Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217323/?format=api
{ "id": 2217323, "url": "http://patchwork.ozlabs.org/api/patches/2217323/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-6-john.cabaj@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260327213732.4049575-6-john.cabaj@canonical.com>", "list_archive_url": null, "date": "2026-03-27T21:37:32", "name": "[SRU,Q:linux-azure,4/4] net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "29c6dd5a62bc410167173827ba05e8d3ec86fe25", "submitter": { "id": 85032, "url": "http://patchwork.ozlabs.org/api/people/85032/?format=api", "name": "John Cabaj", "email": "john.cabaj@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-6-john.cabaj@canonical.com/mbox/", "series": [ { "id": 497833, "url": "http://patchwork.ozlabs.org/api/series/497833/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=497833", "date": "2026-03-27T21:37:31", "name": "net: mana: Fix use-after-free in reset service rescan path & net: mana: Fix double destroy_workqueue on service rescan PCI path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497833/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217323/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217323/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=LkEKltsk;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fjDWy48Sjz1yVW\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 28 Mar 2026 08:37:50 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w6EsA-00041a-Fg; Fri, 27 Mar 2026 21:37:42 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <john.cabaj@canonical.com>)\n id 1w6Es7-0003ze-Es\n for kernel-team@lists.ubuntu.com; Fri, 27 Mar 2026 21:37:39 +0000", "from mail-qk1-f200.google.com (mail-qk1-f200.google.com\n [209.85.222.200])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 3AD3F3F600\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 21:37:39 +0000 (UTC)", "by mail-qk1-f200.google.com with SMTP id\n af79cd13be357-8cfbfac0e05so50858585a.1\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 14:37:39 -0700 (PDT)", "from smtp.gmail.com\n (h208-73-92-250.mdtnwi.broadband.dynamic.tds.net. [208.73.92.250])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8d027f0e687sm32939685a.18.2026.03.27.14.37.37\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 27 Mar 2026 14:37:37 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1774647459;\n bh=xbeXCFF5TjS36Y1zpJHqOoJXwoiQfPfsUrv9/2duSGk=;\n h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=LkEKltskANnrmEoKDJ0MaVfYs4KYNXWdOjYReRLXj0cKZpG3pBl9F9nd6owLzBS9v\n kCw6dGf+ixQC2MficouiyoFVcuGDpNzdNahP0lekzA4c5aWGpZjGJYg0sa+tRh9PaQ\n NwdQE4Z9g5X8MbmqLmaNQWXI8FbIWfQfEgC/c07yqYyIDI8ygHCwyDi6n45gxCnRti\n raPehtHNx2SnoVS4ggyN/0sNtkiKAd42StqC39kmmLnU3nCkQGxOH9qGxVkrBzlvLl\n Sv/QJiV1dOfY5E19HrrZLsilWTmd4r4rYTyRFas+fs2XdJcp70SJpW7A1sVCqeeYLe\n et7W/iPuROmZXlJ3sxQZkT7gT5JK05D+D7znQoIPxaXcWYD/x1fCGQoZ1BgGr+ngA9\n NNbi8bf2q5kkzyO5spMWaV9aEyu7FkKF2WdS58CrIS7yg/0Ma35RcfHCkQieb6wTXN\n 6LqPriiKFz46S4rxBTcB+CcfgTrOUJM102G0JnoT5Ma8NUY16sf77QBclT1n98tti1\n EtnIs/HSlV49R/9UcomSSJFCRXzxKQr2uDwisEyKtC2LfGH7F07TIrRA5v6YM5o17b\n 2T5LvJ4DTphYvmfPiLkbJbXo5T/D3HkD08lk1PjbyxI4TplKTkm9/jBwuoahF5UOPG\n kmYYLOXuwzOfk2LHmB/R37AM=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774647458; x=1775252258;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=xbeXCFF5TjS36Y1zpJHqOoJXwoiQfPfsUrv9/2duSGk=;\n