diff mbox

ehea: fix use after free

Message ID 1288156867.2652.127.camel@edumazet-laptop
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Eric Dumazet Oct. 27, 2010, 5:21 a.m. UTC 
Le mardi 26 octobre 2010 à 20:48 +0200, Eric Dumazet a écrit :

> Note: driver already uses skb after its freeing, before your patch.
> 
>         if (vlan_tx_tag_present(skb)) {
>                 swqe->tx_control |= EHEA_SWQE_VLAN_INSERT;
>                 swqe->vlan_tag = vlan_tx_tag_get(skb);
>         }
> 

Could you please test following patch ?

Thanks

[PATCH] ehea: fix use after free

ehea_start_xmit() dereferences skb after its freeing in ehea_xmit3() to
get vlan tags.

Move the offending block before the potential ehea_xmit3() call.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
 drivers/net/ehea/ehea_main.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Breno Leitao Oct. 27, 2010, 4:05 p.m. UTC | #1 
> [PATCH] ehea: fix use after free
>
> ehea_start_xmit() dereferences skb after its freeing in ehea_xmit3() to
> get vlan tags.
>
> Move the offending block before the potential ehea_xmit3() call.
>
> Signed-off-by: Eric Dumazet<eric.dumazet@gmail.com>
Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Oct. 27, 2010, 6:39 p.m. UTC | #2 
From: Breno Leitao <leitao@linux.vnet.ibm.com>
Date: Wed, 27 Oct 2010 14:05:35 -0200

>> [PATCH] ehea: fix use after free
>>
>> ehea_start_xmit() dereferences skb after its freeing in ehea_xmit3()
>> to
>> get vlan tags.
>>
>> Move the offending block before the potential ehea_xmit3() call.
>>
>> Signed-off-by: Eric Dumazet<eric.dumazet@gmail.com>
> Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index bb7d306..e59d386 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -2249,6 +2249,11 @@  static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	memset(swqe, 0, SWQE_HEADER_SIZE);
 	atomic_dec(&pr->swqe_avail);
 
+	if (vlan_tx_tag_present(skb)) {
+		swqe->tx_control |= EHEA_SWQE_VLAN_INSERT;
+		swqe->vlan_tag = vlan_tx_tag_get(skb);
+	}
+
 	if (skb->len <= SWQE3_MAX_IMM) {
 		u32 sig_iv = port->sig_comp_iv;
 		u32 swqe_num = pr->swqe_id_counter;
@@ -2279,11 +2284,6 @@  static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 	pr->swqe_id_counter += 1;
 
-	if (vlan_tx_tag_present(skb)) {
-		swqe->tx_control |= EHEA_SWQE_VLAN_INSERT;
-		swqe->vlan_tag = vlan_tx_tag_get(skb);
-	}
-
 	if (netif_msg_tx_queued(port)) {
 		ehea_info("post swqe on QP %d", pr->qp->init_attr.qp_nr);
 		ehea_dump(swqe, 512, "swqe");