typo: teh->the #223
Closed
typo: teh->the #223
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Because it matters
|
Thanks |
|
Github Pull Requests are not accepted for this project. You must submit a patch to the Kernel Mailing List. The procedures are outlined here: http://kernelnewbies.org/UpstreamMerge/SubmittingPatches Please close this PR. |
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 17, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 21, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 22, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 23, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 23, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 26, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 27, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 29, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 30, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 31, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Jul 31, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 6, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 11, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 12, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 12, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 13, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 14, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
pkitszel
pushed a commit
to pkitszel/linux
that referenced
this pull request
Aug 14, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 14, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 15, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 16, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 17, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 18, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 19, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 21, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 22, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 22, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 27, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
intel-lab-lkp
pushed a commit
to intel-lab-lkp/linux
that referenced
this pull request
Aug 27, 2025
The following (and similar) KFENCE bugs have recently been found occurring during certain error flows of the ice_probe() function: kernel: ================================================================== kernel: BUG: KFENCE: use-after-free read in ice_cleanup_fltr_mgmt_struct+0x1d kernel: Use-after-free read at 0x00000000e72fe5ed (in kfence-torvalds#223): kernel: ice_cleanup_fltr_mgmt_struct+0x1d/0x200 [ice] kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_probe+0x245/0x2e0 [ice] kernel: kernel: kfence-torvalds#223: <..snip..> kernel: allocated by task 7553 on cpu 0 at 2243.527621s (198.108303s ago): kernel: devm_kmalloc+0x57/0x120 kernel: ice_init_hw+0x491/0x8e0 [ice] kernel: ice_probe+0x203/0x2e0 [ice] kernel: kernel: freed by task 7553 on cpu 0 at 2441.509158s (0.175707s ago): kernel: ice_deinit_hw+0x1e/0x60 [ice] kernel: ice_init+0x1ad/0x570 [ice] kernel: ice_probe+0x22b/0x2e0 [ice] kernel: kernel: ================================================================== These occur as the result of a double-call to ice_deinit_hw(). This double call happens if ice_init() fails at any point after calling ice_init_dev(). Upon errors, ice_init() calls ice_deinit_dev(), which is supposed to be the inverse of ice_init_dev(). However, currently ice_init_dev() does not call ice_init_hw(). Instead, ice_init_hw() is called by ice_probe(). Thus, ice_probe() itself calls ice_deinit_hw() as part of its error cleanup logic. This results in two calls to ice_deinit_hw() which results in straight forward use-after-free violations due to double calling kfree and other cleanup functions. To avoid this double call, move the call to ice_init_hw() into ice_init_dev(), and remove the now logically unnecessary cleanup from ice_probe(). This is simpler than the alternative of moving ice_deinit_hw() *out* of ice_deinit_dev(). Moving the calls to ice_deinit_hw() requires validating all cleanup paths, and changing significantly more code. Moving the calls of ice_init_hw() requires only validating that the new placement is still prior to all HW structure accesses. For ice_probe(), this now delays ice_init_hw() from before ice_adapter_get() to just after it. This is safe, as ice_adapter_get() does not rely on the HW structure. For ice_devlink_reinit_up(), the ice_init_hw() is now called after ice_set_min_max_msix(). This is also safe as that function does not access the HW structure either. This flow makes more logical sense, as ice_init_dev() is mirrored by ice_deinit_dev(), so it reasonably should be the caller of ice_init_hw(). It also reduces one extra call to ice_init_hw() since both ice_probe() and ice_devlink_reinit_up() call ice_init_dev(). This resolves the double-free and avoids memory corruption and other invalid memory accesses in the event of a failed probe. Fixes: 5b246e5 ("ice: split probe into smaller functions") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Because it matters.
And....
Hodor.