linux-kernel - Re: [RESEND PATCH net 1/2] iavf: Fix use-after-free in free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZD+BPjGImmvwVd3G@corigine.com>
Date:   Wed, 19 Apr 2023 07:50:54 +0200
From:   Simon Horman <simon.horman@...igine.com>
To:     Ding Hui <dinghui@...gfor.com.cn>
Cc:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, intel-wired-lan@...ts.osuosl.org,
        jesse.brandeburg@...el.com, anthony.l.nguyen@...el.com,
        keescook@...omium.org, grzegorzx.szczurek@...el.com,
        mateusz.palczewski@...el.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
        pengdonglin@...gfor.com.cn, huangcun@...gfor.com.cn
Subject: Re: [RESEND PATCH net 1/2] iavf: Fix use-after-free in free_netdev

On Wed, Apr 19, 2023 at 09:11:37AM +0800, Ding Hui wrote:
> On 2023/4/19 3:48, Simon Horman wrote:
> > Hi Ding Hui,
> > 
> > On Mon, Apr 17, 2023 at 03:40:15PM +0800, Ding Hui wrote:
> > > We do netif_napi_add() for all allocated q_vectors[], but potentially
> > > do netif_napi_del() for part of them, then kfree q_vectors and lefted
> > 
> > nit: lefted -> leave
> > 
> 
> Thanks, I'll update in v2.
> 
> > > invalid pointers at dev->napi_list.
> > > 
> > > If num_active_queues is changed to less than allocated q_vectors[] by
> > > unexpected, when iavf_remove, we might see UAF in free_netdev like this:
> > > 
> 
> ...
> 
> > > 
> > > Fix it by letting netif_napi_del() match to netif_napi_add().
> > > 
> > > Signed-off-by: Ding Hui <dinghui@...gfor.com.cn>
> > > Cc: Donglin Peng <pengdonglin@...gfor.com.cn>
> > > CC: Huang Cun <huangcun@...gfor.com.cn>
> > 
> > as this is a fix it probably should have a fixes tag.
> > I wonder if it should be:
> > 
> > Fixes: cc0529271f23 ("i40evf: don't use more queues than CPUs")
> 
> I don't think so.
> I searched the git log, and found that the mismatched usage was
> introduced since the beginning of i40evf_main.c, so I'll add
> 
> Fixes: 5eae00c57f5e ("i40evf: main driver core")

Yes, agreed, that is the right tag.