lkml.org 
[lkml]   [2019]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 4.19 185/306] net: hns3: bugfix for buffer not free problem during resetting
Hi!

> From: Huazhong Tan <tanhuazhong@huawei.com>
>
> [ Upstream commit 73b907a083b8a8c1c62cb494bc9fbe6ae086c460 ]
>
> When hns3_get_ring_config()/hns3_queue_to_ring()/
> hns3_get_vector_ring_chain() failed during resetting, the allocated
> memory has not been freed before these three functions return. So
> this patch adds error handler in these functions to fix it.

Correct me if I'm wrong, but... this introduces use-after-free:

> @@ -2592,6 +2592,16 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
> }
>
> return 0;
> +
> +err_free_chain:
> + cur_chain = head->next;
> + while (cur_chain) {
> + chain = cur_chain->next;
> + devm_kfree(&pdev->dev, chain);
> + cur_chain = chain;
> + }

Lets take two iterations:

> + chain = cur_chain->next;
> + devm_kfree(&pdev->dev, chain);
chain freed here.
> + cur_chain = chain;

> + chain = cur_chain->next;
chain->next accessed here, after free.
> + devm_kfree(&pdev->dev, chain);
> + cur_chain = chain;

Should it do devm_kfree(&pdev->dev, cur_chain); ?

Best regards,
Pavel

--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2019-11-29 12:01    [W:0.811 / U:0.452 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site