| Message ID | 20231204024004.8245-1-dinghao.liu@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: bnxt: fix a potential use-after-free in bnxt_init_tc | expand |
On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@zju.edu.cn> wrote: > > When flow_indr_dev_register() fails, bnxt_init_tc will free > bp->tc_info through kfree(). However, the caller function > bnxt_init_one() will ignore this failure and call > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where > a use-after-free happens. Fix this issue by setting > bp->tc_info to NULL after kfree(). > > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > --- > drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > index 38d89d80b4a9..273c9ba48f09 100644 > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) > rhashtable_destroy(&tc_info->flow_table); > free_tc_info: > kfree(tc_info); > + bp->tc_info = NULL; > return rc; > } The other way could have been to assign bp->tc_info only after flow_indr_dev_register succeeds. But this one works too. Thanks. Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> > > -- > 2.17.1 > >
On Mon, Dec 4, 2023 at 12:56 AM Pavan Chebbi <pavan.chebbi@broadcom.com> wrote: > > On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@zju.edu.cn> wrote: > > > > When flow_indr_dev_register() fails, bnxt_init_tc will free > > bp->tc_info through kfree(). However, the caller function > > bnxt_init_one() will ignore this failure and call > > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where > > a use-after-free happens. Fix this issue by setting > > bp->tc_info to NULL after kfree(). > > > > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") > > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > > --- > > drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > index 38d89d80b4a9..273c9ba48f09 100644 > > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) > > rhashtable_destroy(&tc_info->flow_table); > > free_tc_info: > > kfree(tc_info); > > + bp->tc_info = NULL; > > return rc; > > } > > The other way could have been to assign bp->tc_info only after > flow_indr_dev_register succeeds. > But this one works too. Thanks. > Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> I think this is the correct fix. flow_indr_dev_register(), if successful, may call the driver's call back function and so bp->tc_info must be set up before the call. Thanks. Reviewed-by: Michael Chan <michael.chan@broadcom.com>
On Tue, Dec 5, 2023 at 2:05 AM Michael Chan <michael.chan@broadcom.com> wrote: > On Mon, Dec 4, 2023 at 12:56 AM Pavan Chebbi <pavan.chebbi@broadcom.com> > wrote: > > > > On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@zju.edu.cn> > wrote: > > > > > > When flow_indr_dev_register() fails, bnxt_init_tc will free > > > bp->tc_info through kfree(). However, the caller function > > > bnxt_init_one() will ignore this failure and call > > > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where > > > a use-after-free happens. Fix this issue by setting > > > bp->tc_info to NULL after kfree(). > > > > > > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap > rules via indirect callbacks") > > > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > > > --- > > > drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > > index 38d89d80b4a9..273c9ba48f09 100644 > > > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c > > > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) > > > rhashtable_destroy(&tc_info->flow_table); > > > free_tc_info: > > > kfree(tc_info); > > > + bp->tc_info = NULL; > > > return rc; > > > } > > > > The other way could have been to assign bp->tc_info only after > > flow_indr_dev_register succeeds. > > But this one works too. Thanks. > > Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> > > I think this is the correct fix. flow_indr_dev_register(), if > successful, may call the driver's call back function and so > bp->tc_info must be set up before the call. Thanks. > > Reviewed-by: Michael Chan <michael.chan@broadcom.com> > Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 4 Dec 2023 10:40:04 +0800 you wrote: > When flow_indr_dev_register() fails, bnxt_init_tc will free > bp->tc_info through kfree(). However, the caller function > bnxt_init_one() will ignore this failure and call > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where > a use-after-free happens. Fix this issue by setting > bp->tc_info to NULL after kfree(). > > [...] Here is the summary with links: - net: bnxt: fix a potential use-after-free in bnxt_init_tc https://git.kernel.org/netdev/net/c/d007caaaf052 You are awesome, thank you!
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c index 38d89d80b4a9..273c9ba48f09 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) rhashtable_destroy(&tc_info->flow_table); free_tc_info: kfree(tc_info); + bp->tc_info = NULL; return rc; }
When flow_indr_dev_register() fails, bnxt_init_tc will free bp->tc_info through kfree(). However, the caller function bnxt_init_one() will ignore this failure and call bnxt_shutdown_tc() on failure of bnxt_dl_register(), where a use-after-free happens. Fix this issue by setting bp->tc_info to NULL after kfree(). Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + 1 file changed, 1 insertion(+)