1. Patchew
  2. linux
  3. View series

[PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()

Koichiro Den posted 1 patch 1 month ago 
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
[PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Koichiro Den 1 month ago 
Since ixgbe_adapter is embedded in devlink, calling devlink_free()
prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
to the end.

KASAN report:

 BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
 Read of size 8 at addr ffff0000adf813e0 by task bash/2095
 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
 [...]
 Call trace:
  show_stack+0x30/0x90 (C)
  dump_stack_lvl+0x9c/0xd0
  print_address_description.constprop.0+0x90/0x310
  print_report+0x104/0x1f0
  kasan_report+0x88/0x180
  __asan_report_load8_noabort+0x20/0x30
  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
  pci_device_remove+0xa0/0x220
  device_remove+0xb8/0x170
  device_release_driver_internal+0x318/0x490
  device_driver_detach+0x40/0x68
  unbind_store+0xec/0x118
  drv_attr_store+0x64/0xb8
  sysfs_kf_write+0xcc/0x138
  kernfs_fop_write_iter+0x294/0x440
  new_sync_write+0x1fc/0x588
  vfs_write+0x480/0x6a0
  ksys_write+0xf0/0x1e0
  __arm64_sys_write+0x70/0xc0
  invoke_syscall.constprop.0+0xcc/0x280
  el0_svc_common.constprop.0+0xa8/0x248
  do_el0_svc+0x44/0x68
  el0_svc+0x54/0x160
  el0t_64_sync_handler+0xa0/0xe8
  el0t_64_sync+0x1b0/0x1b8

Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
Changes in v2:
- Move only devlink_free()
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 80e6a2ef1350..b3822c229300 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
 
 	devl_port_unregister(&adapter->devlink_port);
 	devl_unlock(adapter->devlink);
-	devlink_free(adapter->devlink);
 
 	ixgbe_stop_ipsec_offload(adapter);
 	ixgbe_clear_interrupt_scheme(adapter);
@@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
 
 	if (disable_dev)
 		pci_disable_device(pdev);
+
+	devlink_free(adapter->devlink);
 }
 
 /**
-- 
2.48.1
RE: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Rinitha, SX 2 weeks, 2 days ago 
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of Koichiro Den
> Sent: 02 September 2025 06:10
> To: intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch; Jagielski, Jedrzej <jedrzej.jagielski@intel.com>; mateusz.polchlopek@intel.com; netdev@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
>
> Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end.
>
> KASAN report:
>
> BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]  Read of size 8 at addr ffff0000adf813e0 by task bash/2095
> CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)  [...]  Call trace:
>  show_stack+0x30/0x90 (C)
>  dump_stack_lvl+0x9c/0xd0
>  print_address_description.constprop.0+0x90/0x310
>  print_report+0x104/0x1f0
>  kasan_report+0x88/0x180
>  __asan_report_load8_noabort+0x20/0x30
>  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
>  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
>  pci_device_remove+0xa0/0x220
>  device_remove+0xb8/0x170
> device_release_driver_internal+0x318/0x490
> device_driver_detach+0x40/0x68
>  unbind_store+0xec/0x118
>  drv_attr_store+0x64/0xb8
>  sysfs_kf_write+0xcc/0x138
>  kernfs_fop_write_iter+0x294/0x440
> new_sync_write+0x1fc/0x588
>  vfs_write+0x480/0x6a0
>  ksys_write+0xf0/0x1e0
>  __arm64_sys_write+0x70/0xc0
>  invoke_syscall.constprop.0+0xcc/0x280
>  el0_svc_common.constprop.0+0xa8/0x248
>  do_el0_svc+0x44/0x68
>  el0_svc+0x54/0x160
>  el0t_64_sync_handler+0xa0/0xe8
>  el0t_64_sync+0x1b0/0x1b8
>
> Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---
> Changes in v2:
> - Move only devlink_free()
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>

Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
RE: [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Jagielski, Jedrzej 1 month ago 
>From: Koichiro Den <den@valinux.co.jp> 
>Sent: Tuesday, September 2, 2025 2:40 AM
>
>Since ixgbe_adapter is embedded in devlink, calling devlink_free()
>prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
>to the end.
>
>KASAN report:
>
> BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
> Read of size 8 at addr ffff0000adf813e0 by task bash/2095
> CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
> [...]
> Call trace:
>  show_stack+0x30/0x90 (C)
>  dump_stack_lvl+0x9c/0xd0
>  print_address_description.constprop.0+0x90/0x310
>  print_report+0x104/0x1f0
>  kasan_report+0x88/0x180
>  __asan_report_load8_noabort+0x20/0x30
>  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
>  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
>  pci_device_remove+0xa0/0x220
>  device_remove+0xb8/0x170
>  device_release_driver_internal+0x318/0x490
>  device_driver_detach+0x40/0x68
>  unbind_store+0xec/0x118
>  drv_attr_store+0x64/0xb8
>  sysfs_kf_write+0xcc/0x138
>  kernfs_fop_write_iter+0x294/0x440
>  new_sync_write+0x1fc/0x588
>  vfs_write+0x480/0x6a0
>  ksys_write+0xf0/0x1e0
>  __arm64_sys_write+0x70/0xc0
>  invoke_syscall.constprop.0+0xcc/0x280
>  el0_svc_common.constprop.0+0xa8/0x248
>  do_el0_svc+0x44/0x68
>  el0_svc+0x54/0x160
>  el0t_64_sync_handler+0xa0/0xe8
>  el0t_64_sync+0x1b0/0x1b8
>
>Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
>Signed-off-by: Koichiro Den <den@valinux.co.jp>
>---
>Changes in v2:
>- Move only devlink_free()
>---
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>index 80e6a2ef1350..b3822c229300 100644
>--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>@@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
> 
> 	devl_port_unregister(&adapter->devlink_port);
> 	devl_unlock(adapter->devlink);
>-	devlink_free(adapter->devlink);
> 
> 	ixgbe_stop_ipsec_offload(adapter);
> 	ixgbe_clear_interrupt_scheme(adapter);
>@@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
> 
> 	if (disable_dev)
> 		pci_disable_device(pdev);
>+
>+	devlink_free(adapter->devlink);
> }
> 
> /**
>-- 
>2.48.1

Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
RE: [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Loktionov, Aleksandr 1 month ago 

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Jagielski, Jedrzej
> Sent: Tuesday, September 2, 2025 9:45 AM
> To: Koichiro Den <den@valinux.co.jp>; intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> mateusz.polchlopek@intel.com; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org
> Subject: Re: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early
> devlink_free() in ixgbe_remove()
> 
> >From: Koichiro Den <den@valinux.co.jp>
> >Sent: Tuesday, September 2, 2025 2:40 AM
> >
> >Since ixgbe_adapter is embedded in devlink, calling devlink_free()
> >prematurely in the ixgbe_remove() path can lead to UAF. Move
> >devlink_free() to the end.
> >
> >KASAN report:
> >
> > BUG: KASAN: use-after-free in
> > ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8
> at
> > addr ffff0000adf813e0 by task bash/2095
> > CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S
> > 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace:
> >  show_stack+0x30/0x90 (C)
> >  dump_stack_lvl+0x9c/0xd0
> >  print_address_description.constprop.0+0x90/0x310
> >  print_report+0x104/0x1f0
> >  kasan_report+0x88/0x180
> >  __asan_report_load8_noabort+0x20/0x30
> >  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
> >  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
> >  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
> >  pci_device_remove+0xa0/0x220
> >  device_remove+0xb8/0x170
> >  device_release_driver_internal+0x318/0x490
> >  device_driver_detach+0x40/0x68
> >  unbind_store+0xec/0x118
> >  drv_attr_store+0x64/0xb8
> >  sysfs_kf_write+0xcc/0x138
> >  kernfs_fop_write_iter+0x294/0x440
> >  new_sync_write+0x1fc/0x588
> >  vfs_write+0x480/0x6a0
> >  ksys_write+0xf0/0x1e0
> >  __arm64_sys_write+0x70/0xc0
> >  invoke_syscall.constprop.0+0xcc/0x280
> >  el0_svc_common.constprop.0+0xa8/0x248
> >  do_el0_svc+0x44/0x68
> >  el0_svc+0x54/0x160
> >  el0t_64_sync_handler+0xa0/0xe8
> >  el0t_64_sync+0x1b0/0x1b8
> >
> >Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
> >Signed-off-by: Koichiro Den <den@valinux.co.jp>
> >---
> >Changes in v2:
> >- Move only devlink_free()
> >---
> > drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> >diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> >b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> >index 80e6a2ef1350..b3822c229300 100644
> >--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> >+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> >@@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev
> *pdev)
> >
> > 	devl_port_unregister(&adapter->devlink_port);
> > 	devl_unlock(adapter->devlink);
> >-	devlink_free(adapter->devlink);
> >
> > 	ixgbe_stop_ipsec_offload(adapter);
> > 	ixgbe_clear_interrupt_scheme(adapter);
> >@@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev
> *pdev)
> >
> > 	if (disable_dev)
> > 		pci_disable_device(pdev);
> >+
> >+	devlink_free(adapter->devlink);
> > }
> >
> > /**
> >--
> >2.48.1
> 
> Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
RE: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Loktionov, Aleksandr 1 month ago 

