From patchwork Thu Nov 19 11:09:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Eggers X-Patchwork-Id: 328986 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.9 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 716BDC6369E for ; Thu, 19 Nov 2020 11:10:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1C7E0246B2 for ; Thu, 19 Nov 2020 11:10:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726995AbgKSLJo (ORCPT ); Thu, 19 Nov 2020 06:09:44 -0500 Received: from mailout12.rmx.de ([94.199.88.78]:35266 "EHLO mailout12.rmx.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725783AbgKSLJo (ORCPT ); Thu, 19 Nov 2020 06:09:44 -0500 Received: from kdin02.retarus.com (kdin02.dmz1.retloc [172.19.17.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout12.rmx.de (Postfix) with ESMTPS id 4CcH51163qzRp1J; Thu, 19 Nov 2020 12:09:41 +0100 (CET) Received: from mta.arri.de (unknown [217.111.95.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by kdin02.retarus.com (Postfix) with ESMTPS id 4CcH4V2sdZz2TTJR; Thu, 19 Nov 2020 12:09:14 +0100 (CET) Received: from N95HX1G2.wgnetz.xx (192.168.54.113) by mta.arri.de (192.168.100.104) with Microsoft SMTP Server (TLS) id 14.3.487.0; Thu, 19 Nov 2020 12:09:14 +0100 From: Christian Eggers To: Andrew Lunn , Florian Fainelli , Vladimir Oltean CC: Vivien Didelot , "David S . Miller" , Jakub Kicinski , , , Christian Eggers Subject: [PATCH net-next v2] net: dsa: avoid potential use-after-free error Date: Thu, 19 Nov 2020 12:09:06 +0100 Message-ID: <20201119110906.25558-1-ceggers@arri.de> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Originating-IP: [192.168.54.113] X-RMX-ID: 20201119-120914-4CcH4V2sdZz2TTJR-0@kdin02 X-RMX-SOURCE: 217.111.95.66 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If dsa_switch_ops::port_txtstamp() returns false, clone will be freed immediately. Shouldn't store a pointer to freed memory. Signed-off-by: Christian Eggers Fixes: 146d442c2357 ("net: dsa: Keep a pointer to the skb clone for TX timestamping") Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Reviewed-by: Florian Fainelli --- Changes since v1: - Fixed "Fixes:" tag (and configured my GIT) - Adjusted commit description net/dsa/slave.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/dsa/slave.c b/net/dsa/slave.c index ff2266d2b998..7efc753e4d9d 100644 --- a/net/dsa/slave.c +++ b/net/dsa/slave.c @@ -522,10 +522,10 @@ static void dsa_skb_tx_timestamp(struct dsa_slave_priv *p, if (!clone) return; - DSA_SKB_CB(skb)->clone = clone; - - if (ds->ops->port_txtstamp(ds, p->dp->index, clone, type)) + if (ds->ops->port_txtstamp(ds, p->dp->index, clone, type)) { + DSA_SKB_CB(skb)->clone = clone; return; + } kfree_skb(clone); }