netdev - Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leak and use-after-free in ixgbe_recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250901083745.69554-1-enjuk@amazon.com>
Date: Mon, 1 Sep 2025 17:37:38 +0900
From: Kohei Enju <enjuk@...zon.com>
To: <aleksandr.loktionov@...el.com>
CC: <andrew+netdev@...n.ch>, <anthony.l.nguyen@...el.com>,
	<davem@...emloft.net>, <den@...inux.co.jp>, <edumazet@...gle.com>,
	<enjuk@...zon.com>, <intel-wired-lan@...ts.osuosl.org>,
	<jedrzej.jagielski@...el.com>, <kohei.enju@...il.com>, <kuba@...nel.org>,
	<mateusz.polchlopek@...el.com>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <przemyslaw.kitszel@...el.com>,
	<stefan.wegrzyn@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leak and
 use-after-free in ixgbe_recovery_probe()

On Mon, 1 Sep 2025 07:11:26 +0000, Loktionov, Aleksandr wrote:

>> [...]
>> 
>> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> index ff6e8ebda5ba..08368e2717c2 100644
>> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
>> @@ -11510,10 +11510,10 @@ static int ixgbe_recovery_probe(struct
>> ixgbe_adapter *adapter)
>>  shutdown_aci:
>>  	mutex_destroy(&adapter->hw.aci.lock);
>>  	ixgbe_release_hw_control(adapter);
>> -	devlink_free(adapter->devlink);
>>  clean_up_probe:
>>  	disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter-
>> >state);
>>  	free_netdev(netdev);
>I'd add a guard here: if (adapter->devlink)
>What do you think?

Thank you for the review.

Currently ixgbe_recovery_probe() is only called from one location,
ixgbe_probe(), and also always adapter->devlink is not NULL in this path
since this is called after ixgbe_allocate_devlink(). In other words, if
ixgbe_allocate_devlink() fails, ixgbe_recovery_probe() never be called.

So I've thought that the guard might not be necessary like error
handling in ixgbe_probe(), but could you let me know your concern if I'm
overlooking something?

Thanks,
Kohei.

>> +	devlink_free(adapter->devlink);
>>  	pci_release_mem_regions(pdev);
>>  	if (disable_dev)
>>  		pci_disable_device(pdev);
>> --
>> 2.51.0