Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bc3077669c1f3f9bd2aca486dcbea9b508dbf318.camel@gmail.com>
Subject: Re: [PATCH net] e100: Fix possible use after free in
 e100_xmit_prepare
From:   Alexander H Duyck <alexander.duyck@gmail.com>
To:     Wang Hai <wanghai38@huawei.com>, jesse.brandeburg@intel.com,
        anthony.l.nguyen@intel.com, baijiaju1990@163.com,
        jeffrey.t.kirsher@intel.com, davem@davemloft.net,
        edumazet@google.com, kuba@kernel.org, pabeni@redhat.com
Cc:     linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        intel-wired-lan@lists.osuosl.org
Date:   Wed, 16 Nov 2022 08:21:19 -0800
In-Reply-To: <20221115172407.72863-1-wanghai38@huawei.com>
References: <20221115172407.72863-1-wanghai38@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4 (3.44.4-2.fc36) 
MIME-Version: 1.0
Precedence: bulk

On Wed, 2022-11-16 at 01:24 +0800, Wang Hai wrote:
> In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so
> e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will
> resend the skb. But the skb is already freed, which will cause UAF bug
> when the upper layer resends the skb.
>=20
> Remove the harmful free.
>=20
> Fixes: 5e5d49422dfb ("e100: Release skb when DMA mapping is failed in e10=
0_xmit_prepare")
> Signed-off-by: Wang Hai <wanghai38@huawei.com>
> ---
>  drivers/net/ethernet/intel/e100.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
>=20
> diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/int=
el/e100.c
> index 560d1d442232..d3fdc290937f 100644
> --- a/drivers/net/ethernet/intel/e100.c
> +++ b/drivers/net/ethernet/intel/e100.c
> @@ -1741,11 +1741,8 @@ static int e100_xmit_prepare(struct nic *nic, stru=
ct cb *cb,
>  	dma_addr =3D dma_map_single(&nic->pdev->dev, skb->data, skb->len,
>  				  DMA_TO_DEVICE);
>  	/* If we can't map the skb, have the upper layer try later */
> -	if (dma_mapping_error(&nic->pdev->dev, dma_addr)) {
> -		dev_kfree_skb_any(skb);
> -		skb =3D NULL;
> +	if (dma_mapping_error(&nic->pdev->dev, dma_addr))
>  		return -ENOMEM;
> -	}
> =20
>  	/*
>  	 * Use the last 4 bytes of the SKB payload packet as the CRC, used for

I'm surprised the original patch that this essentially reverts was even
accepted.

Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>