Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ff359bed-ddfa-9f18-e926-fad986b9918b@gmail.com>
Date:   Mon, 8 Aug 2022 10:42:39 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.12.0
Subject: Re: [PATCH] brcmfmac: fix use-after-free bug
Content-Language: en-US
To:     Alexander Coffin <alex.coffin@matician.com>,
        Franky Lin <franky.lin@broadcom.com>,
        Hante Meuleman <hante.meuleman@broadcom.com>
Cc:     linux-wireless@vger.kernel.org,
        brcm80211-dev-list.pdl@broadcom.com,
        SHA-cyfmac-dev-list@infineon.com
References: <20220802172823.1696680-1-alex.coffin@matician.com>
 <20220802172823.1696680-2-alex.coffin@matician.com>
From:   Arend Van Spriel <aspriel@gmail.com>
In-Reply-To: <20220802172823.1696680-2-alex.coffin@matician.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 8/2/2022 7:28 PM, Alexander Coffin wrote:
 >

A commit message would have been nice...

> Signed-off-by: Alexander Coffin <alex.coffin@matician.com>
> ---
>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> index 87aef211b35f..12ee8b7163fd 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> @@ -296,6 +296,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
>   	struct brcmf_pub *drvr = ifp->drvr;
>   	struct ethhdr *eh;
>   	int head_delta;
> +	unsigned int tx_bytes = skb->len;
>   
>   	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
>   
> @@ -370,7 +371,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
>   		ndev->stats.tx_dropped++;
>   	} else {
>   		ndev->stats.tx_packets++;
> -		ndev->stats.tx_bytes += skb->len;
> +		ndev->stats.tx_bytes += tx_bytes;

Why would this be a use-after-free? We only get here when ret is zero. 
In that case the skb is not freed. If there would be a commit message 
with some error report that proofs there is a use-after-free I would 
look into this further, but now I just say NAK.

Regards,
Arend

>   	}
>   
>   	/* Return ok: we always eat the packet */