* [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match()
@ 2023-05-12 15:35 edward.cree
2023-05-12 15:56 ` Simon Horman
2023-05-13 20:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: edward.cree @ 2023-05-12 15:35 UTC (permalink / raw)
To: linux-net-drivers, davem, kuba, pabeni, edumazet
Cc: Edward Cree, netdev, habetsm.xilinx, Simon Horman
From: Edward Cree <ecree.xilinx@gmail•com>
When writing error messages to extack for pseudo collisions, we can't
use encap->type as encap has already been freed. Fortunately the
same value is stored in local variable em_type, so use that instead.
Fixes: 3c9561c0a5b9 ("sfc: support TC decap rules matching on enc_ip_tos")
Reported-by: Simon Horman <simon.horman@corigine•com>
Signed-off-by: Edward Cree <ecree.xilinx@gmail•com>
---
drivers/net/ethernet/sfc/tc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
index da684b4b7211..6dfbdb39f2fe 100644
--- a/drivers/net/ethernet/sfc/tc.c
+++ b/drivers/net/ethernet/sfc/tc.c
@@ -504,7 +504,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
if (em_type != EFX_TC_EM_PSEUDO_MASK) {
NL_SET_ERR_MSG_FMT_MOD(extack,
"%s encap match conflicts with existing pseudo(MASK) entry",
- encap->type ? "Pseudo" : "Direct");
+ em_type ? "Pseudo" : "Direct");
return -EEXIST;
}
if (child_ip_tos_mask != old->child_ip_tos_mask) {
@@ -525,7 +525,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
default: /* Unrecognised pseudo-type. Just say no */
NL_SET_ERR_MSG_FMT_MOD(extack,
"%s encap match conflicts with existing pseudo(%d) entry",
- encap->type ? "Pseudo" : "Direct",
+ em_type ? "Pseudo" : "Direct",
old->type);
return -EEXIST;
}
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match()
2023-05-12 15:35 [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match() edward.cree
@ 2023-05-12 15:56 ` Simon Horman
2023-05-13 20:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2023-05-12 15:56 UTC (permalink / raw)
To: edward.cree
Cc: linux-net-drivers, davem, kuba, pabeni, edumazet, Edward Cree,
netdev, habetsm.xilinx
On Fri, May 12, 2023 at 04:35:58PM +0100, edward.cree@amd•com wrote:
> From: Edward Cree <ecree.xilinx@gmail•com>
>
> When writing error messages to extack for pseudo collisions, we can't
> use encap->type as encap has already been freed. Fortunately the
> same value is stored in local variable em_type, so use that instead.
>
> Fixes: 3c9561c0a5b9 ("sfc: support TC decap rules matching on enc_ip_tos")
> Reported-by: Simon Horman <simon.horman@corigine•com>
> Signed-off-by: Edward Cree <ecree.xilinx@gmail•com>
Thanks,
Reviewed-by: Simon Horman <simon.horman@corigine•com>
> ---
> drivers/net/ethernet/sfc/tc.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
> index da684b4b7211..6dfbdb39f2fe 100644
> --- a/drivers/net/ethernet/sfc/tc.c
> +++ b/drivers/net/ethernet/sfc/tc.c
> @@ -504,7 +504,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
> if (em_type != EFX_TC_EM_PSEUDO_MASK) {
> NL_SET_ERR_MSG_FMT_MOD(extack,
> "%s encap match conflicts with existing pseudo(MASK) entry",
> - encap->type ? "Pseudo" : "Direct");
> + em_type ? "Pseudo" : "Direct");
> return -EEXIST;
> }
> if (child_ip_tos_mask != old->child_ip_tos_mask) {
> @@ -525,7 +525,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
> default: /* Unrecognised pseudo-type. Just say no */
> NL_SET_ERR_MSG_FMT_MOD(extack,
> "%s encap match conflicts with existing pseudo(%d) entry",
> - encap->type ? "Pseudo" : "Direct",
> + em_type ? "Pseudo" : "Direct",
> old->type);
> return -EEXIST;
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match()
2023-05-12 15:35 [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match() edward.cree
2023-05-12 15:56 ` Simon Horman
@ 2023-05-13 20:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-05-13 20:00 UTC (permalink / raw)
To: edward.cree
Cc: linux-net-drivers, davem, kuba, pabeni, edumazet, ecree.xilinx,
netdev, habetsm.xilinx, simon.horman
Hello:
This patch was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft•net>:
On Fri, 12 May 2023 16:35:58 +0100 you wrote:
> From: Edward Cree <ecree.xilinx@gmail•com>
>
> When writing error messages to extack for pseudo collisions, we can't
> use encap->type as encap has already been freed. Fortunately the
> same value is stored in local variable em_type, so use that instead.
>
> Fixes: 3c9561c0a5b9 ("sfc: support TC decap rules matching on enc_ip_tos")
> Reported-by: Simon Horman <simon.horman@corigine•com>
> Signed-off-by: Edward Cree <ecree.xilinx@gmail•com>
>
> [...]
Here is the summary with links:
- [net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match()
https://git.kernel.org/netdev/net-next/c/befcc1fce564
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-05-13 20:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-12 15:35 [PATCH net-next] sfc: fix use-after-free in efx_tc_flower_record_encap_match() edward.cree
2023-05-12 15:56 ` Simon Horman
2023-05-13 20:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox