On Mon, Sep 01, 2025 at 07:53:54AM +0000, Jagielski, Jedrzej wrote: > From: Koichiro Den <[email protected]> > Sent: Thursday, August 28, 2025 4:06 AM > > >Since ixgbe_adapter is embedded in devlink, calling devlink_free() > >prematurely in the ixgbe_remove() path can sometimes lead to UAF. > > > >Move the devlink cleanup steps to the end. KASAN report: > > > > BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 > > [ixgbe] > > Read of size 8 at addr ffff0000adf813e0 by task bash/2095 > > CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S > > 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) > > [...] > > Call trace: > > show_stack+0x30/0x90 (C) > > dump_stack_lvl+0x9c/0xd0 > > print_address_description.constprop.0+0x90/0x310 > > print_report+0x104/0x1f0 > > kasan_report+0x88/0x180 > > __asan_report_load8_noabort+0x20/0x30 > > ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] > > ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] > > ixgbe_remove+0x2d0/0x8c0 [ixgbe] > > pci_device_remove+0xa0/0x220 > > device_remove+0xb8/0x170 > > device_release_driver_internal+0x318/0x490 > > device_driver_detach+0x40/0x68 > > unbind_store+0xec/0x118 > > drv_attr_store+0x64/0xb8 > > sysfs_kf_write+0xcc/0x138 > > kernfs_fop_write_iter+0x294/0x440 > > new_sync_write+0x1fc/0x588 > > vfs_write+0x480/0x6a0 > > ksys_write+0xf0/0x1e0 > > __arm64_sys_write+0x70/0xc0 > > invoke_syscall.constprop.0+0xcc/0x280 > > el0_svc_common.constprop.0+0xa8/0x248 > > do_el0_svc+0x44/0x68 > > el0_svc+0x54/0x160 > > el0t_64_sync_handler+0xa0/0xe8 > > el0t_64_sync+0x1b0/0x1b8 > > > >Fixes: a0285236ab93 ("ixgbe: add initial devlink support") > >Signed-off-by: Koichiro Den <[email protected]> > >--- > > drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++---- > > 1 file changed, 4 insertions(+), 4 deletions(-) > > > >diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > >b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > >index 80e6a2ef1350..2b1f3104164c 100644 > >--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > >+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > >@@ -12090,10 +12090,6 @@ static void ixgbe_remove(struct pci_dev *pdev) > > if (netdev->reg_state == NETREG_REGISTERED) > > unregister_netdev(netdev); > > > >- devl_port_unregister(&adapter->devlink_port); > >- devl_unlock(adapter->devlink); > >- devlink_free(adapter->devlink); > >- > > ixgbe_stop_ipsec_offload(adapter); > > ixgbe_clear_interrupt_scheme(adapter); > > > >@@ -12125,6 +12121,10 @@ static void ixgbe_remove(struct pci_dev *pdev) > > > > if (disable_dev) > > pci_disable_device(pdev); > >+ > >+ devl_port_unregister(&adapter->devlink_port); > >+ devl_unlock(adapter->devlink); > >+ devlink_free(adapter->devlink); > > Thanks for finding and fixing! > I'm fine with putting devlink_free at the very end of ixgbe_remove, > but wouldn't be moving only devlink_free enough?
Thanks for the review. You're right, let me send v2 shortly. -Koichiro > > > > } > > > > /** > >-- > >2.48.1 >
