2018-11-28 08:11:08

by Pan Bian

Subject: [PATCH] amd-xgbe: set skb to NULL after freeing it

The buffer skb is freed via dev_kfree_skb in a loop. skb may be used
again in the next iteration, resulting in a use-after-free bug. To fix
this, the patch set skb to NULL after dev_kfree_skb(skb).

Signed-off-by: Pan Bian <[email protected]>
---
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 0cc911f..ac6b82d 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -2754,6 +2754,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
netif_err(pdata, rx_err, netdev,
"error in received packet\n");
dev_kfree_skb(skb);
+ skb = NULL;
goto next_packet;
}

@@ -2806,6 +2807,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
netif_err(pdata, rx_err, netdev,
"packet length exceeds configured MTU\n");
dev_kfree_skb(skb);
+ skb = NULL;
goto next_packet;
}

--
2.7.4

2018-11-28 18:51:53

by David Miller

Subject: Re: [PATCH] amd-xgbe: set skb to NULL after freeing it

From: Pan Bian <[email protected]>
Date: Wed, 28 Nov 2018 16:09:45 +0800

> @@ -2754,6 +2754,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
> netif_err(pdata, rx_err, netdev,
> "error in received packet\n");
> dev_kfree_skb(skb);
> + skb = NULL;
> goto next_packet;
> }
>
> @@ -2806,6 +2807,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
> netif_err(pdata, rx_err, netdev,
> "packet length exceeds configured MTU\n");
> dev_kfree_skb(skb);
> + skb = NULL;
> goto next_packet;
> }
>
> --
> 2.7.4

If either of these two cases are executed, it means that it must be
the case that:

!last || context_next

is FALSE, therefore the conditional in the tail code of this function:

/* Check if we need to save state before leaving */
if (received && (!last || context_next)) {
rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
rdata->state_saved = 1;
rdata->state.skb = skb;
rdata->state.len = len;
rdata->state.error = error;
}

will not trigger, and therefore we will not record the free'd SKB.

And if we iterate the loop again, it is guaranteed that 'skb' will
be set to a new packet or NULL.

So there is no problem here.

2018-11-29 07:39:46

by Pan Bian

Subject: Re: [PATCH] amd-xgbe: set skb to NULL after freeing it

On Wed, Nov 28, 2018 at 10:49:31AM -0800, David Miller wrote:
> From: Pan Bian <[email protected]>
> Date: Wed, 28 Nov 2018 16:09:45 +0800
>
> If either of these two cases are executed, it means that it must be
> the case that:
>
> !last || context_next
>
> is FALSE, therefore the conditional in the tail code of this function:
>
> /* Check if we need to save state before leaving */
> if (received && (!last || context_next)) {
> rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
> rdata->state_saved = 1;
> rdata->state.skb = skb;
> rdata->state.len = len;
> rdata->state.error = error;
> }
>
> will not trigger, and therefore we will not record the free'd SKB.
>
> And if we iterate the loop again, it is guaranteed that 'skb' will
> be set to a new packet or NULL.
>
> So there is no problem here.

Got it. Sorry for my misunderstanding. Thank you and Tom for the
detailed explanations.

Pan