From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 138C4C433EF for ; Sat, 5 Mar 2022 15:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231974AbiCEPmI (ORCPT ); Sat, 5 Mar 2022 10:42:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230224AbiCEPmG (ORCPT ); Sat, 5 Mar 2022 10:42:06 -0500 Received: from mout-p-201.mailbox.org (mout-p-201.mailbox.org [IPv6:2001:67c:2050::465:201]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93B9B23BEF; Sat, 5 Mar 2022 07:41:15 -0800 (PST) Received: from smtp102.mailbox.org (smtp102.mailbox.org [IPv6:2001:67c:2050:105:465:1:3:0]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-201.mailbox.org (Postfix) with ESMTPS id 4K9ppt318Cz9sqb; Sat, 5 Mar 2022 16:41:10 +0100 (CET) Message-ID: <3f3957dd-5aae-ca0d-d487-fe062d989980@hauke-m.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hauke-m.de; s=MBO0001; t=1646494868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4p4r1LsqVbNtuaN4+UAKCcBfS2bVk6T+s/lsV//2jnY=; b=jskBSbhBeHHTqsPz5DQ9MKbWrOEdKZ3J+YdfOc3Sj60U/2/Yi9Ay9t3kVCAr9/944aOT41 2OMo9xKrCejSK2kES1NAVzJBvGR2yy97HHXSRmR9gVbfS5nS7m5Vc8LNebdefDQHXTpkEJ ivzogByp9ODBStm3y9J4315uX7dM2Xt7qlUyAGMqQgYpzOKuTygA0HBpsPLtzE/iKhcOaH 0vZ98dgFCh8jN/zicOU95GAyuuAcbh278bnnpxsL8cz6XByVXUjsttglibq0+yFFExcKJ9 DMGny5/+gss8Sir9FRSq8TO7TudU0GXMG3iMm8e6mADcZr/y7r6I01SaOx43AA== Date: Sat, 5 Mar 2022 16:41:00 +0100 MIME-Version: 1.0 Subject: Re: [PATCH net] net: lantiq_xrx200: fix use after free bug Content-Language: en-US To: Aleksander Jan Bajkowski , davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Eric Dumazet References: <20220305112039.3989-1-olek2@wp.pl> From: Hauke Mehrtens In-Reply-To: <20220305112039.3989-1-olek2@wp.pl> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 3/5/22 12:20, Aleksander Jan Bajkowski wrote: > The skb->len field is read after the packet is sent to the network > stack. In the meantime, skb can be freed. This patch fixes this bug. > > Fixes: c3e6b2c35b34 ("net: lantiq_xrx200: add ingress SG DMA support") > Reported-by: Eric Dumazet > Signed-off-by: Aleksander Jan Bajkowski Acked-by: Hauke Mehrtens > --- > drivers/net/ethernet/lantiq_xrx200.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c > index 41d11137cde0..5712c3e94be8 100644 > --- a/drivers/net/ethernet/lantiq_xrx200.c > +++ b/drivers/net/ethernet/lantiq_xrx200.c > @@ -260,9 +260,9 @@ static int xrx200_hw_receive(struct xrx200_chan *ch) > > if (ctl & LTQ_DMA_EOP) { > ch->skb_head->protocol = eth_type_trans(ch->skb_head, net_dev); > - netif_receive_skb(ch->skb_head); > net_dev->stats.rx_packets++; > net_dev->stats.rx_bytes += ch->skb_head->len; > + netif_receive_skb(ch->skb_head); > ch->skb_head = NULL; > ch->skb_tail = NULL; > ret = XRX200_DMA_PACKET_COMPLETE;