* [PATCH net] idpf: fix potential use-after-free in idpf_tso()
@ 2023-11-03 20:04 Eric Dumazet
2023-11-03 20:50 ` Jacob Keller
2023-11-07 1:30 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Eric Dumazet @ 2023-11-03 20:04 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, eric.dumazet, Eric Dumazet, Joshua Hay, Alan Brady,
Madhu Chittim, Phani Burra, Sridhar Samudrala, Willem de Bruijn,
Pavan Kumar Linga, Tony Nguyen, Bailey Forrest
skb_cow_head() can change skb->head (and thus skb_shinfo(skb))
We must not cache skb_shinfo(skb) before skb_cow_head().
Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Joshua Hay <joshua.a.hay@intel.com>
Cc: Alan Brady <alan.brady@intel.com>
Cc: Madhu Chittim <madhu.chittim@intel.com>
Cc: Phani Burra <phani.r.burra@intel.com>
Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Bailey Forrest <bcf@google.com>
---
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 5e1ef70d54fe4147a42e5a3263b73cd3e6316679..1f728a9004d9e40d4434534422a42c8c537f5eae 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -2365,7 +2365,7 @@ static void idpf_tx_splitq_map(struct idpf_queue *tx_q,
*/
int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
{
- const struct skb_shared_info *shinfo = skb_shinfo(skb);
+ const struct skb_shared_info *shinfo;
union {
struct iphdr *v4;
struct ipv6hdr *v6;
@@ -2379,13 +2379,15 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
u32 paylen, l4_start;
int err;
- if (!shinfo->gso_size)
+ if (!skb_is_gso(skb))
return 0;
err = skb_cow_head(skb, 0);
if (err < 0)
return err;
+ shinfo = skb_shinfo(skb);
+
ip.hdr = skb_network_header(skb);
l4.hdr = skb_transport_header(skb);
--
2.42.0.869.gea05f2083d-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] idpf: fix potential use-after-free in idpf_tso()
2023-11-03 20:04 [PATCH net] idpf: fix potential use-after-free in idpf_tso() Eric Dumazet
@ 2023-11-03 20:50 ` Jacob Keller
2023-11-07 1:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Jacob Keller @ 2023-11-03 20:50 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, eric.dumazet, Joshua Hay, Alan Brady, Madhu Chittim,
Phani Burra, Sridhar Samudrala, Willem de Bruijn,
Pavan Kumar Linga, Tony Nguyen, Bailey Forrest
On 11/3/2023 1:04 PM, Eric Dumazet wrote:
> skb_cow_head() can change skb->head (and thus skb_shinfo(skb))
>
> We must not cache skb_shinfo(skb) before skb_cow_head().
>
> Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Joshua Hay <joshua.a.hay@intel.com>
> Cc: Alan Brady <alan.brady@intel.com>
> Cc: Madhu Chittim <madhu.chittim@intel.com>
> Cc: Phani Burra <phani.r.burra@intel.com>
> Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Bailey Forrest <bcf@google.com>
> ---
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
> drivers/net/ethernet/intel/idpf/idpf_txrx.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 5e1ef70d54fe4147a42e5a3263b73cd3e6316679..1f728a9004d9e40d4434534422a42c8c537f5eae 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -2365,7 +2365,7 @@ static void idpf_tx_splitq_map(struct idpf_queue *tx_q,
> */
> int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
> {
> - const struct skb_shared_info *shinfo = skb_shinfo(skb);
> + const struct skb_shared_info *shinfo;
> union {
> struct iphdr *v4;
> struct ipv6hdr *v6;
> @@ -2379,13 +2379,15 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
> u32 paylen, l4_start;
> int err;
>
> - if (!shinfo->gso_size)
> + if (!skb_is_gso(skb))
> return 0;
>
> err = skb_cow_head(skb, 0);
> if (err < 0)
> return err;
>
> + shinfo = skb_shinfo(skb);
> +
> ip.hdr = skb_network_header(skb);
> l4.hdr = skb_transport_header(skb);
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] idpf: fix potential use-after-free in idpf_tso()
2023-11-03 20:04 [PATCH net] idpf: fix potential use-after-free in idpf_tso() Eric Dumazet
2023-11-03 20:50 ` Jacob Keller
@ 2023-11-07 1:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-11-07 1:30 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, netdev, eric.dumazet, joshua.a.hay,
alan.brady, madhu.chittim, phani.r.burra, sridhar.samudrala,
willemb, pavan.kumar.linga, anthony.l.nguyen, bcf
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 3 Nov 2023 20:04:51 +0000 you wrote:
> skb_cow_head() can change skb->head (and thus skb_shinfo(skb))
>
> We must not cache skb_shinfo(skb) before skb_cow_head().
>
> Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Joshua Hay <joshua.a.hay@intel.com>
> Cc: Alan Brady <alan.brady@intel.com>
> Cc: Madhu Chittim <madhu.chittim@intel.com>
> Cc: Phani Burra <phani.r.burra@intel.com>
> Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Bailey Forrest <bcf@google.com>
>
> [...]
Here is the summary with links:
- [net] idpf: fix potential use-after-free in idpf_tso()
https://git.kernel.org/netdev/net/c/115c0f4d5857
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-11-07 1:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-11-03 20:04 [PATCH net] idpf: fix potential use-after-free in idpf_tso() Eric Dumazet
2023-11-03 20:50 ` Jacob Keller
2023-11-07 1:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).