Messages in this thread | | | Date | Tue, 27 Apr 2021 10:55:06 +0800 (GMT+08:00) | From | lyl2019@mail ... | Subject | [BUG] ethernet:enic: A use after free bug in enic_hard_start_xmit |
| |
Hi, maintainers. Our code analyzer reported a uaf bug, but it is a little difficult for me to fix it directly.
File: drivers/net/ethernet/cisco/enic/enic_main.c In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb).
``` enic_queue_wq_skb(enic, wq, skb);// skb could freed here
if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) netif_tx_stop_queue(txq); skb_tx_timestamp(skb); // freed skb is used here. ``` Bug introduced by fb7516d42478e ("enic: add sw timestamp support").
Thanks for your time, looking forwarding to your reply. Lv Yunlong <lyl2019@mail.ustc.edu.cn>
| |