Re: [PATCH net] ixgbevf: fix use-after-free in VEPA multicast source pruning

Michael Bommarito
2026-04-15T16:30:57Z

On Wed, Apr 15, 2026 at 12:17 PM Simon Horman <horms@kernel.org> wrote:
> Sashiko flags a number of issues in the same function that
> do not seem related to your patch.
>
> I'd suggest looking over them if you are interested in
> follow-up work in this area.

Sure, I'd be happy to keep going here if you're open to more hardening
patches.

Two Qs for you:

1. Do you want smaller patches for each or bigger method-level patches?

2. Anything on my list below that you would *not* want me touching?
I'll combine with anything I can find from your Sashiko items

1. line 104
rule: semgrep bug-on-in-net-code (CWE-617)
match: BUG_ON(!test_bit(__IXGBEVF_SERVICE_SCHED,
&adapter->state))
where: ixgbevf_service_event_schedule()
status: untriaged

2. lines 1219-1225
rule: net-drop-continue-in-loop + scan_drop_continue_loops.py
match: VEPA multicast pruning kfree_skb + continue (UAF)
where: ixgbevf_clean_rx_irq()
status: SHIPPED as commit ca62ac02b30d (this patch)

3. line 2769
rule: semgrep signed-int-as-size-param-kmalloc
match: q_vector = kzalloc(size, GFP_KERNEL) (signed size)
status: untriaged

4. line 3452
rule: semgrep signed-int-as-size-param-kmalloc
match: tx_ring->tx_buffer_info = vmalloc(size) (signed size)
status: untriaged

5. line 3530
rule: semgrep signed-int-as-size-param-kmalloc
match: rx_ring->rx_buffer_info = vmalloc(size) (signed size)
status: untriaged

6. line 4114
rule: semgrep narrow-accumulator-overflow
match: i += tx_ring->count;
status: untriaged

7. line 4189
rule: semgrep narrow-accumulator-overflow
match: count += TXD_USE_COUNT(skb_frag_size(frag));
status: untriaged

8. line 4192
rule: semgrep narrow-accumulator-overflow
match: count += skb_shinfo(skb)->nr_frags;
status: untriaged

9. line 4695
rule: coccinelle cancel_work.cocci
match: INIT_WORK(&adapter->service_task, ixgbevf_service_task)
with no matching cancel_work_sync on teardown path
status: untriaged

10. line 4752
rule: coccinelle null_after_free.cocci
where: ixgbevf_probe() err_dma path
status: untriaged

11. line 4795
rule: coccinelle null_after_free.cocci
where: ixgbevf_remove()
status: untriaged