When flow_indr_dev_register() fails, bnxt_init_tc will free
bp->tc_info through kfree(). However, the caller function
bnxt_init_one() will ignore this failure and call
bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
a use-after-free happens. Fix this issue by setting
bp->tc_info to NULL after kfree().
Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
Signed-off-by: Dinghao Liu <[email protected]>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 38d89d80b4a9..273c9ba48f09 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
rhashtable_destroy(&tc_info->flow_table);
free_tc_info:
kfree(tc_info);
+ bp->tc_info = NULL;
return rc;
}
--
2.17.1
On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <[email protected]> wrote:
>
> When flow_indr_dev_register() fails, bnxt_init_tc will free
> bp->tc_info through kfree(). However, the caller function
> bnxt_init_one() will ignore this failure and call
> bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> a use-after-free happens. Fix this issue by setting
> bp->tc_info to NULL after kfree().
>
> Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
> Signed-off-by: Dinghao Liu <[email protected]>
> ---
> drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> index 38d89d80b4a9..273c9ba48f09 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
> rhashtable_destroy(&tc_info->flow_table);
> free_tc_info:
> kfree(tc_info);
> + bp->tc_info = NULL;
> return rc;
> }
The other way could have been to assign bp->tc_info only after
flow_indr_dev_register succeeds.
But this one works too. Thanks.
Reviewed-by: Pavan Chebbi <[email protected]>
>
> --
> 2.17.1
>
>
On Mon, Dec 4, 2023 at 12:56 AM Pavan Chebbi <[email protected]> wrote:
>
> On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <[email protected]> wrote:
> >
> > When flow_indr_dev_register() fails, bnxt_init_tc will free
> > bp->tc_info through kfree(). However, the caller function
> > bnxt_init_one() will ignore this failure and call
> > bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> > a use-after-free happens. Fix this issue by setting
> > bp->tc_info to NULL after kfree().
> >
> > Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
> > Signed-off-by: Dinghao Liu <[email protected]>
> > ---
> > drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > index 38d89d80b4a9..273c9ba48f09 100644
> > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> > @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
> > rhashtable_destroy(&tc_info->flow_table);
> > free_tc_info:
> > kfree(tc_info);
> > + bp->tc_info = NULL;
> > return rc;
> > }
>
> The other way could have been to assign bp->tc_info only after
> flow_indr_dev_register succeeds.
> But this one works too. Thanks.
> Reviewed-by: Pavan Chebbi <[email protected]>
I think this is the correct fix. flow_indr_dev_register(), if
successful, may call the driver's call back function and so
bp->tc_info must be set up before the call. Thanks.
Reviewed-by: Michael Chan <[email protected]>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:
On Mon, 4 Dec 2023 10:40:04 +0800 you wrote:
> When flow_indr_dev_register() fails, bnxt_init_tc will free
> bp->tc_info through kfree(). However, the caller function
> bnxt_init_one() will ignore this failure and call
> bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> a use-after-free happens. Fix this issue by setting
> bp->tc_info to NULL after kfree().
>
> [...]
Here is the summary with links:
- net: bnxt: fix a potential use-after-free in bnxt_init_tc
https://git.kernel.org/netdev/net/c/d007caaaf052
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html