Re: [PATCH 5.15 265/570] net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

Harshit Mogalapalli
2026-04-15T10:07:08Z

Hi,

On 13/04/26 21:26, Greg Kroah-Hartman wrote:
> From: Dipayaan Roy<dipayanroy@linux.microsoft.com>
>
> [ Upstream commit fa103fc8f56954a60699a29215cb713448a39e87 ]
>
> A potential race condition exists in mana_hwc_destroy_channel() where
> hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
> Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
> handler to dereference freed memory, leading to a use-after-free or
> NULL pointer dereference in mana_hwc_handle_resp().
>
> mana_smc_teardown_hwc() signals the hardware to stop but does not
> synchronize against IRQ handlers already executing on other CPUs. The
> IRQ synchronization only happens in mana_hwc_destroy_cq() via
> mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
> after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()
> can dereference freed caller_ctx (and rxq->msg_buf) in
> mana_hwc_handle_resp().
>

I have run an AI assisted backport review and it spotted a probable
issue, I checked it and I think is worth checking here from the authors:

I think this fix relies on presence of commit: 02fed6d92bad ("net: mana:
add msix index sharing between EQs") which is not present in 5.15.y.

This patch mentions:

""
The IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq().
""

and I think that is referring to the synchronization added in
2fed6d92bad ("net: mana: add msix index sharing between EQs"), and give
that we don't have this in 5.15.y, the UAF is still possible ?

Thoughts ?

Thanks,
Harshit

> Fix this by reordering teardown to reverse-of-creation order: destroy
> the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This
> ensures all in-flight interrupt handlers complete before the memory they
> access is freed.
>
> Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
> Reviewed-by: Haiyang Zhang<haiyangz@microsoft.com>
> Signed-off-by: Dipayaan Roy<dipayanroy@linux.microsoft.com>