From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFA75C4332F for ; Mon, 7 Nov 2022 07:03:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230473AbiKGHDP (ORCPT ); Mon, 7 Nov 2022 02:03:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230209AbiKGHDO (ORCPT ); Mon, 7 Nov 2022 02:03:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B68C065C3 for ; Sun, 6 Nov 2022 23:03:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 61BB4B80D15 for ; Mon, 7 Nov 2022 07:03:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E8F0C433D6; Mon, 7 Nov 2022 07:03:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1667804591; bh=NeucI/3zqp+akpMtsKu8R5lV8B05UIL+na/Byd+Rj9g=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=GMvWpZHfpUKMMWUVUlKvnZB87GZ1jI+LOXMNEJvAZbHo6nun/AOioT4iEc4OKutbD wXkSt40Wq/l+BrusYHPbp2TRdql1hLANQMlnU3prqbCJdAr+H9yinixOjX0jycFIBd 4EISOmaemvn+xCNBazGkpR34HJ1tJUahVWK4AMRNmXPJP+K8osrJI3IEc5rWTCAaBa F+paCNr9MRyjXOArxcC0zgjMXl4BJU1W9+uLi9/iBMrqW5gOkgM3ajzHos8XgtmfKC kN+a7tScDKHRIbBHw50P23O/HmWXwT040oKGrMxMKeH6qKPwWl2Gh8+H8Qd4wv9My/ wW83dKy3Qv2Mg== Date: Mon, 7 Nov 2022 09:03:06 +0200 From: Leon Romanovsky To: Tony Nguyen Cc: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, Kees Cook , netdev@vger.kernel.org, Jesse Brandeburg , intel-wired-lan@lists.osuosl.org, "Michael J . Ruhl" , Jacob Keller , Gurucharan Subject: Re: [PATCH net-next 5/6] igb: Do not free q_vector unless new one was allocated Message-ID: References: <20221104205414.2354973-1-anthony.l.nguyen@intel.com> <20221104205414.2354973-6-anthony.l.nguyen@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221104205414.2354973-6-anthony.l.nguyen@intel.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Nov 04, 2022 at 01:54:13PM -0700, Tony Nguyen wrote: > From: Kees Cook > > Avoid potential use-after-free condition under memory pressure. If the > kzalloc() fails, q_vector will be freed but left in the original > adapter->q_vector[v_idx] array position. > > Cc: Jesse Brandeburg > Cc: Tony Nguyen > Cc: "David S. Miller" > Cc: Eric Dumazet > Cc: Jakub Kicinski > Cc: Paolo Abeni > Cc: intel-wired-lan@lists.osuosl.org > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook > Reviewed-by: Michael J. Ruhl > Reviewed-by: Jacob Keller > Tested-by: Gurucharan (A Contingent worker at Intel) You should use first and last names here. > Signed-off-by: Tony Nguyen > --- > drivers/net/ethernet/intel/igb/igb_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c > index d6c1c2e66f26..c2bb658198bf 100644 > --- a/drivers/net/ethernet/intel/igb/igb_main.c > +++ b/drivers/net/ethernet/intel/igb/igb_main.c > @@ -1202,8 +1202,12 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter, > if (!q_vector) { > q_vector = kzalloc(size, GFP_KERNEL); > } else if (size > ksize(q_vector)) { > - kfree_rcu(q_vector, rcu); > - q_vector = kzalloc(size, GFP_KERNEL); > + struct igb_q_vector *new_q_vector; > + > + new_q_vector = kzalloc(size, GFP_KERNEL); > + if (new_q_vector) > + kfree_rcu(q_vector, rcu); > + q_vector = new_q_vector; I wonder if this is correct. 1. if new_q_vector is NULL, you will overwrite q_vector without releasing it. 2. kfree_rcu() doesn't immediately release memory, but after grace period, but here you are overwriting the pointer which is not release yet. > } else { > memset(q_vector, 0, size); > } > -- > 2.35.1 >