Re: [PATCH net v2] net: mlx5e: Fix use-after-free of the MACsec xarray entry on RX SC deletion

[sashiko-bot@kernel.org]

> In macsec_del_rxsc_ctx(), the RX secure channel is torn down with:
> 
> 	list_del_rcu(&rx_sc->rx_sc_list_element);
> 	xa_erase(&macsec->sc_xarray, rx_sc->sc_xarray_element->fs_id);
> 	dst_release(&rx_sc->md_dst->dst);
> 	kfree(rx_sc->sc_xarray_element);
> 	kfree_rcu_mightsleep(rx_sc);
> 
> The comment above the sequence claims that "xa_erase which uses rcu to
> sync" hides the RX SC from the data path, but this is not sufficient:
> the RCU protection of xarray covers only its internal nodes (making
> xa_load() safe against concurrent erase); it does not extend to the
> object pointed to by the entry value.  A reader that has already
> obtained the pointer from xa_load() is not covered by any grace period,
> and the bare kfree() releases the entry object immediately.
> [ ... ]
> confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
> not observed at runtime; it is identified by code inspection only.
> 
> Fixes: b7c9400cbc48 ("net/mlx5e: Implement MACsec Rx data path using MACsec skb_metadata_dst")
> Signed-off-by: Binbin Deng <18983559317@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010032115.93545-1-18983559317@163.com?part=1