[PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown

[PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown

[Ayush Mukkanwar]

cvm_oct_tx_shutdown() kills the tx cleanup tasklet while
the net devices are still registered. This could lead
to use-after-free when a tasklet is scheduled after the
tasklet_kill() is called which might run after the net
devices are freed.
Fix it by unregistering the net devices before the tasklet
is killed.

Fixes: 4898c560103f ("Staging: Octeon:  Free transmit SKBs in a timely manner")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260615172734.42038-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
---
Note: This patch has only been compile tested. No runtime testing was
performed as I do not have access to Octeon hardware.

 drivers/staging/octeon/ethernet.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index 42ec4b8324a8..98d4e025c301 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -113,7 +113,6 @@ static void cvm_oct_remove_device(int port)
 		cancel_delayed_work_sync(&priv->port_periodic_work);
 
 		cvm_oct_tx_shutdown_dev(dev);
-		unregister_netdev(dev);
 		free_netdev(dev);
 		cvm_oct_device[port] = NULL;
 	}
@@ -694,6 +693,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
 	struct device_node *pip;
 	int mtu_overhead = ETH_HLEN + ETH_FCS_LEN;
 	struct octeon_ethernet_platform *plat;
+	int port;
 
 	plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
 	if (!plat)
@@ -729,7 +729,6 @@ static int cvm_oct_probe(struct platform_device *pdev)
 	num_interfaces = cvmx_helper_get_number_of_interfaces();
 	for (interface = 0; interface < num_interfaces; interface++) {
 		int num_ports = cvmx_helper_ports_on_interface(interface);
-		int port;
 
 		for (port = cvmx_helper_get_ipd_port(interface, 0);
 		     port < cvmx_helper_get_ipd_port(interface, num_ports);
@@ -953,8 +952,21 @@ static int cvm_oct_probe(struct platform_device *pdev)
 	return 0;
 
 err_rx:
+	/* Unregister ethernet devices */
+	for (port = 0; port < TOTAL_NUMBER_OF_PORTS; port++)
+		if (cvm_oct_device[port])
+			unregister_netdev(cvm_oct_device[port]);
+
 	cvm_oct_tx_shutdown();
+	goto disable_ipd;
+
 err_tx:
+	/* Unregister ethernet devices */
+	for (port = 0; port < TOTAL_NUMBER_OF_PORTS; port++)
+		if (cvm_oct_device[port])
+			unregister_netdev(cvm_oct_device[port]);
+
+disable_ipd:
 	cvmx_ipd_disable();
 
 	atomic_inc_return(&cvm_oct_poll_queue_stopping);
@@ -984,6 +996,11 @@ static void cvm_oct_remove(struct platform_device *pdev)
 	struct octeon_ethernet_platform *plat = platform_get_drvdata(pdev);
 	int port;
 
+	/* Unregister ethernet devices */
+	for (port = 0; port < TOTAL_NUMBER_OF_PORTS; port++)
+		if (cvm_oct_device[port])
+			unregister_netdev(cvm_oct_device[port]);
+
 	cvmx_ipd_disable();
 
 	atomic_inc_return(&cvm_oct_poll_queue_stopping);
-- 
2.54.0

[PATCH 2/2] staging: octeon: fix out-of-bounds reads in tx path

[Ayush Mukkanwar]

1. cvm_oct_xmit() and cvm_oct_xmit_pow() blindly trust
skb->protocol == htons(ETH_P_IP) and dereference the IP header
without verifying if the packet is long enough or if the header
is in the linear skb data area.
Fix by checking if skb_headlen is larger than
skb_network_offset + size of ip header.

2. cvm_oct_xmit_pow() copies packet data into a fixed size
hardware buffer using a hardcoded memcpy() size. If a packet
is smaller than it, memcpy() will read past the end of the
skb buffer. Fix this by using min_t() so that it does not read
past the end of the skb.

Fixes: 80ff0fd3ab64 ("Staging: Add octeon-ethernet driver files.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260615172734.42038-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
---
Note: This patch has only been compile tested. No runtime testing was
performed as I do not have access to Octeon hardware.

 drivers/staging/octeon/ethernet-tx.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index 5e536827f87a..452bc9fc8a5d 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -361,6 +361,8 @@ netdev_tx_t cvm_oct_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	/* Check if we can use the hardware checksumming */
 	if ((skb->protocol == htons(ETH_P_IP)) &&
+		(skb_network_offset(skb) >= 0) &&
+		(skb_network_offset(skb) + sizeof(struct iphdr) <= skb_headlen(skb)) &&
 	    (ip_hdr(skb)->version == 4) &&
 	    (ip_hdr(skb)->ihl == 5) &&
 	    ((ip_hdr(skb)->frag_off == 0) ||
@@ -571,6 +573,14 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
 	work->packet_ptr.s.back = (copy_location - packet_buffer) >> 7;
 
 	if (skb->protocol == htons(ETH_P_IP)) {
+		if (unlikely(!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))) {
+			cvmx_fpa_free(packet_buffer, CVMX_FPA_PACKET_POOL, 0);
+			cvmx_fpa_free(work, CVMX_FPA_WQE_POOL, 1);
+			dev->stats.tx_dropped++;
+			dev_kfree_skb_any(skb);
+			return NETDEV_TX_OK;
+		}
+
 		work->word2.s.ip_offset = 14;
 		work->word2.s.tcp_or_udp =
 		    (ip_hdr(skb)->protocol == IPPROTO_TCP) ||
@@ -587,7 +597,7 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
 		 * does.
 		 */
 		memcpy(work->packet_data, skb->data + 10,
-		       sizeof(work->packet_data));
+		       min_t(unsigned int, skb->len - 10, sizeof(work->packet_data)));
 	} else {
 		work->word2.snoip.is_rarp = skb->protocol == htons(ETH_P_RARP);
 		work->word2.snoip.is_arp = skb->protocol == htons(ETH_P_ARP);
@@ -596,7 +606,8 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
 		work->word2.snoip.is_mcast =
 		    (skb->pkt_type == PACKET_MULTICAST);
 		work->word2.snoip.not_IP = 1;	/* IP was done up above */
-		memcpy(work->packet_data, skb->data, sizeof(work->packet_data));
+		memcpy(work->packet_data, skb->data,
+		       min_t(unsigned int, skb->len, sizeof(work->packet_data)));
 	}
 
 	/* Submit the packet to the POW */
-- 
2.54.0