From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.178 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792858894; b=YQCuxKFcDZs/o/15R62qHsej9ckhDkTubfkGePOGhlQE4PQc/J7SLzV8G4SoNaLxOEd1 SJPqXYTJCtcOUa6+tMibxTPrTbuLj3x/JT2A5fbIz7pwDBM59uLcjqFsS3+Al5gSKsADp Nkx+d5JlUm1loUd964xdhzdqoADXMdTnh7cybMMAmXhZOkkABEDoTlK3Dn4cv6aXyvoqe KpBveMIibjViiYE6tlcbrjab5dRhZBxJHODpFuDA3RvlgncLtn32upk9Kt3/FiegrPG29 VzniAVBSWkzAJnhRxXYBDApKkacEidFJJ5fguRjJtDQu2VgrbRWp7odnyIeovX+LMUw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792858894; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; bh=F6yz0j17ZlA2N3jpWRgDpMHKo6hhIh1hOz7KuS7dRpI=; b=ohovgw9qvbsFfbzQzp9oNGqaMt/L/vuiQQCJuHT0ca7otwp+DVWfIUXJQawp0iLtWgrd Z39sKS40fi88BY2LjtuofF0SjM40buen2WY2dtEXqb+mTy5Nzxv7QM57af6LYfQTIRYHY Ht7TawDbyam8qJcISug+1d8reRILUd87rO85fPd5WdH+Ncy/R5+MbKoEiiU5vY9r23xb6 BmD2BMiYmZA0UXd6Ftx+reQcH8lTOK9IRtqXKOR2irue+++JPvt615VIlJMAc1eiZV/ae 1YVoSqubgggUAoUSmkrDy9bFadSzvNqxAlTFlWevG2VaDgDHV6V84HEHimk07X/nH+Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=BXiZ4od0; arc=none smtp.remote-ip=74.125.82.178 Received: from mail-dy1-f178.google.com (mail-dy1-f178.google.com [74.125.82.178]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8AA4606A31E for ; Sat, 24 Oct 2026 16:21:33 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org B8AA4606A31E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=BXiZ4od0 Received: by mail-dy1-f178.google.com with SMTP id 5a478bee46e88-369f3e9e431so45357eec.1 for ; Sat, 24 Oct 2026 09:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792858893; x=1793463693; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:content-type:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=F6yz0j17ZlA2N3jpWRgDpMHKo6hhIh1hOz7KuS7dRpI=; b=BXiZ4od0QPRwbJ1HEHXEZYLtBvs7l27b1YDBlLvDljIyAU63OB2ocpUGaqbitr2UE8 U9e0mn5TdgBq7v01NRToS0bUYeZ3PR3hro5KVsLTqXLkuMfKNDMLsfC5VCIXUVxpacZE 9PzBO2uJItxIj8DK0OUoHfDnoCp6yABJB9gzY+MA0D+HUlLt1hHSk9AafZcJYU3oRQGo YMaDEe7nTEcdJ7kVLy6iwzRB5F/wq+tlPyySqeVVfjk3SK72yGCggtnuaG7vlqNCkwd2 31YuO5ewL3hZuVXK8W+asKZG8KXhBVQETyfuXpXib73rIXukDf7u3E3lCfBWljhb6hfG kRBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792858893; x=1793463693; h=mime-version:content-transfer-encoding:content-type:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=F6yz0j17ZlA2N3jpWRgDpMHKo6hhIh1hOz7KuS7dRpI=; b=X5WZQFIQ7w2IxsmsgsH3J8IYx9kwBcLo77t/VJO/yGebBEF27cD0LVsXH4yV62x58c 3powAr1WKfynwnBU6F3MMdcB9QKtQByC0ZuvMl3s8HDJoub1Y3+LCAdjPg1DOpJrUVEV l04Nwf5xVRgCqiUPeVN5PjV3f6MhoOUknQjV4M5el3zIshK3nYW00jXLi7FoU4AHcyuT O/w5ET5FmbthrhdEkqFtiWtu5szW/9vsENs55J+4QxzZCVLRmPrBB0UpjLmfXIFx3d/5 qKmfmPr2c4wozgQdrQzWTNXUJp5TkIWHxDiYKzXQfLMeTDfFulwBKqaspDXMbWJy1c9q Z42g== X-Forwarded-Encrypted: i=1; AKwUvBw89peEHeVO94FlRj2l6gH3yY6LruS1FZzfZ17JiSHSdbHuHIXuZ6QSsBxh8rU4WW+HnhCK/ag=@vger.kernel.org X-Gm-Message-State: AFq9FYLh8LLeh8aUgZLVjBPgrwf9aPMz5fVJHtWi4EKZwKwJPd6lk8wa ij9IgaHVP9G8DpXwoRzKl83DiEK4O70ZA2Peq1pl5QtwhQYAnH3vJ/E2ib+r/eX7bSrXwg== X-Gm-Gg: AYBFou2ePVKnCpY37i+qygiNypt/TzSi5fZVjQ2ITOFkW7KETg9CIYpe9oeqaobrAVP AphtU5cYnhJKPjg0HnKGrDm9zOMSZKgUC9jeZ06JPIsEy/b7v9TK8NEICuqzF/sMVfAZslzmqgc lLFtBcZMDSO+CwQJmxrZ17lON5GAN2KoOgc+k/qXZC9A9zlb+/MORlnnfKwXM+RB7b1fkaCEWKP vPGinS41OFT+FdgiEVdUuVUVdKrhnS0tkqzis7g4I5TpFCoEgbMzxP7FT6u2U/xRu+qYFPP0weV G4UQTfpKb3w3l8liHpkdAtjz9fiHiJ1J6useoroJEbc9N6jaaP92OUOuJ8t2esXCUQbb7YXJ+Fz +kg/Na7PZxIyxSVYRfMtMpJRQYwfZ6iN+6LlVQUQ6ja0Ot0uqTAhFNvCgfL/XhqkuRZNv3wdx0T FiUwJU77TH3G1I/IGou9j3X98p/GZ7ZWBGnXEla0JA3vsJwDFWdj0shLbofldl5/HTRJ/mY1z7p MVLQfwLH4B/ENLn1t4yFeCBWuyAW5SIosLCB4jOPmLGYoQ6c5mO7QYPG67LPqmr7OBl8rd4+EWv BVt+HJwS3nw5fvPZD9YcSC6cb1E+mF1TfBwfADI2osKb437nMK0GdsHqmLCxPLRQkW051jHOXeA KKMKMPKWqg+mCKqxRrZcjKeWqWGk/GPbIxM8XNfuPpg== X-Received: by 2002:a05:693c:6395:10b0:359:3991:ce1a with SMTP id 5a478bee46e88-369e84dd2demr3177495eec.16.1792858892703; Sat, 24 Oct 2026 09:21:32 -0700 (PDT) Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa ([2804:7f0:b101:277b:c08d:c9f9:7c08:79c4]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-369e8ec4d73sm11664942eec.22.2026.10.24.09.21.