[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20251001111646.806130-1-Pavel.Zhigulin@kaspersky.com>
Date: Wed, 1 Oct 2025 14:16:43 +0300
From: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>
To: Ayush Sawal <ayush.sawal@...lsio.com>
CC: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>, Andrew Lunn
<andrew+netdev@...n.ch>, "David S. Miller" <davem@...emloft.net>, Eric
Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>, Leon Romanovsky <leon@...nel.org>, Steffen Klassert
<steffen.klassert@...unet.com>, Cosmin Ratiu <cratiu@...dia.com>, Zhu Yanjun
<yanjun.zhu@...ux.dev>, Harsh Jain <harsh@...lsio.com>, Atul Gupta
<atul.gupta@...lsio.com>, Herbert Xu <herbert@...dor.apana.org.au>, Ganesh
Goudar <ganeshgr@...lsio.com>, <netdev@...r.kernel.org>,
<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: [PATCH] net: fix potential use-after-free in ch_ipsec_xfrm_add_state() callback
In ch_ipsec_xfrm_add_state() there is not check of try_module_get
return value. It is very unlikely, but try_module_get() could return
false value, which could cause use-after-free error.
This fix adds checking the result of try_module_get call
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 6dad4e8ab3ec ("chcr: Add support for Inline IPSec")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>
---
.../net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c
index ecd9a0bd5e18..3a5277630afa 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c
@@ -35,6 +35,8 @@
* Atul Gupta (atul.gupta@...lsio.com)
*/
+#include "asm-generic/errno-base.h"
+#include "linux/compiler.h"
#define pr_fmt(fmt) "ch_ipsec: " fmt
#include <linux/kernel.h>
@@ -301,7 +303,8 @@ static int ch_ipsec_xfrm_add_state(struct net_device *dev,
sa_entry->esn = 1;
ch_ipsec_setkey(x, sa_entry);
x->xso.offload_handle = (unsigned long)sa_entry;
- try_module_get(THIS_MODULE);
+ if (unlikely(!try_module_get(THIS_MODULE)))
+ res = -ENODEV;
out:
return res;
}
--
2.43.0
Powered by blists - more mailing lists