-----Original Message-----
From: Intel-wired-lan <redacted> On Behalf
Of xuanqiang.luo@linux.dev
Sent: Tuesday, July 14, 2026 8:40 AM
To: intel-wired-lan@lists.osuosl.org
Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
Przemyslaw [off-list ref]; andrew+netdev@lunn.ch;
Samudrala, Sridhar [off-list ref]; Drewek, Wojciech
[off-list ref]; piotr.raczynski@intel.com;
michal.swiatkowski@linux.intel.com; Keller, Jacob E
[off-list ref]; netdev@vger.kernel.org; Xuanqiang Luo
[off-list ref]; stable@vger.kernel.org
Subject: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free
in dynamic port cleanup

From: Xuanqiang Luo <redacted>

ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the
dynamic port from pf->dyn_ports. However, it frees the VSI before
reading the index for the erase, resulting in a use-after-free.

Follow the reverse of the allocation order in ice_alloc_dynamic_port()
by erasing the xarray entry before freeing the VSI.

Fixes: eda69d654c7e ("ice: add basic devlink subfunctions support")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <redacted>
---
 drivers/net/ethernet/intel/ice/devlink/port.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c

b/drivers/net/ethernet/intel/ice/devlink/port.c
index 2a2e56777f9f7..3ede246490027 100644

--- a/drivers/net/ethernet/intel/ice/devlink/port.c
+++ b/drivers/net/ethernet/intel/ice/devlink/port.c

@@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct

ice_dynamic_port *dyn_port)

 	xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
 	ice_eswitch_detach_sf(pf, dyn_port);
-	ice_vsi_free(dyn_port->vsi);
 	xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
+	ice_vsi_free(dyn_port->vsi);
 	kfree(dyn_port);
 }

--
2.43.0