Re: [PATCH net] net: ena: PHC: Fix potential use-after-free in get_timestamp

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 08/05/2026 07:21, Arthur Kiyanovski wrote:
> Move the phc->active check and resp pointer assignment to after
> acquiring the spinlock. Previously, phc->active was checked without
> holding the lock, and resp was cached from ena_dev->phc.virt_addr
> before the lock was acquired.
> 
> If ena_com_phc_destroy() runs between the lockless active check and
> the lock acquisition, it sets active=false, releases the lock, frees
> the DMA memory, and sets virt_addr=NULL. The get_timestamp path would
> then read a NULL virt_addr and dereference it.
> 
> With both the active check and the pointer read under the lock,
> destroy cannot free the memory while get_timestamp is using it.
> 
> Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
> ---
>   drivers/net/ethernet/amazon/ena/ena_com.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
> index e67b592..8c86789 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_com.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_com.c
> @@ -1782,20 +1782,23 @@ void ena_com_phc_destroy(struct ena_com_dev *ena_dev)
>   
>   int ena_com_phc_get_timestamp(struct ena_com_dev *ena_dev, u64 *timestamp)
>   {
> -	volatile struct ena_admin_phc_resp *resp = ena_dev->phc.virt_addr;
>   	const ktime_t zero_system_time = ktime_set(0, 0);
>   	struct ena_com_phc_info *phc = &ena_dev->phc;
> +	volatile struct ena_admin_phc_resp *resp;
>   	ktime_t expire_time;
>   	ktime_t block_time;
>   	unsigned long flags = 0;
>   	int ret = 0;
>   
> +	spin_lock_irqsave(&phc->lock, flags);
> +
>   	if (!phc->active) {
> +		spin_unlock_irqrestore(&phc->lock, flags);
>   		netdev_err(ena_dev->net_device, "PHC feature is not active in the device\n");
>   		return -EOPNOTSUPP;
>   	}
>   
> -	spin_lock_irqsave(&phc->lock, flags);
> +	resp = ena_dev->phc.virt_addr;
>   
>   	/* Check if PHC is in blocked state */
>   	if (unlikely(ktime_compare(phc->system_time, zero_system_time))) {

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>