From patchwork Fri Mar 1 08:06:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Horatiu Vultur X-Patchwork-Id: 208686 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:2097:b0:108:e6aa:91d0 with SMTP id gs23csp927554dyb; Fri, 1 Mar 2024 00:06:51 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCVf2VCMsiebJSXlIoC4Jansj3Auv99sLe3G9Nhmz6AYIgq0ElsiaNYbk9wkTB7oHIP1HJypTd+NZuZmDM6jrBkl8xzdjA== X-Google-Smtp-Source: AGHT+IGR4yyyR6Yo7XU6v3nD5lbOxYAPnjFljeI4/V8xBA16ZYSNZgvQFH0HA8tjNQS+CkeJUXXE X-Received: by 2002:a05:6808:229e:b0:3c1:d272:c070 with SMTP id bo30-20020a056808229e00b003c1d272c070mr1351560oib.28.1709280410795; Fri, 01 Mar 2024 00:06:50 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1709280410; cv=pass; d=google.com; s=arc-20160816; b=Zd72f8XnVblMtWNFs9Dw9IHCfK3xYRfahAXnJB61F28AdO4lU3hlDFg8B9XCDzy0tK zgXokLzRDXkYLYkuZ2eZE3TF0pMhY5AdzKu7a3E1YifUgQipMPeQnFxkuBN1s8tAthvT f0QJV8NwuFRJXSc0OAan+D94hIgghWIyjh36PHNScl7TN7F6v8oiAskTWwsDlgM9UBXp BKE09IFIF/D7kvVYqc3ty0fx5RhgW2sI7B/UnZG2PXzKxJmwA/mYGqd5IvQl5PhacnFx lBk0JNllDe5vMtSQo/RpOEaoH9ZEDFqZOxeH3gaE6vZO2HE4wAgLOibYVjnD8F+FMkZB zl1A== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from:dkim-signature; bh=tRDg/JVMYs+OcnaZjipKyW12I6CORNqwsgGpCHW1f98=; fh=XDpHrGypMQdTH7CcLHvDQCichdVQfXHrk0PYvIiMRvw=; b=j/8W65BZwHMB9t32FhBJEk8qyah/JV76svaZhwVsx/aMLXG07dUASz2uTgaEcVgxeA vEyIKGpw5woZdmsK9XwCuVBGpTRU095cRuoHIgwWXXjKCrE/BRg2qnwMXvS2YU01nXSO LK3KTke4GkvqjcTmvDoNasPJxLbNiQm7qiK9q+1g5h+d9sZR38c7OrV/k0HWIYTdWbV8 0wU6yaYtMmptAH2utYcu2YL6JOQ+k6m6wZ/FgrYwjHK+qxeTdCNjdpy9pdDrxOFX5wsd IpZ04j13PqKl+vH1MUZ9cAz16DjQT78DbEU5dhtzHmt62+StL7nF/gYgb0xRS00DRl7I YSCw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@microchip.com header.s=mchp header.b=mZSWsqbI; arc=pass (i=1 spf=pass spfdomain=microchip.com dkim=pass dkdomain=microchip.com dmarc=pass fromdomain=microchip.com); spf=pass (google.com: domain of linux-kernel+bounces-88046-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-88046-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=REJECT dis=NONE) header.from=microchip.com Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [2604:1380:40f1:3f00::1]) by mx.google.com with ESMTPS id p22-20020a639516000000b005e428bea40esi3227172pgd.0.2024.03.01.00.06.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Mar 2024 00:06:50 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-88046-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@microchip.com header.s=mchp header.b=mZSWsqbI; arc=pass (i=1 spf=pass spfdomain=microchip.com dkim=pass dkdomain=microchip.com dmarc=pass fromdomain=microchip.com); spf=pass (google.com: domain of linux-kernel+bounces-88046-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-88046-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=REJECT dis=NONE) header.from=microchip.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 9BD15B23CED for ; Fri, 1 Mar 2024 08:06:40 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E0BBA69D33; Fri, 1 Mar 2024 08:06:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b="mZSWsqbI" Received: from esa.microchip.iphmx.com (esa.microchip.iphmx.com [68.232.153.