Re: [PATCH RESEND v4 net-next 14/14] net: enetc: use kzalloc_flex() for enetc_psfp_gate allocation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] List modifications in enetc_psfp_destroy_clsflower lack spinlock protection, leading to race conditions and potential Use-After-Free.
--

--- Patch [14]: [PATCH RESEND v4 net-next 14/14] net: enetc: use kzalloc_flex() for enetc_psfp_gate allocation ---
commit ac1613be27ea215665e4d0f49e1b480f054aa27f
Author: Wei Fang <wei.fang@nxp.com>

net: enetc: use kzalloc_flex() for enetc_psfp_gate allocation

This commit replaces the open-coded struct_size() + kzalloc() pattern with
the kzalloc_flex() helper when allocating struct enetc_psfp_gate. This
removes the intermediate entries_size local variable.

> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
> index 7b17bca24f260..2aa0fcaafcd23 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c

[ ... ]

> @@ -1242,8 +1241,7 @@ static int enetc_psfp_parse_clsflower(struct enetc_ndev_priv *priv,
>  		goto free_filter;
>  	}
>  
> -	entries_size = struct_size(sgi, entries, entryg->gate.num_entries);
> -	sgi = kzalloc(entries_size, GFP_KERNEL);
> +	sgi = kzalloc_flex(*sgi, entries, entryg->gate.num_entries);

[Severity: High]
This is a pre-existing issue, but is it possible for concurrent TC commands
to cause a use-after-free with the shared epsfp lists?

In enetc_psfp_destroy_clsflower(), remove_one_chain() is called:

    remove_one_chain(priv, filter);

This executes hlist_del(&filter->node) and kfree(filter) on the globally
shared epsfp.stream_list without acquiring epsfp.psfp_lock.

Concurrently, enetc_psfp_get_stats() iterates this list locklessly:

    filter = enetc_get_stream_by_index(f->common.chain_index);

If a user issues "tc -s filter show" concurrently with "tc filter del",
could the lockless iteration in enetc_psfp_get_stats() access the filter
freed by remove_one_chain(), leading to memory corruption?

Additionally, does the unlocked deletion race with locked insertions in
enetc_psfp_parse_clsflower() causing list corruption?

>  	if (!sgi) {
>  		err = -ENOMEM;
>  		goto free_filter;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720014317.1059359-1-wei.fang@oss.nxp.com?part=14