Re: [PATCH net-next v8 12/17] net: macb: change function signatures to take contexts

Replying to sashiko
https://sashiko.dev/#/patchset/20260805-macb-context-v8-0-bc302ffd1174%40bootlin.com

> commit c728638bed1b685fcac80f81dd0aefb9dae1f050
> Author: Théo Lebrun <[email protected]>
> Subject: net: macb: change function signatures to take contexts
>
> To support parallel contexts, this patch updates multiple functions to
> take a context pointer directly rather than reading it from the active
> context (bp->ctx). Functions handling queues are also updated to accept
> the queue index explicitly.
>
> > @@ -3307,7 +3330,7 @@ static int macb_close(struct net_device *netdev)
> >  	netif_carrier_off(netdev);
> >  	spin_unlock_irqrestore(&bp->lock, flags);
> >  
> > -	macb_free(bp);
> > +	macb_free(bp->ctx);
> >  	kfree(bp->ctx);
> >  	bp->ctx = NULL;
>
> [Severity: High]
> Could the context pointer be used after it is freed?
>
> If a TX or HRESP error interrupt fires right before macb_close() disables
> hardware interrupts, it will schedule queue->tx_error_task or
> bp->hresp_err_bh_work.
>
> In macb_close(), the active network context (bp->ctx) is freed and set to NULL,
> but cancel_work_sync() is not called to stop the pending work items.
> When the work runs, it will attempt to read queue->bp->ctx or bp->ctx,
> resulting in a NULL pointer dereference or use-after-free.

Pre-existing issue but not flagged as such.
Related to the close op, not context swapping.

Thanks,
-- 
Théo Lebrun, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com