[PATCH v1] octeontx2: Fix use-after-free of qos node in delete path

[PATCH v1] octeontx2: Fix use-after-free of qos node in delete path

[Binbin Deng]

hash_del_rcu() only unlinks the node; a reader that already holds the
bucket iterator still uses the node.  The immediate kfree() has no
grace period, so a concurrent transmit on a socket whose skb priority
carries the deleted classid reads node->classid / node->qid from freed
memory (use-after-free in the softirq transmit path).

Fix this by calling synchronize_net() before the node is freed, as
mlx5e does.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
not observed at runtime; it is identified by code inspection only.

Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload")
Signed-off-by: Binbin Deng <18983559317@163.com>
---
 drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c
index f160b1618efa..2ede0b84e5f5 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c
@@ -331,6 +331,8 @@ static void otx2_qos_sw_node_delete(struct otx2_nic *pfvf,
 		otx2_qos_update_tx_netdev_queues(pfvf);
 	}
 
+	synchronize_net();
+
 	list_del(&node->list);
 	kfree(node);
 }
-- 
2.43.0

Re: [PATCH v1] octeontx2: Fix use-after-free of qos node in delete path

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH v1] octeontx2: Fix use-after-free of qos node in delete path

[Ratheesh Kannoth]

On 2026-10-14 at 12:12:04, Binbin Deng (18983559317@163.com) wrote:
> hash_del_rcu() only unlinks the node; a reader that already holds the
> bucket iterator still uses the node.  The immediate kfree() has no
> grace period, so a concurrent transmit on a socket whose skb priority
> carries the deleted classid reads node->classid / node->qid from freed
> memory (use-after-free in the softirq transmit path).
>
> Fix this by calling synchronize_net() before the node is freed, as
> mlx5e does.
>
> Found during a static-analysis-assisted audit: candidate sites were
> surfaced by a Coccinelle rule, and the reader/writer paths were
> confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
> not observed at runtime; it is identified by code inspection only.
>
> Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload")
> Signed-off-by: Binbin Deng <18983559317@163.com>

Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com>

Re: [PATCH v1] octeontx2: Fix use-after-free of qos node in delete path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 14 Oct 2026 14:42:04 +0800 you wrote:
> hash_del_rcu() only unlinks the node; a reader that already holds the
> bucket iterator still uses the node.  The immediate kfree() has no
> grace period, so a concurrent transmit on a socket whose skb priority
> carries the deleted classid reads node->classid / node->qid from freed
> memory (use-after-free in the softirq transmit path).
> 
> Fix this by calling synchronize_net() before the node is freed, as
> mlx5e does.
> 
> [...]

Here is the summary with links:
  - [v1] octeontx2: Fix use-after-free of qos node in delete path
    https://git.kernel.org/netdev/net-next/c/dcaa62196489

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html