* [PATCH v2] mctp: fix use after free
@ 2022-02-15 2:05 trix
2022-02-15 2:26 ` Jeremy Kerr
2022-02-15 15:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: trix @ 2022-02-15 2:05 UTC (permalink / raw)
To: jk, matt, davem, kuba, nathan, ndesaulniers
Cc: netdev, linux-kernel, llvm, Tom Rix
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
trace_mctp_key_acquire(key);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire(). Add an else statement
to use the key only when mctp_key_add() is successful.
Fixes: 4f9e1ba6de45 ("mctp: Add tracepoints for tag/key handling")
Signed-off-by: Tom Rix <trix@redhat.com>
---
v2: change the Fixes: line
net/mctp/route.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/mctp/route.c b/net/mctp/route.c
index 17e3482aa770..0c4c56e1bd6e 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -419,13 +419,14 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb)
* this function.
*/
rc = mctp_key_add(key, msk);
- if (rc)
+ if (rc) {
kfree(key);
+ } else {
+ trace_mctp_key_acquire(key);
- trace_mctp_key_acquire(key);
-
- /* we don't need to release key->lock on exit */
- mctp_key_unref(key);
+ /* we don't need to release key->lock on exit */
+ mctp_key_unref(key);
+ }
key = NULL;
} else {
--
2.26.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mctp: fix use after free
2022-02-15 2:05 [PATCH v2] mctp: fix use after free trix
@ 2022-02-15 2:26 ` Jeremy Kerr
2022-02-15 15:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Jeremy Kerr @ 2022-02-15 2:26 UTC (permalink / raw)
To: trix, matt, davem, kuba, nathan, ndesaulniers; +Cc: netdev, linux-kernel, llvm
Hi Tom,
> Clang static analysis reports this problem
> route.c:425:4: warning: Use of memory after it is freed
> trace_mctp_key_acquire(key);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~
> When mctp_key_add() fails, key is freed but then is later
> used in trace_mctp_key_acquire(). Add an else statement
> to use the key only when mctp_key_add() is successful.
>
> Fixes: 4f9e1ba6de45 ("mctp: Add tracepoints for tag/key handling")
> Signed-off-by: Tom Rix <trix@redhat.com>
> ---
> v2: change the Fixes: line
Super, thanks!
Acked-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Cheers,
Jeremy
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mctp: fix use after free
2022-02-15 2:05 [PATCH v2] mctp: fix use after free trix
2022-02-15 2:26 ` Jeremy Kerr
@ 2022-02-15 15:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-15 15:00 UTC (permalink / raw)
To: Tom Rix
Cc: jk, matt, davem, kuba, nathan, ndesaulniers, netdev, linux-kernel, llvm
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Mon, 14 Feb 2022 18:05:41 -0800 you wrote:
> From: Tom Rix <trix@redhat.com>
>
> Clang static analysis reports this problem
> route.c:425:4: warning: Use of memory after it is freed
> trace_mctp_key_acquire(key);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~
> When mctp_key_add() fails, key is freed but then is later
> used in trace_mctp_key_acquire(). Add an else statement
> to use the key only when mctp_key_add() is successful.
>
> [...]
Here is the summary with links:
- [v2] mctp: fix use after free
https://git.kernel.org/netdev/net/c/7e5b6a5c8c44
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-02-15 15:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-15 2:05 [PATCH v2] mctp: fix use after free trix
2022-02-15 2:26 ` Jeremy Kerr
2022-02-15 15:00 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.