lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <DM6PR13MB3705EDC32EDE9FD97DA47F8EFC659@DM6PR13MB3705.namprd13.prod.outlook.com> Date: Wed, 10 Aug 2022 04:31:36 +0000 From: Yinjun Zhang <yinjun.zhang@...igine.com> To: Jialiang Wang <wangjialiang0806@....com>, Simon Horman <simon.horman@...igine.com>, "kuba@...nel.org" <kuba@...nel.org>, "davem@...emloft.net" <davem@...emloft.net>, "edumazet@...gle.com" <edumazet@...gle.com>, "pabeni@...hat.com" <pabeni@...hat.com>, "niejianglei2021@....com" <niejianglei2021@....com> CC: oss-drivers <oss-drivers@...igine.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Subject: RE: [PATCH v2] nfp: fix use-after-free in area_cache_get() On Wed, 10 Aug 2022 12:04:45 +0800 Jialiang Wang wrote: > diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c > b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c > index 34c0d2ddf9ef..a83b8ee49062 100644 > --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c > +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c > @@ -873,10 +873,6 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, > cache->addr = 0; > } > > - /* Adjust the start address to be cache size aligned */ > - cache->id = id; > - cache->addr = addr & ~(u64)(cache->size - 1); > - > /* Re-init to the new ID and address */ > if (cpp->op->area_init) { > err = cpp->op->area_init(cache->area, > @@ -894,6 +890,10 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, > return NULL; > } > > + /* Adjust the start address to be cache size aligned */ > + cache->id = id; > + cache->addr = addr & ~(u64)(cache->size - 1); `cache->addr` is used in `area_init`, so it should be set in advance. > + > exit: > /* Adjust offset */ > *offset = addr - cache->addr; > -- > 2.17.1
Powered by blists - more mailing lists