From: Jakub Kicinski <kuba@kernel.org>
To: Radu Rendec <rrendec@redhat.com>
Cc: "Yoshihiro Shimoda" <yoshihiro.shimoda.uh@renesas.com>,
"David S. Miller" <davem@davemloft.net>,
"Paolo Abeni" <pabeni@redhat.com>,
"Niklas Söderlund" <niklas.soderlund+renesas@ragnatech.se>,
"Simon Horman" <horms@kernel.org>,
netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org
Subject: Re: [PATCH] net: rswitch: Avoid use-after-free in rswitch_poll()
Date: Wed, 3 Jul 2024 19:16:10 -0700 [thread overview]
Message-ID: <20240703191610.30bd4ba8@kernel.org> (raw)
In-Reply-To: <20240702210838.2703228-1-rrendec@redhat.com>
On Tue, 2 Jul 2024 17:08:37 -0400 Radu Rendec wrote:
> The use-after-free is actually in rswitch_tx_free(), which is inlined in
> rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
> same pointer, the skb is first freed using dev_kfree_skb_any(), then the
> value in skb->len is used to update the interface statistics.
>
> Let's move around the instructions to use skb->len before the skb is
> freed.
>
> This bug is trivial to reproduce using KFENCE. It will trigger a splat
> every few packets. A simple ARP request or ICMP echo request is enough.
Please remember to add a Fixes tag in the future. I added one when
applying.
next prev parent reply other threads:[~2024-07-04 2:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-02 21:08 [PATCH] net: rswitch: Avoid use-after-free in rswitch_poll() Radu Rendec
2024-07-02 23:59 ` Yoshihiro Shimoda
2024-07-03 6:31 ` Niklas Söderlund
2024-07-04 2:16 ` Jakub Kicinski [this message]
2024-07-04 2:30 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240703191610.30bd4ba8@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=horms@kernel.org \
--cc=linux-renesas-soc@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=niklas.soderlund+renesas@ragnatech.se \
--cc=pabeni@redhat.com \
--cc=rrendec@redhat.com \
--cc=yoshihiro.shimoda.uh@renesas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.