Reviewed-by: Naman Gulati <[email protected]>
On Fri, Oct 9, 2026 at 2:43 PM Emil Tantilov <[email protected]> wrote: > > Release PTP, which cancels the aux worker, before the unwind frees the > vports, matching the idpf_vc_core_deinit() order. Previously it was > possible for idpf_ptp_update_cached_phctime() which runs via the PTP > auxiliary worker to read a non-NULL but already freed slot, pass its NULL > check, and dereference the freed vport. This can happen on driver load, > where any vport past the first fails to initialize: > > BUG: KASAN: slab-use-after-free in > idpf_ptp_update_cached_phctime+0x4ad/0x4d0 [idpf] > Read of size 8 at addr ff11002129215050 by task ptp3/10120 > ... > idpf_ptp_update_cached_phctime+0x4ad/0x4d0 [idpf] > idpf_ptp_do_aux_work+0x37/0x50 [idpf] > ptp_aux_kworker+0x64/0xd0 > kthread_worker_fn+0x289/0xa20 > ... > Allocated by task 8820 on cpu 32 at 2113.761375s: > idpf_init_task+0x321/0x21c0 [idpf]a > process_one_work+0x917/0x1940 > worker_thread+0x5a5/0xfe0 > ... > Freed by task 8820 on cpu 32 at 2113.809014s: > idpf_vport_dealloc+0x8cf/0x16b0 [idpf] > idpf_init_task+0x245/0x21c0 [idpf] > process_one_work+0x917/0x1940 > worker_thread+0x5a5/0xfe0 > > The aux worker is armed in idpf_vc_core_init() before idpf_init_task() is > queued, so it is live throughout a failing init, leading to the scenario > above. > > Fixes: 1a49cf814fe1 ("idpf: add Tx timestamp flows") > Reviewed-by: Madhu Chittim <[email protected]> > Signed-off-by: Emil Tantilov <[email protected]> > Reported-by: Konstantin Ilichev <[email protected]> > --- > drivers/net/ethernet/intel/idpf/idpf_lib.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c > b/drivers/net/ethernet/intel/idpf/idpf_lib.c > index a1c739cdd540..9c541dd6ed4d 100644 > --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c > +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c > @@ -1747,6 +1747,8 @@ void idpf_init_task(struct work_struct *work) > return; > > unwind_vports: > + idpf_ptp_release(adapter); > + > if (default_vport) { > for (index = 0; index < adapter->max_vports; index++) { > if (adapter->vports[index]) > @@ -1760,7 +1762,6 @@ void idpf_init_task(struct work_struct *work) > cancel_delayed_work_sync(&adapter->serv_task); > cancel_delayed_work_sync(&adapter->mbx_task); > } > - idpf_ptp_release(adapter); > > clear_bit(IDPF_HR_RESET_IN_PROG, adapter->flags); > } > -- > 2.37.3 >
