From patchwork Mon Mar 6 16:53:04 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Ahern X-Patchwork-Id: 735881 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vcSFG6QdHz9s8W for ; Tue, 7 Mar 2017 04:58:10 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="GOiT8/58"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932156AbdCFR6D (ORCPT ); Mon, 6 Mar 2017 12:58:03 -0500 Received: from mail-pf0-f178.google.com ([209.85.192.178]:33249 "EHLO mail-pf0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932114AbdCFR6A (ORCPT ); Mon, 6 Mar 2017 12:58:00 -0500 Received: by mail-pf0-f178.google.com with SMTP id w189so63275606pfb.0 for ; Mon, 06 Mar 2017 09:57:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id; bh=MfhiwR9Cx3krahqyJNTu+vp8tUdA7Cpdg6XS96rJ+Os=; b=GOiT8/58BHGzv1Ii3mgIATJuWWfqyumd6MzvezJxxfMmgloqTId54otwVa+GEL7m/R Lka8odSNqLSlCms/RCTGg89AI31nCsyPJ7sWNLXPRd8h9cTrFthKzBgaRE2FA4ygSmpB egArqVSOpl5f1svwTCn8lxxeJdoA3LvK2/HNk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=MfhiwR9Cx3krahqyJNTu+vp8tUdA7Cpdg6XS96rJ+Os=; b=amsq50SLOkr2xE+KHt4JyYEoRYxJW51tBhWEM0yZ009EO0FfB5GAMWV8XEYeVsMbZa 3wrmZUn4Avhgu0fw8OkbmOTDAqHSx2LrrEbs3QbzriZ3GobJPOcNT4p0VH8T3rvwYOwg Ms9ophBdYGDYswsbS7Yl8J137fXLbvQZor8jJV1j2/4JbRK1HnPbG17EcHK4mkviTBan Gh6e6UeQZabSM5jbM+8waPKsZFdZdw0qmzvhf5BU1VK9WHOKWCw6cKXOMt+F86sioNVl DD0rqri1kfc4gIU6Chseykz5OqJlRszFH+id8F04IjBITRcgBOWPg7HF1AuVZu6Lh0oL Ebrw== X-Gm-Message-State: AMke39l9gpLlCKGraHhGKLDIgzO9FS82uj7KI/iYxlZUbEQZnsa0Tj1nKUDMQfocl0EWvL57 X-Received: by 10.98.11.144 with SMTP id 16mr22503741pfl.78.1488819190101; Mon, 06 Mar 2017 08:53:10 -0800 (PST) Received: from kenny.it.cumulusnetworks.com. ([216.129.126.126]) by smtp.googlemail.com with ESMTPSA id t6sm40966383pgt.8.2017.03.06.08.53.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 06 Mar 2017 08:53:09 -0800 (PST) From: David Ahern To: netdev@vger.kernel.org Cc: David Ahern Subject: [PATCH] vrf: Fix use-after-free in vrf_xmit Date: Mon, 6 Mar 2017 08:53:04 -0800 Message-Id: <1488819184-12641-1-git-send-email-dsa@cumulusnetworks.com> X-Mailer: git-send-email 2.1.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org KASAN detected a use-after-free: [ 269.467067] BUG: KASAN: use-after-free in vrf_xmit+0x7f1/0x827 [vrf] at addr ffff8800350a21c0 [ 269.467067] Read of size 4 by task ssh/1879 [ 269.467067] CPU: 1 PID: 1879 Comm: ssh Not tainted 4.10.0+ #249 [ 269.467067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 269.467067] Call Trace: [ 269.467067] dump_stack+0x81/0xb6 [ 269.467067] kasan_object_err+0x21/0x78 [ 269.467067] kasan_report+0x2f7/0x450 [ 269.467067] ? vrf_xmit+0x7f1/0x827 [vrf] [ 269.467067] ? ip_output+0xa4/0xdb [ 269.467067] __asan_load4+0x6b/0x6d [ 269.467067] vrf_xmit+0x7f1/0x827 [vrf] ... Which corresponds to the skb access after xmit handling. Fix by saving skb->len and using the saved value to update stats. Fixes: 193125dbd8eb2 ("net: Introduce VRF device driver") Signed-off-by: David Ahern --- drivers/net/vrf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index 22379da63400..fea687f35b5a 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -340,6 +340,7 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev) static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) { + int len = skb->len; netdev_tx_t ret = is_ip_tx_frame(skb, dev); if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) { @@ -347,7 +348,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) u64_stats_update_begin(&dstats->syncp); dstats->tx_pkts++; - dstats->tx_bytes += skb->len; + dstats->tx_bytes += len; u64_stats_update_end(&dstats->syncp); } else { this_cpu_inc(dev->dstats->tx_drps);