Re: [PATCH] net: bnxt: fix a potential use-after-free in bnxt_init_tc

[Pavan Chebbi]

On Mon, Dec 4, 2023 at 8:11 AM Dinghao Liu <dinghao.liu@xxxxxxxxxx> wrote:
>
> When flow_indr_dev_register() fails, bnxt_init_tc will free
> bp->tc_info through kfree(). However, the caller function
> bnxt_init_one() will ignore this failure and call
> bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
> a use-after-free happens. Fix this issue by setting
> bp->tc_info to NULL after kfree().
>
> Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
> Signed-off-by: Dinghao Liu <dinghao.liu@xxxxxxxxxx>
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> index 38d89d80b4a9..273c9ba48f09 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
> @@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)
>         rhashtable_destroy(&tc_info->flow_table);
>  free_tc_info:
>         kfree(tc_info);
> +       bp->tc_info = NULL;
>         return rc;
>  }

The other way could have been to assign bp->tc_info only after
flow_indr_dev_register succeeds.
But this one works too. Thanks.
Reviewed-by: Pavan Chebbi <pavan.chebbi@xxxxxxxxxxxx>

>
> --
> 2.17.1
>
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature