| Message ID | b66c3b2603da49706597d84aacb7ac8b4ffb1820.1579952387.git.lorenzo@kernel.org |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | XDP fixes for socionext driver | expand |
On Sat, 25 Jan 2020 12:48:50 +0100 Lorenzo Bianconi <lorenzo@kernel.org> wrote: > Fix possible use-after-free in in netsec_process_rx that can occurs if > the first packet is sent to the normal networking stack and the > following one is dropped by the bpf program attached to the xdp hook. > Fix the issue defining the skb pointer in the 'budget' loop > > Fixes: ba2b232108d3c ("net: netsec: add XDP support") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > --- Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> > drivers/net/ethernet/socionext/netsec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c > index 869a498e3b5e..0e12a9856aea 100644 > --- a/drivers/net/ethernet/socionext/netsec.c > +++ b/drivers/net/ethernet/socionext/netsec.c > @@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) > struct netsec_rx_pkt_info rx_info; > enum dma_data_direction dma_dir; > struct bpf_prog *xdp_prog; > - struct sk_buff *skb = NULL; > u16 xdp_xmit = 0; > u32 xdp_act = 0; > int done = 0; > @@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) > struct netsec_de *de = dring->vaddr + (DESC_SZ * idx); > struct netsec_desc *desc = &dring->desc[idx]; > struct page *page = virt_to_page(desc->addr); > + struct sk_buff *skb = NULL; > u32 xdp_result = XDP_PASS; > u16 pkt_len, desc_len; > dma_addr_t dma_handle; Yes, this is needed in case an xdp_prog jumps to label 'next:', skipping the skb = build_skb() assignment.
On Sat, Jan 25, 2020 at 12:48:50PM +0100, Lorenzo Bianconi wrote: > Fix possible use-after-free in in netsec_process_rx that can occurs if > the first packet is sent to the normal networking stack and the > following one is dropped by the bpf program attached to the xdp hook. > Fix the issue defining the skb pointer in the 'budget' loop > > Fixes: ba2b232108d3c ("net: netsec: add XDP support") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > --- > drivers/net/ethernet/socionext/netsec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c > index 869a498e3b5e..0e12a9856aea 100644 > --- a/drivers/net/ethernet/socionext/netsec.c > +++ b/drivers/net/ethernet/socionext/netsec.c > @@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) > struct netsec_rx_pkt_info rx_info; > enum dma_data_direction dma_dir; > struct bpf_prog *xdp_prog; > - struct sk_buff *skb = NULL; > u16 xdp_xmit = 0; > u32 xdp_act = 0; > int done = 0; > @@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) > struct netsec_de *de = dring->vaddr + (DESC_SZ * idx); > struct netsec_desc *desc = &dring->desc[idx]; > struct page *page = virt_to_page(desc->addr); > + struct sk_buff *skb = NULL; > u32 xdp_result = XDP_PASS; > u16 pkt_len, desc_len; > dma_addr_t dma_handle; > -- > 2.21.1 > Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c index 869a498e3b5e..0e12a9856aea 100644 --- a/drivers/net/ethernet/socionext/netsec.c +++ b/drivers/net/ethernet/socionext/netsec.c @@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) struct netsec_rx_pkt_info rx_info; enum dma_data_direction dma_dir; struct bpf_prog *xdp_prog; - struct sk_buff *skb = NULL; u16 xdp_xmit = 0; u32 xdp_act = 0; int done = 0; @@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget) struct netsec_de *de = dring->vaddr + (DESC_SZ * idx); struct netsec_desc *desc = &dring->desc[idx]; struct page *page = virt_to_page(desc->addr); + struct sk_buff *skb = NULL; u32 xdp_result = XDP_PASS; u16 pkt_len, desc_len; dma_addr_t dma_handle;
Fix possible use-after-free in in netsec_process_rx that can occurs if the first packet is sent to the normal networking stack and the following one is dropped by the bpf program attached to the xdp hook. Fix the issue defining the skb pointer in the 'budget' loop Fixes: ba2b232108d3c ("net: netsec: add XDP support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- drivers/net/ethernet/socionext/netsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)