Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217326/?format=api
{ "id": 2217326, "url": "http://patchwork.ozlabs.org/api/patches/2217326/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-2-john.cabaj@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260327213732.4049575-2-john.cabaj@canonical.com>", "list_archive_url": null, "date": "2026-03-27T21:37:28", "name": "[SRU,R:linux-azure,1/1] net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "29c6dd5a62bc410167173827ba05e8d3ec86fe25", "submitter": { "id": 85032, "url": "http://patchwork.ozlabs.org/api/people/85032/?format=api", "name": "John Cabaj", "email": "john.cabaj@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260327213732.4049575-2-john.cabaj@canonical.com/mbox/", "series": [ { "id": 497834, "url": "http://patchwork.ozlabs.org/api/series/497834/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=497834", "date": "2026-03-27T21:37:28", "name": "[SRU,R:linux-azure,1/1] net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497834/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217326/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217326/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=OOIlDi8y;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fjDWy596Rz20LG\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 28 Mar 2026 08:37:50 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w6Es7-0003zN-0a; Fri, 27 Mar 2026 21:37:39 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <john.cabaj@canonical.com>)\n id 1w6Es4-0003yR-DE\n for kernel-team@lists.ubuntu.com; Fri, 27 Mar 2026 21:37:36 +0000", "from mail-qk1-f199.google.com (mail-qk1-f199.google.com\n [209.85.222.199])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 412AB3F601\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 21:37:36 +0000 (UTC)", "by mail-qk1-f199.google.com with SMTP id\n af79cd13be357-8cd827a356aso644929485a.3\n for <kernel-team@lists.ubuntu.com>; Fri, 27 Mar 2026 14:37:36 -0700 (PDT)", "from smtp.gmail.com\n (h208-73-92-250.mdtnwi.broadband.dynamic.tds.net. [208.73.92.250])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8d027f0e687sm32939685a.18.2026.03.27.14.37.34\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 27 Mar 2026 14:37:34 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1774647456;\n bh=QumL0l/uPQ46h+JZ0MTqX8pgZdKrYDw+ugVb8shQLTQ=;\n h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=OOIlDi8ystoXqh2E87ciyHgbaNMXuldZypJSunVuy6SavF4Kx3Z/1Sghsov8J00zf\n zteMsGSu+T8/n1CnjwaEXkK9YSnamDAbzwl9KEp9Skou412taIr9at+PARkjSFukQd\n YR35+DiuxPqcEh0iG2EOlM+uTWCAfFZ05KOGqqu/LsgUF6aUHUecQjwt8ysT0KB3Na\n 4C4OM7t7aHgStNYj4z2a/ym4QAQqU7pVX9qw+nurtCo/DT+FRr7ShnIjLBjD4MfYDh\n 6xmm+c+BbtahKrJ23sQ0P4pCOWdpA0HpvaIUZ1DBPxGhCvdGMpriy2qQs+Z0+NvInQ\n AuT98qEN8N5xVdRV/UUl7B7WDdLCitloG7+wzhBYbtjpCq2vG/PuEoV37NNjbLzPcX\n CqZrtAOrKJyDXj2djvTnTPgZrDlmVn8zdmoQRUHKm6WszXoM66feFSaUIjlhz8vMp2\n 2PU3FoFN6lKTSt1O5OPP7T/d1ZGXNUSNEjQPHGSmWbpb51yVV4GnHkb8M44wMpbBiY\n SOo18YQHt4FVAtak9jPn0qL3uFKEpyo+PcBhDvbW2RRbJh38xBDjDBy2I80DKwuOEz\n EiJsBI1Z5LeoQM4TACruuF33ioTBWJkwKU96LcbqgZy9xsjUwYnXudVg0sVy1kdgsZ\n F9YLAJa4lrPLI3O/OaXj87M4=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774647455; x=1775252255;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=QumL0l/uPQ46h+JZ0MTqX8pgZdKrYDw+ugVb8shQLTQ=;\n b=P34VzSpWx0hHFp++tOXS89yRS6NdLpWe7zyiO7Sr/N+TFlsOCz1v5pSoabfGYPT5Vn\n