From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E72E5C7EE26 for ; Mon, 1 May 2023 07:41:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232254AbjEAHlb (ORCPT ); Mon, 1 May 2023 03:41:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231755AbjEAHl3 (ORCPT ); Mon, 1 May 2023 03:41:29 -0400 Received: from mail-m11876.qiye.163.com (mail-m11876.qiye.163.com [115.236.118.76]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 295F61B9; Mon, 1 May 2023 00:41:24 -0700 (PDT) Received: from [IPV6:240e:3b7:327f:5c30:7d8b:c3e:1a47:99e8] (unknown [IPV6:240e:3b7:327f:5c30:7d8b:c3e:1a47:99e8]) by mail-m11876.qiye.163.com (Hmail) with ESMTPA id 101163C021F; Mon, 1 May 2023 15:41:17 +0800 (CST) Message-ID: <730cf5ed-2239-34f7-79a5-ffa4d9bb8fae@sangfor.com.cn> Date: Mon, 1 May 2023 15:41:18 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: [PATCH net v3 1/2] iavf: Fix use-after-free in free_netdev To: Simon Horman Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, intel-wired-lan@lists.osuosl.org, jesse.brandeburg@intel.com, anthony.l.nguyen@intel.com, keescook@chromium.org, grzegorzx.szczurek@intel.com, mateusz.palczewski@intel.com, mitch.a.williams@intel.com, gregory.v.rose@intel.com, jeffrey.t.kirsher@intel.com, michal.kubiak@intel.com, madhu.chittim@intel.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, pengdonglin@sangfor.com.cn, huangcun@sangfor.com.cn References: <20230429132022.31765-1-dinghui@sangfor.com.cn> <20230429132022.31765-2-dinghui@sangfor.com.cn> From: Ding Hui In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWS1ZQUlXWQ8JGhUIEh9ZQVlCSUNNVh1LTx5KH0gaHU4YQlUTARMWGhIXJBQOD1 lXWRgSC1lBWUlPSx5BSBlMQUhJTB1BThhIS0FMH0MZQRhIHkFKGk9MQUJCHkNZV1kWGg8SFR0UWU FZT0tIVUpKS0hKTFVKS0tVS1kG X-HM-Tid: 0a87d6423c432eb2kusn101163c021f X-HM-MType: 1 X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6N006Shw4KD0RCkIaHBQ5FA4I HT4KFBpVSlVKTUNJQklNQ0xDSkhPVTMWGhIXVR8SFRwTDhI7CBoVHB0UCVUYFBZVGBVFWVdZEgtZ QVlJT0seQUgZTEFISUwdQU4YSEtBTB9DGUEYSB5BShpPTEFCQh5DWVdZCAFZQUhOT0M3Bg++ Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2023/5/1 15:01, Simon Horman wrote: > On Sat, Apr 29, 2023 at 09:20:21PM +0800, Ding Hui wrote: >> We do netif_napi_add() for all allocated q_vectors[], but potentially >> do netif_napi_del() for part of them, then kfree q_vectors and leave >> invalid pointers at dev->napi_list. >> >> ... >> >> Although the patch #2 (of 2) can avoid the issuse triggered by this >> repro.sh, there still are other potential risks that if num_active_queues >> is changed to less than allocated q_vectors[] by unexpected, the >> mismatched netif_napi_add/del() can also casue UAF. > > nit: ./checkpatch --codespell tells me: > > s/casue/cause/ > Sorry, I'll fix it in v4. >> Since we actually call netif_napi_add() for all allocated q_vectors >> unconditionally in iavf_alloc_q_vectors(), so we should fix it by >> letting netif_napi_del() match to netif_napi_add(). >> >> Fixes: 5eae00c57f5e ("i40evf: main driver core") >> Signed-off-by: Ding Hui >> Cc: Donglin Peng >> Cc: Huang Cun >> Reviewed-by: Simon Horman >> Reviewed-by: Michal Kubiak >> Reviewed-by: Madhu Chittim > > > -- Thanks, -dinghui