Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Biju Das <biju.das.jz@bp.renesas.com>
To:     YueHaibing <yuehaibing@huawei.com>,
        "s.shtylyov@omp.ru" <s.shtylyov@omp.ru>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "edumazet@google.com" <edumazet@google.com>,
        "kuba@kernel.org" <kuba@kernel.org>,
        "pabeni@redhat.com" <pabeni@redhat.com>,
        "phil.edworthy@renesas.com" <phil.edworthy@renesas.com>,
        Prabhakar Mahadev Lad <prabhakar.mahadev-lad.rj@bp.renesas.com>
CC:     "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-renesas-soc@vger.kernel.org" 
        <linux-renesas-soc@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH net] ravb: Fix potential use-after-free in ravb_rx_gbeth()
Thread-Topic: [PATCH net] ravb: Fix potential use-after-free in
 ravb_rx_gbeth()
Thread-Index: AQHZBvnifjjXKLvqgUuypcFW2XI0pa5b8fDQ
Date:   Sat, 3 Dec 2022 10:29:08 +0000
Message-ID: <OS0PR01MB592214C639E060C5AD3A67BF86169@OS0PR01MB5922.jpnprd01.prod.outlook.com>
References: <20221203092941.10880-1-yuehaibing@huawei.com>
In-Reply-To: <20221203092941.10880-1-yuehaibing@huawei.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ogekbapocxOJPM0nUTFUINYpg6fLe3JD9FOrofDRc0DipwS48+ZCpWvOje68?=
 =?us-ascii?Q?fZAUhX34OMi5nii4zhb2fu7xMr0n9qcUPPVgaQwluJyNBuUUO05yc3LmtdG7?=
 =?us-ascii?Q?Yo3rmBGs1/j7GTaNFq1/4GTMrXgm11IDZ8ZuwDpCco5Vgwd1Ai6pIG/EegTu?=
 =?us-ascii?Q?A+4pqGhRw09R4yWRkLJIJiyJZJWxKVt++FUjhkNdh6rN88HUq5LYLcvwo43I?=
 =?us-ascii?Q?a7nb6Nin59BmtklGOqFo+wPa0LLcx5XD7wyOH/9KtsJnXV7t+ixOEvdF19xV?=
 =?us-ascii?Q?EoTWm2HO0DNqTFQhy7aguYlUDNwXxJRrCO+wjV5gXwuPAd9fyW5tk+XyxJ3M?=
 =?us-ascii?Q?ng0z+B7WMWct9syAsz+6dVQWQi+4TQBBSL5Gzut/inbZqpwl4KXn+Cogv+ql?=
 =?us-ascii?Q?ZbfHKEQzQXMA23EV12b1mmIsW8MYDk2H+OxhvqtI7s7jL9pmwdmtci+/phMz?=
 =?us-ascii?Q?C/Pc6fTCB88NNjusRnChjLwnJyFVenEkwZNun6wPxbl1b1lEnUUeGPPBrEJU?=
 =?us-ascii?Q?/iBW6pyA/nkBNN7nbXDdNkbjVaatVbyOoaFCc2lLslykfYdZRXQgyV2+b2ZA?=
 =?us-ascii?Q?SRT6bfMc7BO23E780QUkZc8Ea3YqLy6v9aJHSuR7Dx6toG0Hyj6abQHcnCvJ?=
 =?us-ascii?Q?YtNgiuy7KOvYKI6G/JQr3QeXAD32dXWfb91w3aRJAuETtiRhKdeDC6Lg4Axg?=
 =?us-ascii?Q?zNPhYMf/hvwv1LMvzvB9e3bTj3OSR+74tRQ9LJQL2QWrJxcg303LeEh0ra1w?=
 =?us-ascii?Q?vWVd5N96OETQO66h/OofcTwqE2NAOc5Y99S6PM8wvaGSiH73gcA2IqgqYz+v?=
 =?us-ascii?Q?Tx1+JM8AGweRztV9byShkl0axi1pTLSFm6cb1pYxI6Xkoo8eh+CvkNDWfO60?=
 =?us-ascii?Q?44ImWhxDiQJq6VGW6K+ZPGYS7raCLvsbyvKeqGHooWZ/y8rzSZ/2Gs3kEVvq?=
 =?us-ascii?Q?lGyNUAu6F7wZrMKXeMMygybx9w1pUa9T2b4babuUQ+CzVpt4RbhIgFpjreXz?=
 =?us-ascii?Q?5gakXfFzhTqH4qls7wCxnEAuq9Ev8JiEXloBR8B7ZTPYrvWo7MYhMBmnwI4y?=
 =?us-ascii?Q?bwkyJCkLMoA74x4bOcEP/s4wuwwYHZLFdUGkW43Q7sX6iGOhRSD3ixGhl1Eq?=
 =?us-ascii?Q?p5CToTEKF4vZ4iQ84lODLuNAf+q6v6eERKdT7NPv+vptifA+hOyn2SDO9MbR?=
 =?us-ascii?Q?qm+6KepZk3CEoTkM4iEgsS+bNOH04MHp84NWBrly5VcyZ7Hgrnzy9+bAbdiE?=
 =?us-ascii?Q?UcKyQOYr6H4wLBdiRgQWVVhJGKU8s+rus19RzIkwERzM2ouuJCpepWtkp8Xy?=
 =?us-ascii?Q?K95nmSE67tIbfN7CBpZknFiKFBaEnoWIB5ZCLsfZe2LSCaJMRdIul8GD2iOJ?=
 =?us-ascii?Q?UcX3gq9agNAJBI53FjUqnWX3VjCHGcq53/IJ96CG3isQwcTNB61M74HS1+XV?=
 =?us-ascii?Q?yJVO/S1FYiOUoBeh7XIT3Vjl/HNjphGycCfqbfGOuoNlQ8jliaMWvDDOlzUc?=
 =?us-ascii?Q?XhMQP8IBEf/+zTLdkWzLrikBGWb6Pe0sauB6Z2NKwMsKTiWttFoQFJ5cQsIv?=
 =?us-ascii?Q?hpXONdD6MEUWO+u6NPOehIcuDjdimYkNHZzFhzZG1yf5f5F2ULOwY7BB2agI?=
 =?us-ascii?Q?qA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: bp.renesas.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: OS0PR01MB5922.jpnprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 544154a6-0707-467f-94fb-08dad519360c
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Dec 2022 10:29:08.3564
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 53d82571-da19-47e4-9cb4-625a166a4a2a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 9txMPM9iJeytrUFmbaph765Vcvk8yXn2rZIad54U8yp3WqGRKmqODdV8WkZzRgFwKR83uVLYqGztPrL8j+JwaZD35yUYJplFBa8+Wtd2V8Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OS3PR01MB7826
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi YueHaibing,

