| Message ID | 20240206164328.360313-1-jiri@resnulli.us (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | aa1eec2f546f2afa8c98ec41e5d8ee488165d685 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers | expand |
On Tue, Feb 06, 2024 at 05:43:28PM +0100, Jiri Pirko wrote: > From: Jiri Pirko <jiri@nvidia.com> > > I managed to hit following use after free warning recently: ... > I didn't manage to reproduce it. Though the issue seems to be obvious. > There is a chance that the mlx5_dpll_remove() calls > cancel_delayed_work() when the work runs and manages to re-arm itself. > In that case, after delay timer triggers next attempt to queue it, > it works with freed memory. > > Fix this by using cancel_delayed_work_sync() instead which makes sure > that work is done when it returns. > > Fixes: 496fd0a26bbf ("mlx5: Implement SyncE support using DPLL infrastructure") > Signed-off-by: Jiri Pirko <jiri@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 6 Feb 2024 17:43:28 +0100 you wrote: > From: Jiri Pirko <jiri@nvidia.com> > > I managed to hit following use after free warning recently: > > [ 2169.711665] ================================================================== > [ 2169.714009] BUG: KASAN: slab-use-after-free in __run_timers.part.0+0x179/0x4c0 > [ 2169.716293] Write of size 8 at addr ffff88812b326a70 by task swapper/4/0 > > [...] Here is the summary with links: - [net] net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers https://git.kernel.org/netdev/net/c/aa1eec2f546f You are awesome, thank you!
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c index 18fed2b34fb1..928bf24d4b12 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c @@ -389,7 +389,7 @@ static void mlx5_dpll_remove(struct auxiliary_device *adev) struct mlx5_dpll *mdpll = auxiliary_get_drvdata(adev); struct mlx5_core_dev *mdev = mdpll->mdev; - cancel_delayed_work(&mdpll->work); + cancel_delayed_work_sync(&mdpll->work); mlx5_dpll_mdev_netdev_untrack(mdpll, mdev); destroy_workqueue(mdpll->wq); dpll_pin_unregister(mdpll->dpll, mdpll->dpll_pin,