vFTSl5HuyThRfKMPv65hXhhcoQllEx1drsQt7fTlOuauFU/06NSyaY0ydBdOPLZUGEmA\n 7NQRdJXU47WzWr2i2NUWTk+kgHOqf4ntj56M3/LtvLHCil8PA9+TraoqCSNJbcxxPMzO\n qdP9lmxGm8InMiVZMyG4CTVberM9ZF/eZpqBmrPlZZu8q1x0oNrvakOZS4bHzpwxq444\n IeIfH+WZb9AZPYB2XJclghU5MHDEQnWQszkc4+yxyyoUuk2t/nNw0DVKiOi5mmTGlH8u\n hRpw==", "X-Gm-Message-State": "AOJu0YznAxEDUy6iHyd6omKkNo/u0mA8BNJRXGw9W79NmARhpU13mtzX\n y5LBuLj9+XMyekLdexsPyeWWAg7J119calQRbr00pX0yvRBCR2SGIbEiNWLofQ3QFuZHruSFD8d\n uTus8eKyYb+AI6HmQTEfxxowazVPHfxbP7bW5to0ammfkIxW02YXq2HHV/lFNM82Q2faA8I5O6H\n QNaVef94Zpf8Q8Ow==", "X-Gm-Gg": "ATEYQzyslpZPqtHn7LE3DanP7KkiJ01CR0XZa7UrVDBhcw58Uat3D98KJJWF8lVsFdU\n JYsIoPQSMXem8D3J7a9u8feIOpAfLEGzDm0lxzcTTeKaQyjFWq+bI8mJRhvGEUUeiHHjHNJxFhd\n aSvl4DPNikyrGbRPF9C/uggu81wjL47vdn5eNgZwBpAOEpbTalHRab2bL+aqOSSiQicL0Z+AJLk\n BwK5FqvWsicsVPQnODgNjcmhGL2jmNlhi7eh9YfpHJxoHfjZGfksH6gioX1Bd9t3FiBF+iJi3Jr\n k8sNAHfamRtIW8L35LetCeVpASndArGrbtm7EwhA+c/bsax8ENvPmZuc3QqX25zKaM9O9xIK9J2\n yCaGkLbwBBVsgHlv4gvGxYJHBdRdjVSE/u31MUB/rvp+tjnLJbn5mkg+OWtcUqZQWoX28HOHDfL\n KAsOYueMTO4Q==", "X-Received": [ "by 2002:a05:620a:45a2:b0:8cf:de7b:42a8 with SMTP id\n af79cd13be357-8d01c663b9cmr513878685a.25.1774647455266;\n Fri, 27 Mar 2026 14:37:35 -0700 (PDT)", "by 2002:a05:620a:45a2:b0:8cf:de7b:42a8 with SMTP id\n af79cd13be357-8d01c663b9cmr513876785a.25.1774647454860;\n Fri, 27 Mar 2026 14:37:34 -0700 (PDT)" ], "From": "John Cabaj <john.cabaj@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][R:linux-azure][PATCH 1/1] net: mana: fix use-after-free in\n mana_hwc_destroy_channel() by reordering teardown", "Date": "Fri, 27 Mar 2026 16:37:28 -0500", "Message-ID": "<20260327213732.4049575-2-john.cabaj@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "References": "<20260327213732.4049575-1-john.cabaj@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Dipayaan Roy <dipayanroy@linux.microsoft.com>\n\nBugLink: https://bugs.launchpad.net/bugs/2146588\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq->msg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.\n\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nReviewed-by: Haiyang Zhang <haiyangz@microsoft.com>\nSigned-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>\nReviewed-by: Simon Horman <horms@kernel.org>\nLink: https://patch.msgid.link/abHA3AjNtqa1nx9k@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>\n(cherry picked from commit fa103fc8f56954a60699a29215cb713448a39e87)\nSigned-off-by: John Cabaj <john.cabaj@canonical.com>\n---\n drivers/net/ethernet/microsoft/mana/hw_channel.c | 6 +++---\n 1 file changed, 3 insertions(+), 3 deletions(-)", "diff": "diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c\nindex ba3467f1e2ea..48a9acea4ab6 100644\n--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c\n+++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c\n@@ -814,9 +814,6 @@ void mana_hwc_destroy_channel(struct gdma_context *gc)\n \t\tgc->max_num_cqs = 0;\n \t}\n \n-\tkfree(hwc->caller_ctx);\n-\thwc->caller_ctx = NULL;\n-\n \tif (hwc->txq)\n \t\tmana_hwc_destroy_wq(hwc, hwc->txq);\n \n@@ -826,6 +823,9 @@ void mana_hwc_destroy_channel(struct gdma_context *gc)\n \tif (hwc->cq)\n \t\tmana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);\n \n+\tkfree(hwc->caller_ctx);\n+\thwc->caller_ctx = NULL;\n+\n \tmana_gd_free_res_map(&hwc->inflight_msg_res);\n \n \thwc->num_inflight_msg = 0;\n", "prefixes": [ "SRU", "R:linux-azure", "1/1" ] }