[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <99f7ebc7-5703-4ed2-853d-fcbbf8c074e1@intel.com>
Date: Fri, 3 Nov 2023 13:50:33 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Eric Dumazet <edumazet@...gle.com>, "David S . Miller"
<davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>
CC: <netdev@...r.kernel.org>, <eric.dumazet@...il.com>, Joshua Hay
<joshua.a.hay@...el.com>, Alan Brady <alan.brady@...el.com>, Madhu Chittim
<madhu.chittim@...el.com>, Phani Burra <phani.r.burra@...el.com>, "Sridhar
Samudrala" <sridhar.samudrala@...el.com>, Willem de Bruijn
<willemb@...gle.com>, Pavan Kumar Linga <pavan.kumar.linga@...el.com>, "Tony
Nguyen" <anthony.l.nguyen@...el.com>, Bailey Forrest <bcf@...gle.com>
Subject: Re: [PATCH net] idpf: fix potential use-after-free in idpf_tso()
On 11/3/2023 1:04 PM, Eric Dumazet wrote:
> skb_cow_head() can change skb->head (and thus skb_shinfo(skb))
>
> We must not cache skb_shinfo(skb) before skb_cow_head().
>
> Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Joshua Hay <joshua.a.hay@...el.com>
> Cc: Alan Brady <alan.brady@...el.com>
> Cc: Madhu Chittim <madhu.chittim@...el.com>
> Cc: Phani Burra <phani.r.burra@...el.com>
> Cc: Sridhar Samudrala <sridhar.samudrala@...el.com>
> Cc: Willem de Bruijn <willemb@...gle.com>
> Cc: Pavan Kumar Linga <pavan.kumar.linga@...el.com>
> Cc: Tony Nguyen <anthony.l.nguyen@...el.com>
> Cc: Bailey Forrest <bcf@...gle.com>
> ---
Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>
> drivers/net/ethernet/intel/idpf/idpf_txrx.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 5e1ef70d54fe4147a42e5a3263b73cd3e6316679..1f728a9004d9e40d4434534422a42c8c537f5eae 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -2365,7 +2365,7 @@ static void idpf_tx_splitq_map(struct idpf_queue *tx_q,
> */
> int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
> {
> - const struct skb_shared_info *shinfo = skb_shinfo(skb);
> + const struct skb_shared_info *shinfo;
> union {
> struct iphdr *v4;
> struct ipv6hdr *v6;
> @@ -2379,13 +2379,15 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
> u32 paylen, l4_start;
> int err;
>
> - if (!shinfo->gso_size)
> + if (!skb_is_gso(skb))
> return 0;
>
> err = skb_cow_head(skb, 0);
> if (err < 0)
> return err;
>
> + shinfo = skb_shinfo(skb);
> +
> ip.hdr = skb_network_header(skb);
> l4.hdr = skb_transport_header(skb);
>
Powered by blists - more mailing lists