b=Yjvds17P3JsMbh3w13XxE40fVtqf9AKw6ycRlR0ERkd7IpAHknAAaVc5PfZTmXfozY\n yUKhXMB0JrW2U28i1+itOon8T1HJReV9W+LokNbSIOIuelKUlknRivQTbHqdybztMIRu\n oqgXoamOg9M1An/AvaXMRg0eOr5IbI4fWVn2R6Cd1a3n4dqTOKOtoyD8fmsrmHO5Qrj1\n W+oD8lVoBLY07O3plGr4i7wm7gXmHaXiv3+o6iaEO7F/47kajOWh+wtvuDIWOdAhnQvy\n L06H9550aE/uYmsvPVWY5lKus11ZYKXNpAMh9m8baoqF/RAMbceC0uabtRdYNxxsChG/\n 3HcA==", "X-Gm-Message-State": "AOJu0YzQC9VQtI0T9Er/zDVJv0tHw7zQIMR/BhUdHsxiowIlzA5Tb5/k\n GgMu0D3NHttnu6/HvxmATlTzXWEEwLAB5jXGYZKev/WyEVnVEWOpKDtuGjHVyFtR6MN4Y1ROrKW\n Pbq44eC/V1wLNU/4jT56LaqMy8zLtk6Y67Ewt+MtBTmEn3NNSik3kocReMKz047bh6or6ldftrU\n adI03ZXsFuFgN/KA==", "X-Gm-Gg": "ATEYQzwZC56gHa1BNBgk0XghQYd6HU6p1zMGzirc+BX4/efGr7nW1m9E5mGvSh6803X\n ICda2jbLTH5p4L7diDVNNjARYnsa3V+ozy7mCBr/RH7naU4Qi4hsnWP2Yk8R14FkKvJNkS19Scx\n Gm1VErfRFBvjcafNxnNrd+dyoGnRxUH9STGylYHtivIGNyaTlqtnfBo1QrUamIPOKV/z8HsHZKa\n obxZbejjzV361O4ebB++gdQyR3ytYSDUSGzNs8XzRw7doWfm2cPYpzepqDQaWMHxgzQyITPebO8\n UHzYpSzEn2JzMzyKRADVmj0oOZychxccymMNh0DqpLxG+JnkeE8cuV6lLS5RobgU2sO+tjVXLiD\n a2CVs/73N4ZWpRkEMeNuKKSSitX7Hnq6+l0oBF24nAkFVorbTvnIukogT6kjDgNJ36xW4Ar3ocW\n StJ0NWDljVdw==", "X-Received": [ "by 2002:a05:620a:6910:b0:8cf:bad7:20c5 with SMTP id\n af79cd13be357-8d01ce806e2mr450170885a.25.1774647458203;\n Fri, 27 Mar 2026 14:37:38 -0700 (PDT)", "by 2002:a05:620a:6910:b0:8cf:bad7:20c5 with SMTP id\n af79cd13be357-8d01ce806e2mr450167385a.25.1774647457728;\n Fri, 27 Mar 2026 14:37:37 -0700 (PDT)" ], "From": "John Cabaj <john.cabaj@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][Q:linux-azure][PATCH 4/4] net: mana: fix use-after-free in\n mana_hwc_destroy_channel() by reordering teardown", "Date": "Fri, 27 Mar 2026 16:37:32 -0500", "Message-ID": "<20260327213732.4049575-6-john.cabaj@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "References": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Dipayaan Roy <dipayanroy@linux.microsoft.com>\n\nBugLink: https://bugs.launchpad.net/bugs/2146588\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq->msg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.\n\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nReviewed-by: Haiyang Zhang <haiyangz@microsoft.com>\nSigned-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>\nReviewed-by: Simon Horman <horms@kernel.org>\nLink: https://patch.msgid.link/abHA3AjNtqa1nx9k@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>\n(cherry picked from commit fa103fc8f56954a60699a29215cb713448a39e87)\nSigned-off-by: John Cabaj <john.cabaj@canonical.com>\n---\n drivers/net/ethernet/microsoft/mana/hw_channel.c | 6 +++---\n 1 file changed, 3 insertions(+), 3 deletions(-)", "diff": "diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c\nindex aa4e2731e2ba..840c6b8957c9 100644\n--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c\n+++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c\n@@ -814,9 +814,6 @@ void mana_hwc_destroy_channel(struct gdma_context *gc)\n \t\tgc->max_num_cqs = 0;\n \t}\n \n-\tkfree(hwc->caller_ctx);\n-\thwc->caller_ctx = NULL;\n-\n \tif (hwc->txq)\n \t\tmana_hwc_destroy_wq(hwc, hwc->txq);\n \n@@ -826,6 +823,9 @@ void mana_hwc_destroy_channel(struct gdma_context *gc)\n \tif (hwc->cq)\n \t\tmana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);\n \n+\tkfree(hwc->caller_ctx);\n+\thwc->caller_ctx = NULL;\n+\n \tmana_gd_free_res_map(&hwc->inflight_msg_res);\n \n \thwc->num_inflight_msg = 0;\n", "prefixes": [ "SRU", "Q:linux-azure", "4/4" ] }