linux-kernel - drivers/net/ethernet/microchip/sparx5/sparx5_packet.c:147 sparx5_xtr_grp() error: dereferencing freed memory 'skb'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 1 Feb 2022 12:25:29 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Steen Hegelund <steen.hegelund@...rochip.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org,
        Bjarni Jonasson <bjarni.jonasson@...rochip.com>,
        Lars Povlsen <lars.povlsen@...rochip.com>
Subject: drivers/net/ethernet/microchip/sparx5/sparx5_packet.c:147
 sparx5_xtr_grp() error: dereferencing freed memory 'skb'

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   26291c54e111ff6ba87a164d85d4a4e134b7315c
commit: f3cad2611a77f0229dc16aa7bd2ef63e35ea9fb6 net: sparx5: add hostmode with phylink support
config: nios2-randconfig-m031-20220130 (https://download.01.org/0day-ci/archive/20220201/202202011757.Azj3HHCb-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c:147 sparx5_xtr_grp() error: dereferencing freed memory 'skb'

vim +/skb +147 drivers/net/ethernet/microchip/sparx5/sparx5_packet.c

f3cad2611a77f0 Steen Hegelund 2021-06-24  134  	if (abort_flag || pruned_flag || !eof_flag) {
f3cad2611a77f0 Steen Hegelund 2021-06-24  135  		netdev_err(netdev, "Discarded frame: abort:%d pruned:%d eof:%d\n",
f3cad2611a77f0 Steen Hegelund 2021-06-24  136  			   abort_flag, pruned_flag, eof_flag);
f3cad2611a77f0 Steen Hegelund 2021-06-24  137  		kfree_skb(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24  138  		netdev->stats.rx_dropped++;
f3cad2611a77f0 Steen Hegelund 2021-06-24  139  		return;
f3cad2611a77f0 Steen Hegelund 2021-06-24  140  	}
f3cad2611a77f0 Steen Hegelund 2021-06-24  141  
f3cad2611a77f0 Steen Hegelund 2021-06-24  142  	/* Finish up skb */
f3cad2611a77f0 Steen Hegelund 2021-06-24  143  	skb_put(skb, byte_cnt - ETH_FCS_LEN);
f3cad2611a77f0 Steen Hegelund 2021-06-24  144  	eth_skb_pad(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24  145  	skb->protocol = eth_type_trans(skb, netdev);
f3cad2611a77f0 Steen Hegelund 2021-06-24  146  	netif_rx(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24 @147  	netdev->stats.rx_bytes += skb->len;
                                                                          ^^^^^^^^
The netif_rx() function will free the skb.

f3cad2611a77f0 Steen Hegelund 2021-06-24  148  	netdev->stats.rx_packets++;
f3cad2611a77f0 Steen Hegelund 2021-06-24  149  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org