Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217325/?format=api
{ "id": 2217325, "url": "http://patchwork.ozlabs.org/api/patches/2217325/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-3-john.cabaj@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260327213732.4049575-3-john.cabaj@canonical.com>", "list_archive_url": null, "date": "2026-03-27T21:37:29", "name": "[SRU,Q:linux-azure,1/4] net: mana: Fix use-after-free in reset service rescan path", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "10038ccb0b8448091f9484bb993e66995823aaa0", "submitter": { "id": 85032, "url": "http://patchwork.ozlabs.org/api/people/85032/?format=api", "name": "John Cabaj", "email": "john.cabaj@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-3-john.cabaj@canonical.com/mbox/", "series": [ { "id": 497833, "url": "http://patchwork.ozlabs.org/api/series/497833/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=497833", "date": "2026-03-27T21:37:31", "name": "net: mana: Fix use-after-free in reset service rescan path & net: mana: Fix double destroy_workqueue on service rescan PCI path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497833/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217325/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217325/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=Ru+eMce7;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fjDWy4hfFz1yVX\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 28 Mar 2026 08:37:49 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w6Es7-0003zl-HM; Fri, 27 Mar 2026 21:37:39 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <john.cabaj@canonical.com>)\n id 1w6Es5-0003yg-5N\n for kernel-team@lists.ubuntu.com; Fri, 27 Mar 2026 21:37:37 +0000", "from mail-qk1-f199.google.com (mail-qk1-f199.google.com\n [209.85.222.199])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id EE50A3F601\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 21:37:36 +0000 (UTC)", "by mail-qk1-f199.google.com with SMTP id\n af79cd13be357-8cfbbf78ca8so632929385a.0\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 14:37:36 -0700 (PDT)", "from smtp.gmail.com\n (h208-73-92-250.mdtnwi.broadband.dynamic.tds.net. [208.73.92.250])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8d027f0e687sm32939685a.18.2026.03.27.14.37.34\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 27 Mar 2026 14:37:35 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1774647456;\n bh=htDTPzeNXOGx+FlU1JhzDSkCA98nhkgkFCHWup8YckE=;\n h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=Ru+eMce7Da8/p8X41llH5jLnYh3phLw23DXh/BoXEIqJENn+aRTlmTF0yTxE/wMwX\n ZokuspdY8jQawrFE1uZaYJMeNE+3sWdJpSpfBDLhQbnlGy7foStEO/lxvJjjXFcOm8\n DtMJdpKruNx/3EWPttC+1ogqGDsxeGze2UFRDoOxxfWbv47URv3MYyMq2qSwcO97Tj\n uOyFhOBHo/tf0Fx8U6nFOwwxBnik52J/tPPkqjYo0kfplouWDRmyk/1AsFS++8Wpqf\n FxQorXN7OvNPwDRwClq8ljkzP9srx+xJ8LxFwOMxBgt0WYPsD5QVVxcYmu9STRpSNx\n