| Message ID | 20220224145325.GA6793@kili (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net/mlx5e: TC, Fix use after free in mlx5e_clone_flow_attr_for_post_act() | expand |
On 2022-02-24 4:53 PM, Dan Carpenter wrote: > This returns freed memory leading to a use after free. It's supposed to > return NULL. > > Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > This goes through Saeed's tree not the net tree. > > drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > index 76a015dfc5fc..c0776a4a3845 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > @@ -3398,7 +3398,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr, > if (!attr2 || !parse_attr) { > kvfree(parse_attr); > kfree(attr2); > - return attr2; > + return NULL; > } > > memcpy(attr2, attr, attr_sz); hi, I noticed your fix now and already reviewed same fix from Colin https://patchwork.kernel.org/project/netdevbpf/patch/20220224221525.147744-1-colin.i.king@gmail.com/ so just need to take either one. thanks Reviewed-by: Roi Dayan <roid@nvidia.com>
On 25 Feb 14:18, Roi Dayan wrote: > > >On 2022-02-24 4:53 PM, Dan Carpenter wrote: >>This returns freed memory leading to a use after free. It's supposed to >>return NULL. >> >>Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") >>Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >>--- >>This goes through Saeed's tree not the net tree. >> >> drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >>diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c >>index 76a015dfc5fc..c0776a4a3845 100644 >>--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c >>+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c >>@@ -3398,7 +3398,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr, >> if (!attr2 || !parse_attr) { >> kvfree(parse_attr); >> kfree(attr2); >>- return attr2; >>+ return NULL; >> } >> memcpy(attr2, attr, attr_sz); > >hi, I noticed your fix now and already reviewed same fix from Colin > >https://patchwork.kernel.org/project/netdevbpf/patch/20220224221525.147744-1-colin.i.king@gmail.com/ > >so just need to take either one. >thanks > Ok this one arrived first, will take this one :). applied to net-next-mlx5. >Reviewed-by: Roi Dayan <roid@nvidia.com>
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c index 76a015dfc5fc..c0776a4a3845 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -3398,7 +3398,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr, if (!attr2 || !parse_attr) { kvfree(parse_attr); kfree(attr2); - return attr2; + return NULL; } memcpy(attr2, attr, attr_sz);
This returns freed memory leading to a use after free. It's supposed to return NULL. Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- This goes through Saeed's tree not the net tree. drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)