netdev - Re: [PATCH] net: rswitch: Avoid use-after-free in rswitch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240703191610.30bd4ba8@kernel.org>
Date: Wed, 3 Jul 2024 19:16:10 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Radu Rendec <rrendec@...hat.com>
Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>, "David S. Miller"
 <davem@...emloft.net>, Paolo Abeni <pabeni@...hat.com>, Niklas
 Söderlund <niklas.soderlund+renesas@...natech.se>, Simon
 Horman <horms@...nel.org>, netdev@...r.kernel.org,
 linux-renesas-soc@...r.kernel.org
Subject: Re: [PATCH] net: rswitch: Avoid use-after-free in rswitch_poll()

On Tue,  2 Jul 2024 17:08:37 -0400 Radu Rendec wrote:
> The use-after-free is actually in rswitch_tx_free(), which is inlined in
> rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
> same pointer, the skb is first freed using dev_kfree_skb_any(), then the
> value in skb->len is used to update the interface statistics.
> 
> Let's move around the instructions to use skb->len before the skb is
> freed.
> 
> This bug is trivial to reproduce using KFENCE. It will trigger a splat
> every few packets. A simple ARP request or ICMP echo request is enough.

Please remember to add a Fixes tag in the future. I added one when
applying.