gUjFWNYkzsm0SyAo1IvQHw6BKRVJhOfwXYv2IClek921Q6lq4roWwbDUHm3/mPC4FQ\n AY/1pIQ8yMx3p1mJxN83JQcjAoBPF+7QhDXqzym4gj3MrsRxtv1299iwds/ypyUb/7\n mLhjqjPg4F23pxuEiv6RmI1CrCCTUEwckuQg76Cdri1qTnPP8i3aV6OGUCCQu9q4Wi\n xEK2kFiL5H7AzCdO/aRC3KMMbV8zEzp8oMdYaPrBfCNesk2IN33cjnxb+tjPZPANZw\n 5OR1TNqPsWr4HO8pTqfC3BBE/rRnoJUIpIwzM0fXI5CztNmRP3mthPJrf3BKPThQH8\n ZjO/nTV3ZHTpPIF2Vzkl8YNQ=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774647456; x=1775252256;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=htDTPzeNXOGx+FlU1JhzDSkCA98nhkgkFCHWup8YckE=;\n b=bJEu7OFYiJ8cCMrJ4/pIKAM2TijE4q5br0iPDu+zyVQbsKPa0pJrmV9wWEUD7qioy7\n RgsIOM0dVO55bw1KPm0Jh2hUADQ3GPYO1zFnNQlB4uOLOtXCl+Sv6GtXeTo44t51WSAd\n Ekunyar00jOegyxtdtL2j/uIaVxUo7Ha5qfDMY+viHEo7q0f8Bq4zGXEGOOGCq6Hfz6J\n T75oPgczmF49BhxKlZB1+klLMypnJjHTcfKWaiMsLlaKOhce06F6jLHf/dYdUWAQRcU6\n 7BNd+NZQIT71xMnOvtsQbl7ux2G+rnPEERRb3S5FFSClxmZxbaO7gpAEGqq2CjNIcyXY\n VBOg==", "X-Gm-Message-State": "AOJu0YyT9oeIvydafLKsl/VVk1mNc5zFaMwh4Fo+OLDRvYLv/sSrJm3p\n kRqKx6VoqsENytH6SkKJTo6TiM+KzdbCxrZNPmfRmcWDo3IFLU4w6qPB1gUy9g6yu6Q4ycfKNSm\n MzzcRi7HgCRByv3EiO4UhlQAza6irckFMB9mkkUdF2UJc8Nx4Hf+O0IENwmXMi1UWdPMH3TLlUT\n XUUPMxG0JFyaAp3w==", "X-Gm-Gg": "ATEYQzy3T6CcreVSEyaBPDkyuP1mR57DYKY5A5rRVXAyadAxN7X6qhwOuG6nVYe2B/3\n 8nAOQiP06kbt8AkMfdw5tSjZelAhpPt3x4ShAaDh3Vqw7Q54A2cVkFPg3Zy4hXqFiYL+vQiDKD5\n 0SlWfdmwCWbqDJ89pxQJxh670k0uTePAYsJlPVde9ur47v2b8DQpvWuVLm0Td1dr6NK9K5T5Cws\n Jrn9At7e1+FP334vzZvo+woIxlWpxpA9hk4ma9OLX6ALnf2c972/1PRoXX7qsRPLPwLL+TOaRpm\n v0hib5h7rjw3N8Af2ikI6JzvOmJE6075jsqN0AGS9INzWLDFG2SdmcJp897W6YEF6F8uDg8Klt0\n AAoMkr+xCRdEZtTVkLNMxkNJQBn67LisYcydnIGOLRu+ZReKblQ9xR9RWsJ52PARoct3QztSozP\n TXub2kCW+FLQ==", "X-Received": [ "by 2002:a05:620a:7002:b0:8cd:982d:411d with SMTP id\n af79cd13be357-8d01c7be11cmr563851285a.52.1774647455943;\n Fri, 27 Mar 2026 14:37:35 -0700 (PDT)", "by 2002:a05:620a:7002:b0:8cd:982d:411d with SMTP id\n af79cd13be357-8d01c7be11cmr563848185a.52.1774647455551;\n Fri, 27 Mar 2026 14:37:35 -0700 (PDT)" ], "From": "John Cabaj <john.cabaj@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][Q:linux-azure][PATCH 1/4] net: mana: Fix use-after-free in\n reset service rescan path", "Date": "Fri, 27 Mar 2026 16:37:29 -0500", "Message-ID": "<20260327213732.4049575-3-john.cabaj@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "References": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Dipayaan Roy <dipayanroy@linux.microsoft.com>\n\nBugLink: https://bugs.launchpad.net/bugs/2146588\n\nWhen mana_serv_reset() encounters -ETIMEDOUT or -EPROTO from\nmana_gd_resume(), it performs a PCI rescan via mana_serv_rescan().\n\nmana_serv_rescan() calls pci_stop_and_remove_bus_device(), which can\ninvoke the driver's remove path and free the gdma_context associated\nwith the device. After returning, mana_serv_reset() currently jumps to\nthe out label and attempts to clear gc->in_service, dereferencing a\nfreed gdma_context.