macsec_del_rxsc_ctx() frees the RX SC metadata_dst via metadata_dst_free(), which directly kfree()s the object and ignores the dst_entry refcount. The MACsec RX offload datapath mlx5e_macsec_offload_handle_rx_skb() takes a reference on this dst with dst_hold() and attaches it to the skb via skb_dst_set(). If such an skb is still in flight when the RX SC is deleted, the metadata_dst is freed while the skb still references it; the subsequent dst_release() on skb free then operates on already-freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after the last reference is dropped. The dst subsystem frees metadata_dst objects from dst_destroy() once the refcount reaches zero (DST_METADATA is set by metadata_dst_alloc()). Same class of bug and fix as commit c32b26aaa2f9 ("netfilter: nft_tunnel: fix use-after-free on object destroy"). Fixes: 9b9e23c4dc2b ("net/mlx5e: MACsec, fix memory leak when MACsec device is deleted") Cc: stable@vger.kernel.org Signed-off-by: Doruk Tan Ozturk --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index 71b3a059c964..2a4e7ed76d31 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -829,7 +829,7 @@ static void macsec_del_rxsc_ctx(struct mlx5e_macsec *macsec, struct mlx5e_macsec */ list_del_rcu(&rx_sc->rx_sc_list_element); xa_erase(&macsec->sc_xarray, rx_sc->sc_xarray_element->fs_id); - metadata_dst_free(rx_sc->md_dst); + dst_release(&rx_sc->md_dst->dst); kfree(rx_sc->sc_xarray_element); kfree_rcu_mightsleep(rx_sc); } -- 2.43.0