pdev);
>-- 
>2.51.0


Much thanks for finding and fixing it!

Reviewed-by: Jedrzej Jagielski <[email protected]>


Reply via email to