\n\nThe issue was observed with the following call logs:\n[ 698.942636] BUG: unable to handle page fault for address: ff6c2b638088508d\n[ 698.943121] #PF: supervisor write access in kernel mode\n[ 698.943423] #PF: error_code(0x0002) - not-present page\n[S[ 698.943793] Pat Dec 6 07:GD5 100000067 P4D 1002f7067 PUD 1002f8067 PMD 101bef067 PTE 0\n0:56 2025] hv_[n e 698.944283] Oops: Oops: 0002 [#1] SMP NOPTI\ntvsc f8615163-00[ 698.944611] CPU: 28 UID: 0 PID: 249 Comm: kworker/28:1\n...\n[Sat Dec 6 07:50:56 2025] R10: [ 699.121594] mana 7870:00:00.0 enP30832s1: Configured vPort 0 PD 18 DB 16\n000000000000001b R11: 0000000000000000 R12: ff44cf3f40270000\n[Sat Dec 6 07:50:56 2025] R13: 0000000000000001 R14: ff44cf3f402700c8 R15: ff44cf3f4021b405\n[Sat Dec 6 07:50:56 2025] FS: 0000000000000000(0000) GS:ff44cf7e9fcf9000(0000) knlGS:0000000000000000\n[Sat Dec 6 07:50:56 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[Sat Dec 6 07:50:56 2025] CR2: ff6c2b638088508d CR3: 000000011fe43001 CR4: 0000000000b73ef0\n[Sat Dec 6 07:50:56 2025] Call Trace:\n[Sat Dec 6 07:50:56 2025] <TASK>\n[Sat Dec 6 07:50:56 2025] mana_serv_func+0x24/0x50 [mana]\n[Sat Dec 6 07:50:56 2025] process_one_work+0x190/0x350\n[Sat Dec 6 07:50:56 2025] worker_thread+0x2b7/0x3d0\n[Sat Dec 6 07:50:56 2025] kthread+0xf3/0x200\n[Sat Dec 6 07:50:56 2025] ? __pfx_worker_thread+0x10/0x10\n[Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10\n[Sat Dec 6 07:50:56 2025] ret_from_fork+0x21a/0x250\n[Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10\n[Sat Dec 6 07:50:56 2025] ret_from_fork_asm+0x1a/0x30\n[Sat Dec 6 07:50:56 2025] </TASK>\n\nFix this by returning immediately after mana_serv_rescan() to avoid\naccessing GC state that may no longer be valid.\n\nFixes: 9bf66036d686 (\"net: mana: Handle hardware recovery events when probing the device\")\nReviewed-by: Simon Horman <horms@kernel.org>\nReviewed-by: Long Li <longli@microsoft.com>\nSigned-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>\nLink: https://patch.msgid.link/20251218131054.GA3173@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\n\n(cherry picked from commit 3387a7ad478b46970ae8254049167d166e398aeb)\nSigned-off-by: John Cabaj <john.cabaj@canonical.com>\n---\n drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)", "diff": "diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c\nindex a0bb433e91dd..ce13e05f8624 100644\n--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c\n+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c\n@@ -481,7 +481,7 @@ static void mana_serv_reset(struct pci_dev *pdev)\n \t\t/* Perform PCI rescan on device if we failed on HWC */\n \t\tdev_err(&pdev->dev, \"MANA service: resume failed, rescanning\\n\");\n \t\tmana_serv_rescan(pdev);\n-\t\tgoto out;\n+\t\treturn;\n \t}\n \n \tif (ret)\n", "prefixes": [ "SRU", "Q:linux-azure", "1/4" ] }