[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <48a51a78-da87-58f3-92b2-01db85e14cfb@intel.com>
Date: Thu, 7 Dec 2023 10:55:03 +0100
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Dinghao Liu <dinghao.liu@....edu.cn>
CC: Ariel Elior <aelior@...vell.com>, Manish Chopra <manishc@...vell.com>,
"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Yuval
Mintz" <Yuval.Mintz@...gic.com>, <netdev@...r.kernel.org>,
<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] [v2] qed: Fix a potential use-after-free in
qed_cxt_tables_alloc
On 12/7/23 10:36, Dinghao Liu wrote:
> qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to
> free p_hwfn->p_cxt_mngr->ilt_shadow on error. However,
> qed_cxt_tables_alloc() accesses the freed pointer on failure
> of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(),
> which may lead to use-after-free. Fix this issue by setting
> p_hwfn->p_cxt_mngr->ilt_shadow to NULL in qed_ilt_shadow_free().
>
> Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support")
> Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
> ---
>
> Changelog:
For future submissions please also provide links to previous versions
(would be to v1 in this case). No need to add this now for this one.
>
> v2: -Change the bug type from double-free to use-after-free.
> -Move the null check against p_mngr->ilt_shadow to the beginning
> of the function qed_ilt_shadow_free().
> -When kcalloc() fails in qed_ilt_shadow_alloc(), just return
> because there is nothing to free.
> ---
> drivers/net/ethernet/qlogic/qed/qed_cxt.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Powered by blists - more mailing lists