linux-kernel - RE: [Intel-wired-lan] [PATCH v3] ice: ice_adapter: release xa entry on adapter allocation failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <IA3PR11MB8986E04DF6C3B1DF2CA823B5E5E6A@IA3PR11MB8986.namprd11.prod.outlook.com>
Date: Wed, 1 Oct 2025 12:11:07 +0000
From: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
To: Haotian Zhang <vulab@...as.ac.cn>, "Keller, Jacob E"
	<jacob.e.keller@...el.com>, "Nguyen, Anthony L" <anthony.l.nguyen@...el.com>,
	"Kitszel, Przemyslaw" <przemyslaw.kitszel@...el.com>
CC: Andrew Lunn <andrew+netdev@...n.ch>, "David S . Miller"
	<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
	<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [Intel-wired-lan] [PATCH v3] ice: ice_adapter: release xa entry
 on adapter allocation failure



> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
> Of Haotian Zhang
> Sent: Wednesday, October 1, 2025 1:54 PM
> To: Keller, Jacob E <jacob.e.keller@...el.com>; Nguyen, Anthony L
> <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@...el.com>
> Cc: Andrew Lunn <andrew+netdev@...n.ch>; David S . Miller
> <davem@...emloft.net>; Eric Dumazet <edumazet@...gle.com>; Jakub
> Kicinski <kuba@...nel.org>; Paolo Abeni <pabeni@...hat.com>; intel-
> wired-lan@...ts.osuosl.org; netdev@...r.kernel.org; linux-
> kernel@...r.kernel.org; Haotian Zhang <vulab@...as.ac.cn>
> Subject: [Intel-wired-lan] [PATCH v3] ice: ice_adapter: release xa
> entry on adapter allocation failure
> 
> When ice_adapter_new() fails, the reserved XArray entry created by
> xa_insert() is not released. This causes subsequent insertions at
> the same index to return -EBUSY, potentially leading to
> NULL pointer dereferences.
> 
> Reorder the operations as suggested by Przemek Kitszel:
> 1. Check if adapter already exists (xa_load)
> 2. Reserve the XArray slot (xa_reserve)
> 3. Allocate the adapter (ice_adapter_new)
> 4. Store the adapter (xa_store)
> 
> Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times
> than needed")
> Suggested-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>
> Suggested-by: Jacob Keller <jacob.e.keller@...el.com>
> Signed-off-by: Haotian Zhang <vulab@...as.ac.cn>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>

> 
> ---
> Changes in v3:
>   - Reorder xa_load/xa_reserve/ice_adapter_new/xa_store calls as
>     suggested by Przemek Kitszel, instead of just adding xa_release().
> Changes in v2:
>   - Instead of checking the return value of xa_store(), fix the real
> bug
>     where a failed ice_adapter_new() would leave a stale entry in the
>     XArray.
>   - Use xa_release() to clean up the reserved entry, as suggested by
>     Jacob Keller.
> ---

...

> --
> 2.50.1.windows.1