From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-002.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-002.esa.us-west-2.outbound.mail-perimeter.amazon.com [44.246.1.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBF62340A43; Fri, 8 May 2026 06:21:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=44.246.1.125 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778221315; cv=none; b=Z0DTGxRrn6+rFKwctI0yTHWvQHll/hWQMSdLFhS79tWCji6HrReK7zm31sdcFM7v03FQts8/Y3PFgF6YmRMd2dzCODovIuIAPxCSjY42Igldq6fLJ359ksBE9dKFM+9YSHXPkcTvRPUjsmaUOpUoE/pkOrtO1s+hOFVmsRBZvSw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778221315; c=relaxed/simple; bh=1HTZqNIRNhnVA9GomOxpx+k/9CWd0/Hv2kiqs3U4suc=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=L7FB15WRxoH+TulSfSxLqbHdIQnRiudN63qf8OcDMBwCjtfxDV62AZ6oM9WOBBLGxAyZlNAlejjqma3GTg/e8gTJPhG/oZyPLnWN8bATHX+C8POOLBmFOF6Ba7WWCb3ilBmy/slSrTNqsy2RaJeWxGCfqAWJ1kXJdfMqEUTxEMI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.com; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=KczaQj57; arc=none smtp.client-ip=44.246.1.125 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="KczaQj57" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1778221311; x=1809757311; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=4yZtaKeio3ILKwfYLRbQsPyAM3HC2HFa+/XjpqORz+8=; b=KczaQj57SUSlZ/w6WH5NS4PiPr1l6x/5VwNsaVe+Z88QTAfnsqUPia0R IvK12oPdBUoHN6K57UbYWt82wrO1v1jlhxD5cL29sPN5t01ROmfKjNGut ny3QMBfjvw0GX4/rz1HZ04FgOslQ/LY8DmTsv9dY51iNCCuXRsGztPxkF CZc246PWH6yCoFFWFCKKfcQDykc+IAx3eL2Kx+BufTQAxfA6NedKSxjm0 Szcwd7nWXMoCVmJO+z3/0gRLnnvQJy0oL/sRFhImqr5dCGjDlTU1/hfd0 XkCnmhNiJdVzSOIyDzVxlZ7f87t+dOc68or15/amyzru+IYXv7y+YVelG Q==; X-CSE-ConnectionGUID: XGuw1oxjSqK/w5W70Wxgig== X-CSE-MsgGUID: 3tXvht1URfOgrdcJ56N7qw== X-IronPort-AV: E=Sophos;i="6.23,223,1770595200"; d="scan'208";a="19164035" Received: from ip-10-5-9-48.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.9.48]) by internal-pdx-out-002.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 May 2026 06:21:42 +0000 Received: from EX19MTAUWA001.ant.amazon.com [205.251.233.182:28957] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.52.175:2525] with esmtp (Farcaster) id e73dbfc9-e5fe-4b82-bf79-8667badb4bee; Fri, 8 May 2026 06:21:42 +0000 (UTC) X-Farcaster-Flow-ID: e73dbfc9-e5fe-4b82-bf79-8667badb4bee Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWA001.ant.amazon.com (10.250.64.218) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Fri, 8 May 2026 06:21:41 +0000 Received: from dev-dsk-akiyano-1c-2138b29d.eu-west-1.amazon.com (172.19.83.6) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Fri, 8 May 2026 06:21:36 +0000 From: Arthur Kiyanovski To: David Miller , Jakub Kicinski , CC: Arthur Kiyanovski , Richard Cochran , Eric Dumazet , Paolo Abeni , David Woodhouse , Thomas Gleixner , Miroslav Lichvar , Andrew Lunn , Wen Gu , Xuan Zhuo , David Woodhouse , "Yonatan Sarna" , Zorik Machulsky , "Alexander Matushevsky" , Saeed Bshara , Matt Wilson , Anthony Liguori , Nafea Bshara , Evgeny Schmeilin , Netanel Belgazal , Ali Saidi , Benjamin Herrenschmidt , Noam Dagan , David Arinzon , Evgeny Ostrovsky , Ofir Tabachnik , Amit Bernstein , Subject: [PATCH net] net: ena: PHC: Fix potential use-after-free in get_timestamp Date: Fri, 8 May 2026 06:21:21 +0000 Message-ID: <20260508062126.7273-1-akiyano@amazon.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EX19D031UWA002.ant.amazon.com (10.13.139.96) To EX19D001UWA001.ant.amazon.com (10.13.138.214) Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired. If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it. With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Cc: stable@vger.kernel.org Signed-off-by: Arthur Kiyanovski --- drivers/net/ethernet/amazon/ena/ena_com.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c index e67b592..8c86789 100644 --- a/drivers/net/ethernet/amazon/ena/ena_com.c +++ b/drivers/net/ethernet/amazon/ena/ena_com.c @@ -1782,20 +1782,23 @@ void ena_com_phc_destroy(struct ena_com_dev *ena_dev) int ena_com_phc_get_timestamp(struct ena_com_dev *ena_dev, u64 *timestamp) { - volatile struct ena_admin_phc_resp *resp = ena_dev->phc.virt_addr; const ktime_t zero_system_time = ktime_set(0, 0); struct ena_com_phc_info *phc = &ena_dev->phc; + volatile struct ena_admin_phc_resp *resp; ktime_t expire_time; ktime_t block_time; unsigned long flags = 0; int ret = 0; + spin_lock_irqsave(&phc->lock, flags); + if (!phc->active) { + spin_unlock_irqrestore(&phc->lock, flags); netdev_err(ena_dev->net_device, "PHC feature is not active in the device\n"); return -EOPNOTSUPP; } - spin_lock_irqsave(&phc->lock, flags); + resp = ena_dev->phc.virt_addr; /* Check if PHC is in blocked state */ if (unlikely(ktime_compare(phc->system_time, zero_system_time))) { -- 2.47.3