From nobody Thu Oct 2 11:52:37 2025 Received: from zg8tmja5ljk3lje4mi4ymjia.icoremail.net (zg8tmja5ljk3lje4mi4ymjia.icoremail.net [209.97.182.222]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1172539FCE; Wed, 17 Sep 2025 05:46:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.97.182.222 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758087996; cv=none; b=XZteDee/llt/Q/2tcj6hr5HR/uMtHN2Y65TaJnlY9AEZW1+vzzkQv4sFnlIy+zlvJqXZQyMOaTzfL5ykEgxdZjtVYaoA4LXI87KpXLNXLJptTupfBcoUGAZ5uGCwZya+w8ScFxTTXtpo3KdlUCmoVY1sAJTN1fFwIh93BdWXZew= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758087996; c=relaxed/simple; bh=2f19mQav6gwzMIg6V1nSP79ryNXoYeYfagKKlybhPSE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type; b=W4vAWfau886CbnIt6VybftJINy9OIPdjMrc6yukK3swMGKMdvnDbgm5MNjbbznOJQBwXJyeZPiS1koPOKio/dcZlD2iBFTj06lcc0NvjqZ+mHxHSBLlUJiUCHC7bkRZk3BoGkbBZmn59ltTTUKp+q9zLVf2+iwMsSw3tci8ON60= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=209.97.182.222 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [106.117.98.100]) by mtasvr (Coremail) with SMTP id _____wDnoewfS8poC6JCAg--.2647S3; Wed, 17 Sep 2025 13:46:08 +0800 (CST) Received: from ubuntu.localdomain (unknown [106.117.98.100]) by mail-app4 (Coremail) with SMTP id zi_KCgC3TYMcS8poA53oAQ--.17850S2; Wed, 17 Sep 2025 13:46:06 +0800 (CST) From: Duoming Zhou To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, pabeni@redhat.com, kuba@kernel.org, edumazet@google.com, davem@davemloft.net, andrew+netdev@lunn.ch, Duoming Zhou Subject: [PATCH v3 net] cnic: Fix use-after-free bugs in cnic_delete_task Date: Wed, 17 Sep 2025 13:46:02 +0800 Message-Id: <20250917054602.16457-1-duoming@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgC3TYMcS8poA53oAQ--.17850S2 X-CM-SenderInfo: qssqjiasttq6lmxovvfxof0/1tbiAwQMAWjJvXsG9gAHsa X-CM-DELIVERINFO: =?B?qNoS9wXKKxbFmtjJiESix3B1w3uoVhYI+vyen2ZzBEkOnu5chDpkB+ZdGnv/zQ0PbP CR131FE3wBtlILXmPZxD8pDyDF6auOnSUBe/Otpe715s37l1u0dpkuwlm+i5YvY82xOPTB XevXbOfKwvDIw1MoGswrnuIdOBCKa07kOFutN/OoK9AMAT+3mukI9oR5gRN+Mw== X-Coremail-Antispam: 1Uk129KBj93XoWxGw13WFyrAr1xZw4UJr1UArc_yoW5CryUpr W5Ga4UJa97Jr13twsrXr48XFn09ayvy34UGr4fJws5Z3s0qF15Kry8KFWfua4UCrZ5ZF1x Zrs8ZFZxZF90kFXCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUUvmb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc804VCY07AIYIkI8VC2zVCFFI0UMc 02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAF wI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y48IcxkI7V AKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I 3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxV WUtVW8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8I cVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aV AFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZE Xa7IU801v3UUUUU== The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev =3D cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays =E2=80=94 such as inserting calls to ssleep() within the cnic_delete_task() function =E2=80=94 to increase the likelihood of triggering the bug. Fixes: fdf24086f475 ("cnic: Defer iscsi connection cleanup") Signed-off-by: Duoming Zhou --- Changes in v3: - Add how I discovered and tested the patch in the commit message. - Remove flush_workqueue() in cnic_cm_stop_bnx2x_hw(). drivers/net/ethernet/broadcom/cnic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/br= oadcom/cnic.c index a9040c42d2ff..6e97a5a7daaf 100644 --- a/drivers/net/ethernet/broadcom/cnic.c +++ b/drivers/net/ethernet/broadcom/cnic.c @@ -4230,8 +4230,7 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *de= v) =20 cnic_bnx2x_delete_wait(dev, 0); =20 - cancel_delayed_work(&cp->delete_task); - flush_workqueue(cnic_wq); + cancel_delayed_work_sync(&cp->delete_task); =20 if (atomic_read(&cp->iscsi_conn) !=3D 0) netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n", --=20 2.34.1