linux-kernel - Re: [PATCH net 2/3] net: hns3: fix a use after free problem in hns3_nic_maybe_stop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 02 Dec 2019 19:28:40 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     tanhuazhong@...wei.com
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        salil.mehta@...wei.com, yisen.zhuang@...wei.com,
        linuxarm@...wei.com, jakub.kicinski@...ronome.com,
        linyunsheng@...wei.com
Subject: Re: [PATCH net 2/3] net: hns3: fix a use after free problem in
 hns3_nic_maybe_stop_tx()

From: Huazhong Tan <tanhuazhong@...wei.com>
Date: Tue, 3 Dec 2019 11:08:54 +0800

> From: Yunsheng Lin <linyunsheng@...wei.com>
> 
> Currently, hns3_nic_maybe_stop_tx() uses skb_copy() to linearize a
> SKB if the BD num required by the SKB does not meet the hardware
> limitation, and it linearizes the SKB by allocating a new SKB and
> freeing the old SKB, if hns3_nic_maybe_stop_tx() returns -EBUSY,
> the sch_direct_xmit() still hold reference to old SKB and try to
> retransmit the old SKB when dev_hard_start_xmit() return TX_BUSY,
> which may cause use after freed problem.
> 
> This patch fixes it by using __skb_linearize() to linearize the
> SKB in hns3_nic_maybe_stop_tx().
> 
> Fixes: 51e8439f3496 ("net: hns3: add 8 BD limit for tx flow")
> Signed-off-by: Yunsheng Lin <linyunsheng@...wei.com>
> Signed-off-by: Huazhong Tan <tanhuazhong@...wei.com>

That's not what I see.

You're freeing the SKB in the caller of hns3_nic_maybe_stop_tx()
in the -ENOMEM case, not the generic qdisc code.

Standing practice is to always return NETIF_TX_OK in this case
and just pretend the frame was sent.

Grep for __skb_linearize use throughout various drivers to see
what I mean.  i40e is just one of several examples.