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Oct 2026 09:21:32 -0700 (PDT) From: Joas Antonio dos Santos To: Saeed Mahameed , Tariq Toukan , Leon Romanovsky , Mark Bloch Cc: Boris Pismenny , Sabrina Dubroca , Andrew Lunn , David S. Miller , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] net/mlx5e: macsec: free SC lookup entries after an RCU grace period Date: Sat, 24 Oct 2026 13:21:28 -0300 Message-ID: <179285888829.90275.17386097105525068016@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-Mailing-List: netdev@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 macsec_del_rxsc_ctx() removes rx_sc->sc_xarray_element from macsec->sc_xarray with xa_erase() and frees it with kfree() right away. mlx5e_macsec_offload_handle_rx_skb() looks the element up with xa_load() under rcu_read_lock() and then dereferences ->rx_sc, so an RX completion that loaded the element just before xa_erase() reads freed memory. rx_sc itself is already freed with kfree_rcu_mightsleep(); only the element pointing to it was missed. macsec_fs_id_del() has the same problem on the TX side: it removes fs_id_found from the SCI rhashtable and frees it with kfree(), while mlx5e_macsec_handle_tx_skb() and mlx5e_macsec_tx_build_eseg() read it through mlx5_macsec_fs_get_fs_id_from_hashtable(), which uses rhashtable_lookup() under rcu_read_lock(). Free both with kvfree_rcu_mightsleep(). Both run in process context from the macsec offload ops, outside any spinlock, so sleeping is fine. The sc_xarray_element issue was pointed out during review of "net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete" and left for a follow-up; this is that follow-up. Fixes: b7c9400cbc48 ("net/mlx5e: Implement MACsec Rx data path using MACsec skb_metadata_dst") Signed-off-by: Joas Antonio dos Santos Assisted-by: Yaga Agent HackerSec Claude:claude-opus-5-5 --- Testing: compile-tested only (arm64, W=1, CONFIG_MLX5_MACSEC=y, no new warnings). I do not have MACsec-capable ConnectX hardware, so this was not run on a real device and I have no reproducer against the driver itself. The free-while-reader-holds-RCU pattern was reproduced with a standalone test module under KASAN (slab-use-after-free on kmalloc-16), and the same module showed no reports after switching to kvfree_rcu_mightsleep(). drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index 38a3415ac..fb9126f6b 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -839,7 +839,7 @@ static void macsec_del_rxsc_ctx(struct mlx5e_macsec *macsec, struct mlx5e_macsec list_del_rcu(&rx_sc->rx_sc_list_element); xa_erase(&macsec->sc_xarray, rx_sc->sc_xarray_element->fs_id); dst_release(&rx_sc->md_dst->dst); - kfree(rx_sc->sc_xarray_element); + kvfree_rcu_mightsleep(rx_sc->sc_xarray_element); kfree_rcu_mightsleep(rx_sc); } diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c index efc516749..910fafe40 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c @@ -684,7 +684,7 @@ static void macsec_fs_id_del(struct list_head *macsec_devices_list, u32 fs_id, xa_erase(fs_id_xa, fs_id); - kfree(fs_id_found); + kvfree_rcu_mightsleep(fs_id_found); if (macsec_fs_is_macsec_device_empty(macsec_device)) { list_del(&macsec_device->macsec_devices_list_entry);