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Koichiro Den
> Sent: Tuesday, September 2, 2025 2:40 AM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> Jagielski, Jedrzej <jedrzej.jagielski@intel.com>;
> mateusz.polchlopek@intel.com; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early
> devlink_free() in ixgbe_remove()
> 
> Since ixgbe_adapter is embedded in devlink, calling devlink_free()
> prematurely in the ixgbe_remove() path can lead to UAF. Move
> devlink_free() to the end.
> 
> KASAN report:
> 
>  BUG: KASAN: use-after-free in
> ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]  Read of size 8
> at addr ffff0000adf813e0 by task bash/2095
>  CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-
> tnguy.net-queue+ #1 PREEMPT(full)  [...]  Call trace:
>   show_stack+0x30/0x90 (C)
>   dump_stack_lvl+0x9c/0xd0
>   print_address_description.constprop.0+0x90/0x310
>   print_report+0x104/0x1f0
>   kasan_report+0x88/0x180
>   __asan_report_load8_noabort+0x20/0x30
>   ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>   ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
>   ixgbe_remove+0x2d0/0x8c0 [ixgbe]
>   pci_device_remove+0xa0/0x220
>   device_remove+0xb8/0x170
>   device_release_driver_internal+0x318/0x490
>   device_driver_detach+0x40/0x68
>   unbind_store+0xec/0x118
>   drv_attr_store+0x64/0xb8
>   sysfs_kf_write+0xcc/0x138
>   kernfs_fop_write_iter+0x294/0x440
>   new_sync_write+0x1fc/0x588
>   vfs_write+0x480/0x6a0
>   ksys_write+0xf0/0x1e0
>   __arm64_sys_write+0x70/0xc0
>   invoke_syscall.constprop.0+0xcc/0x280
>   el0_svc_common.constprop.0+0xa8/0x248
>   do_el0_svc+0x44/0x68
>   el0_svc+0x54/0x160
>   el0t_64_sync_handler+0xa0/0xe8
>   el0t_64_sync+0x1b0/0x1b8
> 
> Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>



> ---
> Changes in v2:
> - Move only devlink_free()
> ---
>  drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index 80e6a2ef1350..b3822c229300 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
> 
>  	devl_port_unregister(&adapter->devlink_port);
>  	devl_unlock(adapter->devlink);
> -	devlink_free(adapter->devlink);
> 
>  	ixgbe_stop_ipsec_offload(adapter);
>  	ixgbe_clear_interrupt_scheme(adapter);
> @@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
> 
>  	if (disable_dev)
>  		pci_disable_device(pdev);
> +
> +	devlink_free(adapter->devlink);
>  }
> 
>  /**
> --
> 2.48.1
Re: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Paul Menzel 1 month ago 
Dear Koichiro,


Thank you for your patch.

