netdev - Re: [PATCH net] hsr: Prevent use after free in prp_create_tagged

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 31 Oct 2023 13:15:08 +0100
From: Paolo Abeni <pabeni@...hat.com>
To: Dan Carpenter <dan.carpenter@...aro.org>, Murali Karicheri
	 <m-karicheri2@...com>
Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
 <edumazet@...gle.com>,  Jakub Kicinski <kuba@...nel.org>, Sebastian Andrzej
 Siewior <bigeasy@...utronix.de>,  YueHaibing <yuehaibing@...wei.com>,
 Ziyang Xuan <william.xuanziyang@...wei.com>, netdev@...r.kernel.org, 
 kernel-janitors@...r.kernel.org
Subject: Re: [PATCH net] hsr: Prevent use after free in
 prp_create_tagged_frame()

On Fri, 2023-10-27 at 15:19 +0300, Dan Carpenter wrote:
> The prp_fill_rct() function can fail.  In that situation, it frees the
> skb and returns NULL.  Meanwhile on the success path, it returns the
> original skb.  So it's straight forward to fix bug by using the returned
> value.
> 
> Fixes: 451d8123f897 ("net: prp: add packet handling support")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
>  net/hsr/hsr_forward.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
> index b71dab630a87..80cdc6f6b34c 100644
> --- a/net/hsr/hsr_forward.c
> +++ b/net/hsr/hsr_forward.c
> @@ -342,9 +342,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame,
>  	skb = skb_copy_expand(frame->skb_std, 0,
>  			      skb_tailroom(frame->skb_std) + HSR_HLEN,
>  			      GFP_ATOMIC);
> -	prp_fill_rct(skb, frame, port);
> -
> -	return skb;
> +	return prp_fill_rct(skb, frame, port);
>  }
>  
>  static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,

Acked-by: Paolo Abeni <pabeni@...hat.com>

(note both trees are currently locked now due to the pending PR; this
tag is intended to speed-up the merge after the PR itself)