* Re: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup
2026-07-14 6:39 [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup xuanqiang.luo
@ 2026-07-14 14:14 ` Marcin Szycik
2026-07-14 14:24 ` Loktionov, Aleksandr
1 sibling, 0 replies; 3+ messages in thread
From: Marcin Szycik @ 2026-07-14 14:14 UTC (permalink / raw)
To: xuanqiang.luo, intel-wired-lan
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev,
sridhar.samudrala, wojciech.drewek, piotr.raczynski,
michal.swiatkowski, jacob.e.keller, netdev, Xuanqiang Luo, stable
On 14.07.2026 08:39, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
> port from pf->dyn_ports. However, it frees the VSI before reading the
> index for the erase, resulting in a use-after-free.
>
> Follow the reverse of the allocation order in ice_alloc_dynamic_port()
> by erasing the xarray entry before freeing the VSI.
>
> Fixes: eda69d654c7e ("ice: add basic devlink subfunctions support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Thank you!
I wonder how such a glaring issue survived in the codebase for so long.
Perhaps ice_vsi_free() exited early for some reason.
> ---
> drivers/net/ethernet/intel/ice/devlink/port.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c b/drivers/net/ethernet/intel/ice/devlink/port.c
> index 2a2e56777f9f7..3ede246490027 100644
> --- a/drivers/net/ethernet/intel/ice/devlink/port.c
> +++ b/drivers/net/ethernet/intel/ice/devlink/port.c
> @@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct ice_dynamic_port *dyn_port)
>
> xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
> ice_eswitch_detach_sf(pf, dyn_port);
> - ice_vsi_free(dyn_port->vsi);
> xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
> + ice_vsi_free(dyn_port->vsi);
> kfree(dyn_port);
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread* RE: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup
2026-07-14 6:39 [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup xuanqiang.luo
2026-07-14 14:14 ` [Intel-wired-lan] " Marcin Szycik
@ 2026-07-14 14:24 ` Loktionov, Aleksandr
1 sibling, 0 replies; 3+ messages in thread
From: Loktionov, Aleksandr @ 2026-07-14 14:24 UTC (permalink / raw)
To: xuanqiang.luo@linux.dev, intel-wired-lan@lists.osuosl.org
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, andrew+netdev@lunn.ch,
Samudrala, Sridhar, Drewek, Wojciech, piotr.raczynski@intel.com,
michal.swiatkowski@linux.intel.com, Keller, Jacob E,
netdev@vger.kernel.org, Xuanqiang Luo, stable@vger.kernel.org
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of xuanqiang.luo@linux.dev
> Sent: Tuesday, July 14, 2026 8:40 AM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> Samudrala, Sridhar <sridhar.samudrala@intel.com>; Drewek, Wojciech
> <wojciech.drewek@intel.com>; piotr.raczynski@intel.com;
> michal.swiatkowski@linux.intel.com; Keller, Jacob E
> <jacob.e.keller@intel.com>; netdev@vger.kernel.org; Xuanqiang Luo
> <luoxuanqiang@kylinos.cn>; stable@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free
> in dynamic port cleanup
>
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the
> dynamic port from pf->dyn_ports. However, it frees the VSI before
> reading the index for the erase, resulting in a use-after-free.
>
> Follow the reverse of the allocation order in ice_alloc_dynamic_port()
> by erasing the xarray entry before freeing the VSI.
>
> Fixes: eda69d654c7e ("ice: add basic devlink subfunctions support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
> drivers/net/ethernet/intel/ice/devlink/port.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c
> b/drivers/net/ethernet/intel/ice/devlink/port.c
> index 2a2e56777f9f7..3ede246490027 100644
> --- a/drivers/net/ethernet/intel/ice/devlink/port.c
> +++ b/drivers/net/ethernet/intel/ice/devlink/port.c
> @@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct
> ice_dynamic_port *dyn_port)
>
> xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
> ice_eswitch_detach_sf(pf, dyn_port);
> - ice_vsi_free(dyn_port->vsi);
> xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
> + ice_vsi_free(dyn_port->vsi);
> kfree(dyn_port);
> }
>
> --
> 2.43.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread