Re: [PATCH net] net/mlx5e: rep, Fix races between devcom PAIR event and uplink close

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net/mlx5e: bypassed devcom lock in stop path leaves UAF race unmitigated
--

commit a1ed4eff90a08173eecbfbc7850c1594a36291d8
Author: Shay Drory <shayd@nvidia.com>

net/mlx5e: rep, Fix races between devcom PAIR event and uplink close

This commit attempts to fix a use-after-free race between the devcom PAIR
event and uplink close by protecting the teardown path with the devcom read
semaphore.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> index 88a170e40bd93..7211faaffd8d3 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> @@ -629,8 +629,12 @@ mlx5e_remove_sqs_fwd_rules(struct mlx5e_priv *priv)
>  	struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
>  	struct mlx5e_rep_priv *rpriv = priv->ppriv;
>  	struct mlx5_eswitch_rep *rep = rpriv->rep;
> +	bool devcom_locked;
>  
> +	devcom_locked = mlx5_devcom_for_each_peer_begin(esw->devcom);
>  	mlx5e_sqs2vport_stop(esw, rep);

[Severity: High]
If mlx5_devcom_for_each_peer_begin() returns false because the devcom is not
yet marked ready, it drops the read semaphore before returning:

drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c:
mlx5_devcom_for_each_peer_begin() {
	...
	if (!READ_ONCE(comp->ready)) {
		up_read(&comp->sem);
		return false;
	}
	...
}

In that case, devcom_locked will be false, but mlx5e_sqs2vport_stop() is
still executed without holding the devcom read semaphore.

Does this leave the list modifications in mlx5e_sqs2vport_stop() unprotected
against a concurrent devcom PAIR event, potentially leading to the same
use-after-free regression on rep_sq objects that this patch was intended to
resolve?

> +	if (devcom_locked)
> +		mlx5_devcom_for_each_peer_end(esw->devcom);
>  }
>  
>  static int

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015085744.1109107-1-tariqt@nvidia.com?part=1