linux-kernel - Re: [PATCH] net: bnxt: fix a potential use-after-free in bnxt_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACKFLimhHCAqs1APuhX9CWd5c9OQTV=RnA-Aague4SgQufE+_A@mail.gmail.com>
Date:   Mon, 4 Dec 2023 11:14:15 -0800
From:   Michael Chan <michael.chan@...adcom.com>
To:     Pavan Chebbi <pavan.chebbi@...adcom.com>
Cc:     Dinghao Liu <dinghao.liu@....edu.cn>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Sriharsha Basavapatna <sriharsha.basavapatna@...adcom.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: bnxt: fix a potential use-after-free in bnxt_init_tc

On Mon, Dec 4, 2023 at 12:56 AM Pavan Chebbi <pavan.chebbi@...adcom.com> wrote:
>
> On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@....edu.cn> wrote:
> >
> > When flow_indr_dev_register() fails, bnxt_init_tc will free
> > bp->tc_info through kfree(). However, the caller function
> > bnxt_init_one() will ignore this failure and call
> > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> > a use-after-free happens. Fix this issue by setting
> > bp->tc_info to NULL after kfree().
> >
> > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
> > Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
> > ---
> >  drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > index 38d89d80b4a9..273c9ba48f09 100644
> > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
> >         rhashtable_destroy(&tc_info->flow_table);
> >  free_tc_info:
> >         kfree(tc_info);
> > +       bp->tc_info = NULL;
> >         return rc;
> >  }
>
> The other way could have been to assign bp->tc_info only after
> flow_indr_dev_register succeeds.
> But this one works too. Thanks.
> Reviewed-by: Pavan Chebbi <pavan.chebbi@...adcom.com>

I think this is the correct fix.  flow_indr_dev_register(), if
successful, may call the driver's call back function and so
bp->tc_info must be set up before the call.  Thanks.

Reviewed-by: Michael Chan <michael.chan@...adcom.com>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4209 bytes)