[PATCH net 3/6] net: enetc: fix use-after-free in mailbox cleanup on interrupt race

[Wei Fang]

Sashiko reported a use-after-free issue in the PF mailbox teardown path
due to incorrect shutdown ordering [1].

In enetc_msg_psi_free(), cancel_work_sync() is called before disabling
the hardware MR interrupt and unregistering the interrupt handler via
free_irq(). This creates a race window where:

1. cancel_work_sync() completes and returns
2. A hardware interrupt arrives and enetc_msg_psi_msix() executes
3. The interrupt handler calls schedule_work(&pf->msg_task),
   re-queuing the work
4. enetc_msg_free_mbx() frees the mailbox DMA buffers
5. The re-queued msg_task work runs and accesses freed memory

The timeline of the race:

  CPU0 (teardown)                   CPU1 (interrupt)
  ================                  ================
  cancel_work_sync()
    -> work cancelled
                                    <interrupt>
                                    enetc_msg_psi_msix()
                                      schedule_work() // work re-queued!
  enetc_msg_disable_mr_int()
  enetc_msg_free_mbx()
    -> DMA buffers freed
  free_irq()
                                    worker runs
                                    -> UAF: access freed rxmsg[]

Fix by reordering the teardown sequence to follow proper driver shutdown
discipline:

1. Synchronously unregister interrupt handler (free_irq)
   - Waits for any running handler to complete
   - Guarantees no more schedule_work() calls after this point
2. Cancel pending work (cancel_work_sync)
   - Now safe, as no new work can be queued
3. Free mailbox resources (enetc_msg_free_mbx)
   - All accessors have stopped
4. Disable hardware interrupt source (enetc_msg_disable_mr_int)
   - Clean up hardware state (defense in depth)

After free_irq() returns, the interrupt handler cannot run anymore,
eliminating the possibility of work re-queuing after cancellation. This
ensures mailbox buffers are only freed after all potential accessors
have been shut down.

Link: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1
Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support")
Signed-off-by: Wei Fang <wei.fang@xxxxxxx>
---
 drivers/net/ethernet/freescale/enetc/enetc_msg.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_msg.c b/drivers/net/ethernet/freescale/enetc/enetc_msg.c
index 40d22ebe9224..fe9680a97b0e 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_msg.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_msg.c
@@ -151,14 +151,14 @@ void enetc_msg_psi_free(struct enetc_pf *pf)
 	struct enetc_si *si = pf->si;
 	int i;
 
-	cancel_work_sync(&pf->msg_task);
+	/* de-register message passing interrupt handler */
+	free_irq(pci_irq_vector(si->pdev, ENETC_SI_INT_IDX), si);
 
-	/* disable MR interrupts */
-	enetc_msg_disable_mr_int(&si->hw);
+	cancel_work_sync(&pf->msg_task);
 
 	for (i = 0; i < pf->num_vfs; i++)
 		enetc_msg_free_mbx(si, i);
 
-	/* de-register message passing interrupt handler */
-	free_irq(pci_irq_vector(si->pdev, ENETC_SI_INT_IDX), si);
+	/* disable MR interrupts */
+	enetc_msg_disable_mr_int(&si->hw);
 }
-- 
2.34.1