| Message ID | 20220412092419.GA3865@kili (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [net-next] net: ethernet: mtk_eth_soc: use after free in __mtk_ppe_check_skb() | expand |
Hello: This patch was applied to netdev/net-next.git (master) by David S. Miller <davem@davemloft.net>: On Tue, 12 Apr 2022 12:24:19 +0300 you wrote: > The __mtk_foe_entry_clear() function frees "entry" so we have to use > the _safe() version of hlist_for_each_entry() to prevent a use after > free. > > Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > [...] Here is the summary with links: - [net-next] net: ethernet: mtk_eth_soc: use after free in __mtk_ppe_check_skb() https://git.kernel.org/netdev/net-next/c/17a5f6a78dc7 You are awesome, thank you!
diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c index 282a1f34a88a..683f89f8e3b2 100644 --- a/drivers/net/ethernet/mediatek/mtk_ppe.c +++ b/drivers/net/ethernet/mediatek/mtk_ppe.c @@ -600,6 +600,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) struct mtk_foe_entry *hwe = &ppe->foe_table[hash]; struct mtk_flow_entry *entry; struct mtk_foe_bridge key = {}; + struct hlist_node *n; struct ethhdr *eh; bool found = false; u8 *tag; @@ -609,7 +610,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND) goto out; - hlist_for_each_entry(entry, head, list) { + hlist_for_each_entry_safe(entry, n, head, list) { if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) { if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND))
The __mtk_foe_entry_clear() function frees "entry" so we have to use the _safe() version of hlist_for_each_entry() to prevent a use after free. Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/mediatek/mtk_ppe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)