* [PATCH net] net: hsr: Fix potential use-after-free
@ 2022-11-23 6:30 YueHaibing
2022-11-24 8:53 ` Paolo Abeni
0 siblings, 1 reply; 3+ messages in thread
From: YueHaibing @ 2022-11-23 6:30 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, arvid.brodin
Cc: netdev, linux-kernel, YueHaibing
The skb is delivered to netif_rx() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
Fixes: f266a683a480 ("net/hsr: Better frame dispatch")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
net/hsr/hsr_forward.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index a50429a62f74..56bb27d67a2e 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -351,17 +351,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
struct hsr_node *node_src)
{
bool was_multicast_frame;
- int res;
+ int res, recv_len;
was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
hsr_addr_subst_source(node_src, skb);
skb_pull(skb, ETH_HLEN);
+ recv_len = skb->len;
res = netif_rx(skb);
if (res == NET_RX_DROP) {
dev->stats.rx_dropped++;
} else {
dev->stats.rx_packets++;
- dev->stats.rx_bytes += skb->len;
+ dev->stats.rx_bytes += recv_len;
if (was_multicast_frame)
dev->stats.multicast++;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: hsr: Fix potential use-after-free
2022-11-23 6:30 [PATCH net] net: hsr: Fix potential use-after-free YueHaibing
@ 2022-11-24 8:53 ` Paolo Abeni
2022-11-25 7:53 ` YueHaibing
0 siblings, 1 reply; 3+ messages in thread
From: Paolo Abeni @ 2022-11-24 8:53 UTC (permalink / raw)
To: YueHaibing, davem, edumazet, kuba, arvid.brodin; +Cc: netdev, linux-kernel
Hello,
On Wed, 2022-11-23 at 14:30 +0800, YueHaibing wrote:
> The skb is delivered to netif_rx() which may free it, after calling this,
> dereferencing skb may trigger use-after-free.
>
> Fixes: f266a683a480 ("net/hsr: Better frame dispatch")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
The code looks good, but the above is not the commit introducing the
issue, it just move the netif_rx() and later skb access from somewhere
else.
Please go deeper in git history and find the change that originated the
issue.
Thanks,
Paolo
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: hsr: Fix potential use-after-free
2022-11-24 8:53 ` Paolo Abeni
@ 2022-11-25 7:53 ` YueHaibing
0 siblings, 0 replies; 3+ messages in thread
From: YueHaibing @ 2022-11-25 7:53 UTC (permalink / raw)
To: Paolo Abeni, davem, edumazet, kuba, arvid.brodin; +Cc: netdev, linux-kernel
On 2022/11/24 16:53, Paolo Abeni wrote:
> Hello,
>
> On Wed, 2022-11-23 at 14:30 +0800, YueHaibing wrote:
>> The skb is delivered to netif_rx() which may free it, after calling this,
>> dereferencing skb may trigger use-after-free.
>>
>> Fixes: f266a683a480 ("net/hsr: Better frame dispatch")
>> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
>
> The code looks good, but the above is not the commit introducing the
> issue, it just move the netif_rx() and later skb access from somewhere
> else.
>
> Please go deeper in git history and find the change that originated the> issue.
Ok, will dig it.
>
> Thanks,
>
> Paolo
>
> .
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-25 7:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-23 6:30 [PATCH net] net: hsr: Fix potential use-after-free YueHaibing
2022-11-24 8:53 ` Paolo Abeni
2022-11-25 7:53 ` YueHaibing
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).