| Message ID | ZHo0vwquhOy3FaXc@decadent.org.uk (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 7c5d4801ecf0564c860033d89726b99723c55146 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() | expand |
On Fri, Jun 02, 2023 at 08:28:15PM +0200, Ben Hutchings wrote: > irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. > So we need to clear the pointer to our glue structure in rmap before > doing that, not after. > > Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj ...") > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Reviewed-by: Simon Horman <simon.horman@corigine.com>
Hi, On Fri, 2023-06-02 at 20:28 +0200, Ben Hutchings wrote: > irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. > So we need to clear the pointer to our glue structure in rmap before > doing that, not after. > > Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj ...") > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> The patch LGTM, but please include the full blamed commit title into the fixes tag. A new version will be needed. Also add Jacob and Saeed to the cc-list Thanks, Paolo
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Fri, 2 Jun 2023 20:28:15 +0200 you wrote: > irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. > So we need to clear the pointer to our glue structure in rmap before > doing that, not after. > > Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj ...") > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > > [...] Here is the summary with links: - [net] lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() https://git.kernel.org/netdev/net/c/7c5d4801ecf0 You are awesome, thank you!
diff --git a/lib/cpu_rmap.c b/lib/cpu_rmap.c index 73c1636b927b..4c348670da31 100644 --- a/lib/cpu_rmap.c +++ b/lib/cpu_rmap.c @@ -280,8 +280,8 @@ static void irq_cpu_rmap_release(struct kref *ref) struct irq_glue *glue = container_of(ref, struct irq_glue, notify.kref); - cpu_rmap_put(glue->rmap); glue->rmap->obj[glue->index] = NULL; + cpu_rmap_put(glue->rmap); kfree(glue); }
irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. So we need to clear the pointer to our glue structure in rmap before doing that, not after. Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj ...") Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- I noticed this issue when reviewing stable changes. I haven't tested the change. Ben. lib/cpu_rmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)