Thanks for the feedback.

> Subject: [PATCH net] ravb: Fix potential use-after-free in
> ravb_rx_gbeth()
>=20
> The skb is delivered to napi_gro_receive() which may free it, after
> calling this, dereferencing skb may trigger use-after-free.

Can you please reconfirm the changes you have done is actually fixing any i=
ssue?=20
If yes, please provide the details.

Current code,

napi_gro_receive(&priv->napi[q], priv->rx_1st_skb);

- stats->rx_bytes +=3D priv->rx_1st_skb->len;
+ stats->rx_bytes +=3D pkt_len;

Note: I haven't tested your patch yet to see it cause any regression.

Cheers,
Biju

>=20
> Fixes: 1c59eb678cbd ("ravb: Fillup ravb_rx_gbeth() stub")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
> ---
>  drivers/net/ethernet/renesas/ravb_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/drivers/net/ethernet/renesas/ravb_main.c
> b/drivers/net/ethernet/renesas/ravb_main.c
> index 6bc923326268..33f723a9f471 100644
> --- a/drivers/net/ethernet/renesas/ravb_main.c
> +++ b/drivers/net/ethernet/renesas/ravb_main.c
> @@ -841,7 +841,7 @@ static bool ravb_rx_gbeth(struct net_device *ndev,
> int *quota, int q)
>  				napi_gro_receive(&priv->napi[q],
>  						 priv->rx_1st_skb);
>  				stats->rx_packets++;
> -				stats->rx_bytes +=3D priv->rx_1st_skb->len;
> +				stats->rx_bytes +=3D pkt_len;
>  				break;
>  			}
>  		}
> --
> 2.34.1