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFE996930E; Fri, 1 Mar 2024 08:06:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=68.232.153.233 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709280379; cv=none; b=fDRcopBhw7rBkJfKFvOXNZZz8RHgEyeSDIG0/0MX05iuRhgHXP8nhSaeam4a9c1ylEX1o+ZPPCAr0mCoL0xTk7H5P1FdfKnvOB9oiyefn474tDu06D0qvmooWNjYDcaXLGYkogBuWnLEB7CZmpMD/CpdOb9g0DBZD3jV01JuWMA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709280379; c=relaxed/simple; bh=yI37i87UqneOzVmTClYz+I31zKh2W/A+wihChWmk0Kk=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=ddGvE1SkM8WztxgUmaREEPAj+kGUmY4reYNkLThiTJSSClM1BI6/64iU9/3z0c+sl2WA/PHQ61FqjhQJQblyolf2SYIU3ZUueJh+woecBSMLQ4skrXNsE3T2pjQtTfJmjU0M5rEfPLvpfXTNpauTNb14rX+bZaZKpoaZgSeqJ0o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=microchip.com; spf=pass smtp.mailfrom=microchip.com; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b=mZSWsqbI; arc=none smtp.client-ip=68.232.153.233 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=microchip.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=microchip.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1709280377; x=1740816377; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=yI37i87UqneOzVmTClYz+I31zKh2W/A+wihChWmk0Kk=; b=mZSWsqbI/Upxee9fzIGcrL2jQO5mBjMhO4ItNufEUUXs/7Z6zvLMiPAf 3pZpWg37+MBXeJWB3TFXDfRyZkDqpe60gTGTr3RQ8oXCuKtz+YIdg+ei6 ALdy9qVtaaow9T/G/uT/KGglu/XPx+WR6I43X8xg7fbdrcjGEpjIG7lo1 JAGnyaw72B/u5oj+MoEJq2RFMq6dFq4/XACfDcvBEFhL+3u5/2s2EytC2 j75b3eCMVT7TVlSsmXBChOpmg7/x+qnaUHIOB3dV3MC4y2hULOt2uBuSk RFsbBn8CbDGt9lCIxeCVeLozTqpvxlVE7qsJzDou2pErWaxlt7xrT3tQ3 w==; X-CSE-ConnectionGUID: KhfOYgZRQh2P8hw7PiCldA== X-CSE-MsgGUID: 1AUvhw2rQpqUKBk3Czq4Hg== X-IronPort-AV: E=Sophos;i="6.06,195,1705388400"; d="scan'208";a="18668063" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO email.microchip.com) ([170.129.1.10]) by esa1.microchip.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 01 Mar 2024 01:06:15 -0700 Received: from chn-vm-ex04.mchp-main.com (10.10.85.152) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 1 Mar 2024 01:06:14 -0700 Received: from DEN-DL-M31836.microsemi.net (10.10.85.11) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server id 15.1.2507.35 via Frontend Transport; Fri, 1 Mar 2024 01:06:12 -0700 From: Horatiu Vultur To: , , , , , , , , CC: , , , Horatiu Vultur Subject: [PATCH net] net: sparx5: Fix use after free inside sparx5_del_mact_entry Date: Fri, 1 Mar 2024 09:06:08 +0100 Message-ID: <20240301080608.3053468-1-horatiu.vultur@microchip.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1792310415998392213 X-GMAIL-MSGID: 1792310415998392213 Based on the static analyzis of the code it looks like when an entry from the MAC table was removed, the entry was still used after being freed. More precise the vid of the mac_entry was used after calling devm_kfree on the mac_entry. The fix consists in first using the vid of the mac_entry to delete the entry from the HW and after that to free it. Fixes: b37a1bae742f ("net: sparx5: add mactable support") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman --- drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c index 4af285918ea2a..75868b3f548ec 100644 --- a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c +++ b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c @@ -347,10 +347,10 @@ int sparx5_del_mact_entry(struct sparx5 *sparx5, list) { if ((vid == 0 || mact_entry->vid == vid) && ether_addr_equal(addr, mact_entry->mac)) { + sparx5_mact_forget(sparx5, addr, mact_entry->vid); + list_del(&mact_entry->list); devm_kfree(sparx5->dev, mact_entry); - - sparx5_mact_forget(sparx5, addr, mact_entry->vid); } } mutex_unlock(&sparx5->mact_lock);