Skip to contentSkip to conversation

net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()

PATCH Applied Dan Carpenter 3 participants 3 messages Sep 30, 2025 – Oct 3, 2025

Subsystems (6)
Networking Network drivers Kernel janitors InfiniBand +2 more subsystems
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()

Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.

Fixes cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
index d2071aff7b8f..308b4458e0d4 100644
@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
 				mlx4_unregister_mac(mdev->dev, priv->port, mac);
 
 				hlist_del_rcu(&entry->hlist);
-				kfree_rcu(entry, rcu);
 				en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
 				       entry->mac, priv->port);
+				kfree_rcu(entry, rcu);
 				++removed;
 			}
 		}
Signature · 1 line
2.51.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · Dan Carpenter

Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.

Fixes cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
Signed-off-by Dan Carpenter <[email protected]>
---
  drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +0 -0
index d2071aff7b8f..308b4458e0d4 100644

drivers/net/ethernet/mellanox/mlx4/en_netdev.c static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, · line 1188

Quoted 10 lines
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
  				mlx4_unregister_mac(mdev->dev, priv->port, mac);
 
  				hlist_del_rcu(&entry->hlist);
-				kfree_rcu(entry, rcu);
  				en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
  				       entry->mac, priv->port);
+				kfree_rcu(entry, rcu);
  				++removed;
  			}
  		}
Reviewed-by Tariq Toukan <[email protected]>

Thanks for your patch.

CI Applied
#2 lore raw
In reply to Dan Carpenter
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Tue, 30 Sep 2025 15:25:01 +0300 you wrote:

Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.

Fixes cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
Signed-off-by Dan Carpenter <[email protected]>

[...]

Here is the summary with links:
- [net] net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()

    https://git.kernel.org/netdev/net/c/4f0d91ba7281

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html