[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOBf=msuHEJOxtOhTd3-Pqg4EG4PS4+o0jLgLO5db59fkKC=gA@mail.gmail.com>
Date: Tue, 5 Dec 2023 08:24:25 +0530
From: Somnath Kotur <somnath.kotur@...adcom.com>
To: Michael Chan <michael.chan@...adcom.com>
Cc: Pavan Chebbi <pavan.chebbi@...adcom.com>, Dinghao Liu <dinghao.liu@....edu.cn>,
"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Sriharsha Basavapatna <sriharsha.basavapatna@...adcom.com>, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: bnxt: fix a potential use-after-free in bnxt_init_tc
On Tue, Dec 5, 2023 at 2:05 AM Michael Chan <michael.chan@...adcom.com>
wrote:
> On Mon, Dec 4, 2023 at 12:56 AM Pavan Chebbi <pavan.chebbi@...adcom.com>
> wrote:
> >
> > On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@....edu.cn>
> wrote:
> > >
> > > When flow_indr_dev_register() fails, bnxt_init_tc will free
> > > bp->tc_info through kfree(). However, the caller function
> > > bnxt_init_one() will ignore this failure and call
> > > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> > > a use-after-free happens. Fix this issue by setting
> > > bp->tc_info to NULL after kfree().
> > >
> > > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap
> rules via indirect callbacks")
> > > Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
> > > ---
> > > drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > > index 38d89d80b4a9..273c9ba48f09 100644
> > > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
> > > rhashtable_destroy(&tc_info->flow_table);
> > > free_tc_info:
> > > kfree(tc_info);
> > > + bp->tc_info = NULL;
> > > return rc;
> > > }
> >
> > The other way could have been to assign bp->tc_info only after
> > flow_indr_dev_register succeeds.
> > But this one works too. Thanks.
> > Reviewed-by: Pavan Chebbi <pavan.chebbi@...adcom.com>
>
> I think this is the correct fix. flow_indr_dev_register(), if
> successful, may call the driver's call back function and so
> bp->tc_info must be set up before the call. Thanks.
>
> Reviewed-by: Michael Chan <michael.chan@...adcom.com>
>
Reviewed-by: Somnath Kotur <somnath.kotur@...adcom.com>
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4212 bytes)
Powered by blists - more mailing lists