Am 02.09.25 um 02:39 schrieb Koichiro Den:
> Since ixgbe_adapter is embedded in devlink, calling devlink_free()
> prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
> to the end.
> 
> KASAN report:
> 
>   BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>   Read of size 8 at addr ffff0000adf813e0 by task bash/2095
>   CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
>   [...]
>   Call trace:
>    show_stack+0x30/0x90 (C)
>    dump_stack_lvl+0x9c/0xd0
>    print_address_description.constprop.0+0x90/0x310
>    print_report+0x104/0x1f0
>    kasan_report+0x88/0x180
>    __asan_report_load8_noabort+0x20/0x30
>    ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>    ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
>    ixgbe_remove+0x2d0/0x8c0 [ixgbe]
>    pci_device_remove+0xa0/0x220
>    device_remove+0xb8/0x170
>    device_release_driver_internal+0x318/0x490
>    device_driver_detach+0x40/0x68
>    unbind_store+0xec/0x118
>    drv_attr_store+0x64/0xb8
>    sysfs_kf_write+0xcc/0x138
>    kernfs_fop_write_iter+0x294/0x440
>    new_sync_write+0x1fc/0x588
>    vfs_write+0x480/0x6a0
>    ksys_write+0xf0/0x1e0
>    __arm64_sys_write+0x70/0xc0
>    invoke_syscall.constprop.0+0xcc/0x280
>    el0_svc_common.constprop.0+0xa8/0x248
>    do_el0_svc+0x44/0x68
>    el0_svc+0x54/0x160
>    el0t_64_sync_handler+0xa0/0xe8
>    el0t_64_sync+0x1b0/0x1b8
> 
> Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---
> Changes in v2:
> - Move only devlink_free()
> ---
>   drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index 80e6a2ef1350..b3822c229300 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
>   
>   	devl_port_unregister(&adapter->devlink_port);
>   	devl_unlock(adapter->devlink);
> -	devlink_free(adapter->devlink);
>   
>   	ixgbe_stop_ipsec_offload(adapter);
>   	ixgbe_clear_interrupt_scheme(adapter);
> @@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
>   
>   	if (disable_dev)
>   		pci_disable_device(pdev);
> +
> +	devlink_free(adapter->devlink);
>   }
>   
>   /**

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul
Re: [Intel-wired-lan] [PATCH v2] ixgbe: fix too early devlink_free() in ixgbe_remove()
Posted by Paul Menzel 1 month ago 
[Cc: Remove mateusz.polchlopek@intel.com (address rejected)]

Am 02.09.25 um 07:08 schrieb Paul Menzel:
> Dear Koichiro,
> 
> 
> Thank you for your patch.
> 
> Am 02.09.25 um 02:39 schrieb Koichiro Den:
>> Since ixgbe_adapter is embedded in devlink, calling devlink_free()
>> prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
>> to the end.
>>
>> KASAN report:
>>
>>   BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>>   Read of size 8 at addr ffff0000adf813e0 by task bash/2095
>>   CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
>>   [...]
>>   Call trace:
>>    show_stack+0x30/0x90 (C)
>>    dump_stack_lvl+0x9c/0xd0
>>    print_address_description.constprop.0+0x90/0x310
>>    print_report+0x104/0x1f0
>>    kasan_report+0x88/0x180
>>    __asan_report_load8_noabort+0x20/0x30
>>    ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
>>    ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
>>    ixgbe_remove+0x2d0/0x8c0 [ixgbe]
>>    pci_device_remove+0xa0/0x220
>>    device_remove+0xb8/0x170
>>    device_release_driver_internal+0x318/0x490
>>    device_driver_detach+0x40/0x68
>>    unbind_store+0xec/0x118
>>    drv_attr_store+0x64/0xb8
>>    sysfs_kf_write+0xcc/0x138
>>    kernfs_fop_write_iter+0x294/0x440
>>    new_sync_write+0x1fc/0x588
>>    vfs_write+0x480/0x6a0
>>    ksys_write+0xf0/0x1e0
>>    __arm64_sys_write+0x70/0xc0
>>    invoke_syscall.constprop.0+0xcc/0x280
>>    el0_svc_common.constprop.0+0xa8/0x248
>>    do_el0_svc+0x44/0x68
>>    el0_svc+0x54/0x160
>>    el0t_64_sync_handler+0xa0/0xe8
>>    el0t_64_sync+0x1b0/0x1b8
>>
>> Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
>> Signed-off-by: Koichiro Den <den@valinux.co.jp>
>> ---
>> Changes in v2:
>> - Move only devlink_free()
>> ---
>>   drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/ 
>> net/ethernet/intel/ixgbe/ixgbe_main.c
>> index 80e6a2ef1350..b3822c229300 100644
>> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> @@ -12092,7 +12092,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
>>       devl_port_unregister(&adapter->devlink_port);
>>       devl_unlock(adapter->devlink);
>> -    devlink_free(adapter->devlink);
>>       ixgbe_stop_ipsec_offload(adapter);
>>       ixgbe_clear_interrupt_scheme(adapter);
>> @@ -12125,6 +12124,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
>>       if (disable_dev)
>>           pci_disable_device(pdev);
>> +
>> +    devlink_free(adapter->devlink);
>>   }
>>   /**
> 
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
> 
> 
> Kind regards,
> 
> Paul

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.