6.6-stable patches

added patches:
	net-rswitch-avoid-use-after-free-in-rswitch_poll.patch

diff --git a/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch b/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch
new file mode 100644 (file)
index 0000000..f613f14
--- /dev/null
+++ b/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch
@@ -0,0 +1,52 @@
+From 9a0c28efeec6383ef22e97437616b920e7320b67 Mon Sep 17 00:00:00 2001
+From: Radu Rendec <rrendec@redhat.com>
+Date: Tue, 2 Jul 2024 17:08:37 -0400
+Subject: net: rswitch: Avoid use-after-free in rswitch_poll()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Radu Rendec <rrendec@redhat.com>
+
+commit 9a0c28efeec6383ef22e97437616b920e7320b67 upstream.
+
+The use-after-free is actually in rswitch_tx_free(), which is inlined in
+rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
+same pointer, the skb is first freed using dev_kfree_skb_any(), then the
+value in skb->len is used to update the interface statistics.
+
+Let's move around the instructions to use skb->len before the skb is
+freed.
+
+This bug is trivial to reproduce using KFENCE. It will trigger a splat
+every few packets. A simple ARP request or ICMP echo request is enough.
+
+Fixes: 271e015b9153 ("net: rswitch: Add unmap_addrs instead of dma address in each desc")
+Signed-off-by: Radu Rendec <rrendec@redhat.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://patch.msgid.link/20240702210838.2703228-1-rrendec@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/rswitch.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/rswitch.c
++++ b/drivers/net/ethernet/renesas/rswitch.c
+@@ -799,13 +799,13 @@ static void rswitch_tx_free(struct net_d
+ 
+               skb = gq->skbs[gq->dirty];
+               if (skb) {
++                      rdev->ndev->stats.tx_packets++;
++                      rdev->ndev->stats.tx_bytes += skb->len;
+                       dma_unmap_single(ndev->dev.parent,
+                                        gq->unmap_addrs[gq->dirty],
+                                        skb->len, DMA_TO_DEVICE);
+                       dev_kfree_skb_any(gq->skbs[gq->dirty]);
+                       gq->skbs[gq->dirty] = NULL;
+-                      rdev->ndev->stats.tx_packets++;
+-                      rdev->ndev->stats.tx_bytes += skb->len;
+               }
+ 
+               desc->desc.die_dt = DT_EEMPTY;

diff --git a/queue-6.6/series b/queue-6.6/series
index 148ff1c64523d5d22192ba20d0dfbcdea3a43d45..29d4082a0dcebf6572365a3500f5bc1e4a99b767 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -97,3 +97,4 @@ bpf-sync_linked_regs-must-preserve-subreg_def.patch
 tracing-kprobes-skip-symbol-counting-logic-for-module-symbols-in-create_local_trace_kprobe.patch
 selftests-bpf-add-netlink-helper-library.patch
 selftests-bpf-remove-use-of-__xlated.patch
+net-rswitch-avoid-use-after-free-in-rswitch_poll.patch