net: ena: PHC: Fix potential use-after-free in get_timestamp

Move the phc->active check and resp pointer assignment to after
acquiring the spinlock. Previously, phc->active was checked without
holding the lock, and resp was cached from ena_dev->phc.virt_addr
before the lock was acquired.

If ena_com_phc_destroy() runs between the lockless active check and
the lock acquisition, it sets active=false, releases the lock, frees
the DMA memory, and sets virt_addr=NULL. The get_timestamp path would
then read a NULL virt_addr and dereference it.

With both the active check and the pointer read under the lock,
destroy cannot free the memory while get_timestamp is using it.

Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver")
Cc: stable@vger.kernel.org
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260508062126.7273-1-akiyano@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index e67b592e569763a28c054832711d3f0e1fd07105..8c86789d867a5f07bafd16a8528b8ad8c68783be 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -1782,20 +1782,23 @@ void ena_com_phc_destroy(struct ena_com_dev *ena_dev)
 
 int ena_com_phc_get_timestamp(struct ena_com_dev *ena_dev, u64 *timestamp)
 {
-       volatile struct ena_admin_phc_resp *resp = ena_dev->phc.virt_addr;
        const ktime_t zero_system_time = ktime_set(0, 0);
        struct ena_com_phc_info *phc = &ena_dev->phc;
+       volatile struct ena_admin_phc_resp *resp;
        ktime_t expire_time;
        ktime_t block_time;
        unsigned long flags = 0;
        int ret = 0;
 
+       spin_lock_irqsave(&phc->lock, flags);
+
        if (!phc->active) {
+               spin_unlock_irqrestore(&phc->lock, flags);
                netdev_err(ena_dev->net_device, "PHC feature is not active in the device\n");
                return -EOPNOTSUPP;
        }
 
-       spin_lock_irqsave(&phc->lock, flags);
+       resp = ena_dev->phc.virt_addr;
 
        /* Check if PHC is in blocked state */
        if (unlikely(ktime_compare(phc->system_time, zero_system_time))) {