* [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
@ 2025-09-23 11:19 Dan Carpenter
2025-09-23 11:54 ` Vadim Fedorenko
2025-09-25 9:10 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2025-09-23 11:19 UTC (permalink / raw)
To: Subbaraya Sundeep
Cc: Sunil Goutham, Geetha sowjanya, hariprasad, Bharat Bhushan,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, kernel-janitors
This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line. Two lines later, we take
a mutex so I don't think this is an RCU safe region. Re-order it to do
the dereferences before queuing up the free.
Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
index 5f80b23c5335..26a08d2cfbb1 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -1326,7 +1326,6 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
free_leaf:
otx2_tc_del_from_flow_list(flow_cfg, new_node);
- kfree_rcu(new_node, rcu);
if (new_node->is_act_police) {
mutex_lock(&nic->mbox.lock);
@@ -1346,6 +1345,7 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
mutex_unlock(&nic->mbox.lock);
}
+ kfree_rcu(new_node, rcu);
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
2025-09-23 11:19 [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Dan Carpenter
@ 2025-09-23 11:54 ` Vadim Fedorenko
2025-09-25 9:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Vadim Fedorenko @ 2025-09-23 11:54 UTC (permalink / raw)
To: Dan Carpenter, Subbaraya Sundeep
Cc: Sunil Goutham, Geetha sowjanya, hariprasad, Bharat Bhushan,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, kernel-janitors
On 23/09/2025 12:19, Dan Carpenter wrote:
> This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
> and then dereferences it on the next line. Two lines later, we take
> a mutex so I don't think this is an RCU safe region. Re-order it to do
> the dereferences before queuing up the free.
>
> Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
2025-09-23 11:19 [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Dan Carpenter
2025-09-23 11:54 ` Vadim Fedorenko
@ 2025-09-25 9:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-09-25 9:10 UTC (permalink / raw)
To: Dan Carpenter
Cc: sbhatta, sgoutham, gakula, hkelam, bbhushan2, andrew+netdev,
davem, edumazet, kuba, pabeni, netdev, linux-kernel,
kernel-janitors
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 23 Sep 2025 14:19:11 +0300 you wrote:
> This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
> and then dereferences it on the next line. Two lines later, we take
> a mutex so I don't think this is an RCU safe region. Re-order it to do
> the dereferences before queuing up the free.
>
> Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
>
> [...]
Here is the summary with links:
- [net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
https://git.kernel.org/netdev/net/c/d9c70e93ec59
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-09-25 9:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-23 11:19 [PATCH net] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Dan Carpenter
2025-09-23 11:54 ` Vadim Fedorenko
2025-09-25 9:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).