Re: [PATCH net v3 1/2] iavf: Fix use-after-free in free_netdev

[Ding Hui <dinghui@sangfor.com.cn>]

On 2023/5/1 15:01, Simon Horman wrote:
> On Sat, Apr 29, 2023 at 09:20:21PM +0800, Ding Hui wrote:
>> We do netif_napi_add() for all allocated q_vectors[], but potentially
>> do netif_napi_del() for part of them, then kfree q_vectors and leave
>> invalid pointers at dev->napi_list.
>>
>> ...
>>
>> Although the patch #2 (of 2) can avoid the issuse triggered by this
>> repro.sh, there still are other potential risks that if num_active_queues
>> is changed to less than allocated q_vectors[] by unexpected, the
>> mismatched netif_napi_add/del() can also casue UAF.
> 
> nit: ./checkpatch --codespell tells me:
> 
>       s/casue/cause/
> 

Sorry, I'll fix it in v4.

>> Since we actually call netif_napi_add() for all allocated q_vectors
>> unconditionally in iavf_alloc_q_vectors(), so we should fix it by
>> letting netif_napi_del() match to netif_napi_add().
>>
>> Fixes: 5eae00c57f5e ("i40evf: main driver core")
>> Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
>> Cc: Donglin Peng <pengdonglin@sangfor.com.cn>
>> Cc: Huang Cun <huangcun@sangfor.com.cn>
>> Reviewed-by: Simon Horman <simon.horman@corigine.com>
>> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
>> Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
> 
> 
> 

-- 
Thanks,
-dinghui