From: Greg Kroah-Hartman Date: Tue, 17 Dec 2024 09:38:39 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.4.288~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e42366ee01a34e4cf9c4f940ccb6cf4967be0a36;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: net-rswitch-avoid-use-after-free-in-rswitch_poll.patch --- diff --git a/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch b/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch new file mode 100644 index 00000000000..f613f14c330 --- /dev/null +++ b/queue-6.6/net-rswitch-avoid-use-after-free-in-rswitch_poll.patch @@ -0,0 +1,52 @@ +From 9a0c28efeec6383ef22e97437616b920e7320b67 Mon Sep 17 00:00:00 2001 +From: Radu Rendec +Date: Tue, 2 Jul 2024 17:08:37 -0400 +Subject: net: rswitch: Avoid use-after-free in rswitch_poll() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Radu Rendec + +commit 9a0c28efeec6383ef22e97437616b920e7320b67 upstream. + +The use-after-free is actually in rswitch_tx_free(), which is inlined in +rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the +same pointer, the skb is first freed using dev_kfree_skb_any(), then the +value in skb->len is used to update the interface statistics. + +Let's move around the instructions to use skb->len before the skb is +freed. + +This bug is trivial to reproduce using KFENCE. It will trigger a splat +every few packets. A simple ARP request or ICMP echo request is enough. + +Fixes: 271e015b9153 ("net: rswitch: Add unmap_addrs instead of dma address in each desc") +Signed-off-by: Radu Rendec +Reviewed-by: Yoshihiro Shimoda +Reviewed-by: Niklas Söderlund +Link: https://patch.msgid.link/20240702210838.2703228-1-rrendec@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/rswitch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/renesas/rswitch.c ++++ b/drivers/net/ethernet/renesas/rswitch.c +@@ -799,13 +799,13 @@ static void rswitch_tx_free(struct net_d + + skb = gq->skbs[gq->dirty]; + if (skb) { ++ rdev->ndev->stats.tx_packets++; ++ rdev->ndev->stats.tx_bytes += skb->len; + dma_unmap_single(ndev->dev.parent, + gq->unmap_addrs[gq->dirty], + skb->len, DMA_TO_DEVICE); + dev_kfree_skb_any(gq->skbs[gq->dirty]); + gq->skbs[gq->dirty] = NULL; +- rdev->ndev->stats.tx_packets++; +- rdev->ndev->stats.tx_bytes += skb->len; + } + + desc->desc.die_dt = DT_EEMPTY; diff --git a/queue-6.6/series b/queue-6.6/series index 148ff1c6452..29d4082a0dc 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -97,3 +97,4 @@ bpf-sync_linked_regs-must-preserve-subreg_def.patch tracing-kprobes-skip-symbol-counting-logic-for-module-symbols-in-create_local_trace_kprobe.patch selftests-bpf-add-netlink-helper-library.patch selftests-bpf-remove-use-of-__xlated.patch +net-rswitch-avoid-use-after-free-in-rswitch_poll.patch