> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of > Simon Horman > Sent: Wednesday, April 22, 2026 8:00 PM > To: Kohei Enju <[email protected]> > Cc: [email protected]; [email protected]; Nguyen, > Anthony L <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Andrew Lunn <[email protected]>; > David S. Miller <[email protected]>; Eric Dumazet > <[email protected]>; Jakub Kicinski <[email protected]>; Paolo Abeni > <[email protected]>; Drewek, Wojciech <[email protected]>; > Keller, Jacob E <[email protected]>; Zaremba, Larysa > <[email protected]>; Fijalkowski, Maciej > <[email protected]> > Subject: Re: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix UAF/NULL deref when > VSI rebuild and XDP attach race > Importance: High > > On Sat, Apr 18, 2026 at 09:01:15AM +0000, Kohei Enju wrote: > > ice_xdp_setup_prog() unconditionally hot-swaps xdp_prog when > > ICE_VSI_REBUILD_PENDING is set. In the attach path, this can publish a > > new rx_ring->xdp_prog before rx_ring->xdp_ring becomes valid while the > > rebuild is pending. As a result, ice_clean_rx_irq() may dereference > > rx_ring->xdp_ring too early. > > > > With high-volume RX packets, running these commands in parallel > > triggered a KASAN splat [1]. > > # ethtool --reset $DEV irq dma filter offload # ip link set dev $DEV > > xdp {obj $OBJ sec xdp,off} > > > > Fix this by rejecting XDP attach while rebuild is pending. > > Keep XDP detach allowed in this window. Detach clears > > rx_ring->xdp_prog, so the RX path will not attempt to access rx_ring- > >xdp_ring. > > > > [1] > > BUG: KASAN: slab-use-after-free in ice_napi_poll+0x3921/0x41a0 Read of > > size 2 at addr ffff88812475b880 by task ksoftirqd/1/23 [...] Call > > Trace: > > <TASK> > > ice_napi_poll+0x3921/0x41a0 > > __napi_poll+0x98/0x520 > > net_rx_action+0x8f2/0xfa0 > > handle_softirqs+0x1cb/0x7f0 > > [...] > > </TASK> > > > > Allocated by task 7246: > > ice_prepare_xdp_rings+0x3de/0x12d0 > > ice_xdp+0x61c/0xef0 > > dev_xdp_install+0x3c4/0x840 > > dev_xdp_attach+0x50a/0x10a0 > > dev_change_xdp_fd+0x175/0x210 > > [...] > > > > Freed by task 7251: > > __rcu_free_sheaf_prepare+0x5f/0x230 > > rcu_free_sheaf+0x1a/0xf0 > > rcu_core+0x567/0x1d80 > > handle_softirqs+0x1cb/0x7f0 > > > > Fixes: 2504b8405768 ("ice: protect XDP configuration with a mutex") > > Signed-off-by: Kohei Enju <[email protected]> > > Reviewed-by: Simon Horman <[email protected]> > > Sashiko has provided some feedback on this patch. > However, I believe the issues it raises are not introduced by this patch and > should not block progress of it. > I'd like to ask if you could take a look over that feedback and see if any > follow- > up is appropriate. > > Thanks!
Tested-by: Patryk Holda <[email protected]>
