From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5E3B7C433FE for ; Mon, 7 Nov 2022 07:03:16 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id DFD3D400C4; Mon, 7 Nov 2022 07:03:15 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org DFD3D400C4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1667804595; bh=NbMpoqAABX4mK/uVLAaApan3zHsZzbBgIH7kTdbnkS0=; h=Date:From:To:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: Cc:From; b=0Ef5GNLpXQQ+GDpALCzeqxorCjCvQZG4ujLPeHMaachEmeOIsv8R7eFUuBXoS78ij yZiaVaiKFp07n8CuJ8WpdFmHtjtoOvPcqydBy3E1mejrTDD3AH6rsG0eg+jAwhLG0z 51P2WFg2IkAtTruW5qSEzMKQVIdkNurnOu90XgcBG7ZZoPelyVZ4anmxvFnxjr5v9c u9smmxoEGtG5tIbR8ofh1t7WKJgrnkRKyuILUukrO3hdjBFqfOEhakFoA9WC/Qsk+Z yN9T7NKldz0yB85yo3LNwnftxkOXA7ngVUBp4L9prKBeNUh3dFK5/VMmPT7MhVmXJl f66UJFUxBFtFw== X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jSHLYSavUrue; Mon, 7 Nov 2022 07:03:15 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by smtp2.osuosl.org (Postfix) with ESMTP id DBD29400EF; Mon, 7 Nov 2022 07:03:14 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org DBD29400EF Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id 9EE171BF2C0 for ; Mon, 7 Nov 2022 07:03:13 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 7806E4077D for ; Mon, 7 Nov 2022 07:03:13 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 7806E4077D X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bfRFtCQE9M1H for ; Mon, 7 Nov 2022 07:03:12 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org B2F07406E0 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by smtp4.osuosl.org (Postfix) with ESMTPS id B2F07406E0 for ; Mon, 7 Nov 2022 07:03:12 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9985E60DFD; Mon, 7 Nov 2022 07:03:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E8F0C433D6; Mon, 7 Nov 2022 07:03:09 +0000 (UTC) Date: Mon, 7 Nov 2022 09:03:06 +0200 From: Leon Romanovsky To: Tony Nguyen Message-ID: References: <20221104205414.2354973-1-anthony.l.nguyen@intel.com> <20221104205414.2354973-6-anthony.l.nguyen@intel.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20221104205414.2354973-6-anthony.l.nguyen@intel.com> X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1667804591; bh=NeucI/3zqp+akpMtsKu8R5lV8B05UIL+na/Byd+Rj9g=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=GMvWpZHfpUKMMWUVUlKvnZB87GZ1jI+LOXMNEJvAZbHo6nun/AOioT4iEc4OKutbD wXkSt40Wq/l+BrusYHPbp2TRdql1hLANQMlnU3prqbCJdAr+H9yinixOjX0jycFIBd 4EISOmaemvn+xCNBazGkpR34HJ1tJUahVWK4AMRNmXPJP+K8osrJI3IEc5rWTCAaBa F+paCNr9MRyjXOArxcC0zgjMXl4BJU1W9+uLi9/iBMrqW5gOkgM3ajzHos8XgtmfKC kN+a7tScDKHRIbBHw50P23O/HmWXwT040oKGrMxMKeH6qKPwWl2Gh8+H8Qd4wv9My/ wW83dKy3Qv2Mg== X-Mailman-Original-Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=GMvWpZHf Subject: Re: [Intel-wired-lan] [PATCH net-next 5/6] igb: Do not free q_vector unless new one was allocated X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kees Cook , netdev@vger.kernel.org, "Michael J . Ruhl" , edumazet@google.com, intel-wired-lan@lists.osuosl.org, kuba@kernel.org, pabeni@redhat.com, davem@davemloft.net Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" On Fri, Nov 04, 2022 at 01:54:13PM -0700, Tony Nguyen wrote: > From: Kees Cook > > Avoid potential use-after-free condition under memory pressure. If the > kzalloc() fails, q_vector will be freed but left in the original > adapter->q_vector[v_idx] array position. > > Cc: Jesse Brandeburg > Cc: Tony Nguyen > Cc: "David S. Miller" > Cc: Eric Dumazet > Cc: Jakub Kicinski > Cc: Paolo Abeni > Cc: intel-wired-lan@lists.osuosl.org > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook > Reviewed-by: Michael J. Ruhl > Reviewed-by: Jacob Keller > Tested-by: Gurucharan (A Contingent worker at Intel) You should use first and last names here. > Signed-off-by: Tony Nguyen > --- > drivers/net/ethernet/intel/igb/igb_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c > index d6c1c2e66f26..c2bb658198bf 100644 > --- a/drivers/net/ethernet/intel/igb/igb_main.c > +++ b/drivers/net/ethernet/intel/igb/igb_main.c > @@ -1202,8 +1202,12 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter, > if (!q_vector) { > q_vector = kzalloc(size, GFP_KERNEL); > } else if (size > ksize(q_vector)) { > - kfree_rcu(q_vector, rcu); > - q_vector = kzalloc(size, GFP_KERNEL); > + struct igb_q_vector *new_q_vector; > + > + new_q_vector = kzalloc(size, GFP_KERNEL); > + if (new_q_vector) > + kfree_rcu(q_vector, rcu); > + q_vector = new_q_vector; I wonder if this is correct. 1. if new_q_vector is NULL, you will overwrite q_vector without releasing it. 2. kfree_rcu() doesn't immediately release memory, but after grace period, but here you are overwriting the pointer which is not release yet. > } else { > memset(q_vector, 0, size); > } > -- > 2.35.1 > _______________________________________________ Intel-wired-lan mailing list Intel-wired-lan@osuosl.org https://lists.osuosl.org/mailman/listinfo/intel-wired-lan