From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D6CE35FF6E for ; Mon, 13 Apr 2026 18:24:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104690; cv=none; b=BVewNIJicikfGQmtoib14V8uzDczY/dkFdnp7zBCUW2SJfxDi7ZwQDqSP8wCblIxxupnJGPpGCVbDU8kBilC92UDWkcA3/p4DDSaMpp5A66cZ+4BeOKCyCYEcK9g8hUftebLIgwQWo8bKkOIuUo4oTjU/sI4lgu1rhuvbCkovcc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104690; c=relaxed/simple; bh=WX+GbDCQnemIbX75B+YiYyahJQmX7jQXWaQHRJtE22g=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=JbW/snanW6Qkw9S9qvdB0UwSnpCtpFyYCBxxXJC34Ow6KCdPXwSaeQa0HkVxzeo74ARcOntCDSediylDKKkEUhOGl3aU/58h/5xoWma2oKysCArDU2wHboF9LFTdFT99zh9/1mwIzilh2Bj+lGqPqSPH1vOnTHj1lJWstDmu+AE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oerwcTa9; arc=none smtp.client-ip=209.85.219.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oerwcTa9" Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-8aca6bd57cfso18256676d6.0 for ; Mon, 13 Apr 2026 11:24:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776104688; x=1776709488; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pwuEhADy0804om/OdHEIRZ/J1D9Tqo21sy7eI3dqC5M=; b=oerwcTa9ieG1OFUB7FyjG6puCmp+rUhPWSY2P9RJIR80DQy4olguP0QSFpzGjw3yEW 4s3l9w6/psQwdzXLeIZNv8On2mSK89g03NK5htrp7tqYPfVYEb6ntBGAsHFJyaJOrCXI fSxwSqosGzTs+qbDrTb5MFqgYPNmCdIAz4lB1Va6Jzzrju7g/t5Hu5fCcNkNMGwNApa2 LsvviMh0nUduvQakttLcIviqYmBjkXwuJMnC+s57pr0qE6y1itXEuk7TPs55iFAyOQqT ivKjBXK6eD3KO1pK/tUKiddiTgXsplHTX0iEU4OCDRM6011FkiSLw6kzts3d6XmYwKA8 hXEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776104688; x=1776709488; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pwuEhADy0804om/OdHEIRZ/J1D9Tqo21sy7eI3dqC5M=; b=tISObaa4kV88I997s3sO7z5DTtq+o3/wwZJLdOmuWf3W11aYhOZhPHMGw2NbWu1gBh uCzZHL+8OsgxNSfwmXbOAEwK1khldDnmR8GpmSKXUd7N1qQ+2e5wjtQ8W53q/jeojFYX 7AOaQGPwxIDC2Rt4dKrfDXS32HrK3Y1Fay7ljIjopuZYBjj9uRs32h5wtfheSCullioc lSOs0Z6Flo0GKc/POFm7yPTcIwdqk/9rKXZSLwrEEDGxXAstRsfFadC/c3VPeZKq3EiS KzBImXyDwSgKytRj76HSPmODxS9qdZ/L0zSfWeqWQDkp5vcZ0rmQqpdejA0mbAKXI4BI Kb9g== X-Forwarded-Encrypted: i=1; AFNElJ82lWPO+x40zJDaEyzFqLrF5ijKNKUl3O716dWwZhrdm9YlwO4c06/aM4OO8KqX6L/DStyDqawF87DWz88=@vger.kernel.org X-Gm-Message-State: AOJu0YyFh2aggEvDbM8Iz3+uXDcsakctxSUSB9Svk4MPV4fN2xMsUGHC +qs6EWHF2UOnEyu+sRiv9KzfoH6B1sp3KhteilglPiqvffj1SG7Iy314 X-Gm-Gg: AeBDietfxVSG/WUo+y/qXhd+yItvINCq3r1LY7KxIxuncYQs3D3E3IM5gIcx3ZPZg76 GHdMKHBe6wmczsWYVnjhQqwALsVAEG7WuU6ksTAGMtC+ukXd9K7u3tMxcD6IF8bPKZDqEcycmNO PNhCPGg936RjOIU/bTE8noJeHXYtcASs8VMrPRSheaRtAPrr77lfY7hBRWI4NYDKSDBvVd5h0oz FCwRQXL/DnhuW28Ieh9K9KNz5SXwRxJoWwBWbb5mMijrpXZqh/NbWPQld244ZISyKxPsTMAgBhm BHl1TTmrmi9FNHjgTGL19fboX1PhPgG14aJlHfdUU9Br6rF3WWLy/ex3OkT/v4q+JoGAmEBZV1H JF1uulI69z4HXAo4EZVBEw9LkKEZyw3RYxhOp66i3dATFvA6auZAXqJf2/ELvQ4fyKRDLNxFT/S dEEaHm7UpZJgQkscRMZAA2UI7C8XDt0+SYAKhuEUw3kN6Kuk7gfdHF+P3EJyoaXfi2TZ2tl/UhD 31/x7JO59k2YVLU73M7 X-Received: by 2002:a05:6214:4c8f:b0:89c:6451:67ac with SMTP id 6a1803df08f44-8ac8617fc04mr206413246d6.12.1776104687285; Mon, 13 Apr 2026 11:24:47 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ac84a47a0dsm103210326d6.22.2026.04.13.11.24.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 11:24:46 -0700 (PDT) From: Michael Bommarito To: intel-wired-lan@lists.osuosl.org Cc: "Tony Nguyen" , "Przemek Kitszel" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , netdev@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Bommarito Subject: [PATCH net] ixgbevf: fix use-after-free in VEPA multicast source pruning Date: Mon, 13 Apr 2026 14:24:27 -0400 Message-ID: <20260413182427.298513-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags — a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible. Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito --- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c index 42f89a179a3f..4ba3be961ab6 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c @@ -1221,6 +1221,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, ether_addr_equal(rx_ring->netdev->dev_addr, eth_hdr(skb)->h_source)) { dev_kfree_skb_irq(skb); + skb = NULL; continue; } -- 2.53.0