Patch "sfc: Fix use-after-free due to selftest_work" has been added to the 6.2-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    sfc: Fix use-after-free due to selftest_work

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sfc-fix-use-after-free-due-to-selftest_work.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 19540a6ef1f02c4dce73c44da42c1fce8db551d8
Author: Ding Hui <dinghui@xxxxxxxxxxxxxx>
Date:   Fri Apr 14 23:23:06 2023 +0800

    sfc: Fix use-after-free due to selftest_work
    
    [ Upstream commit a80bb8e7233b2ad6ff119646b6e33fb3edcec37b ]
    
    There is a use-after-free scenario that is:
    
    When the NIC is down, user set mac address or vlan tag to VF,
    the xxx_set_vf_mac() or xxx_set_vf_vlan() will invoke efx_net_stop()
    and efx_net_open(), since netif_running() is false, the port will not
    start and keep port_enabled false, but selftest_work is scheduled
    in efx_net_open().
    
    If we remove the device before selftest_work run, the efx_stop_port()
    will not be called since the NIC is down, and then efx is freed,
    we will soon get a UAF in run_timer_softirq() like this:
    
    [ 1178.907941] ==================================================================
    [ 1178.907948] BUG: KASAN: use-after-free in run_timer_softirq+0xdea/0xe90
    [ 1178.907950] Write of size 8 at addr ff11001f449cdc80 by task swapper/47/0
    [ 1178.907950]
    [ 1178.907953] CPU: 47 PID: 0 Comm: swapper/47 Kdump: loaded Tainted: G           O     --------- -t - 4.18.0 #1
    [ 1178.907954] Hardware name: SANGFOR X620G40/WI2HG-208T1061A, BIOS SPYH051032-U01 04/01/2022
    [ 1178.907955] Call Trace:
    [ 1178.907956]  <IRQ>
    [ 1178.907960]  dump_stack+0x71/0xab
    [ 1178.907963]  print_address_description+0x6b/0x290
    [ 1178.907965]  ? run_timer_softirq+0xdea/0xe90
    [ 1178.907967]  kasan_report+0x14a/0x2b0
    [ 1178.907968]  run_timer_softirq+0xdea/0xe90
    [ 1178.907971]  ? init_timer_key+0x170/0x170
    [ 1178.907973]  ? hrtimer_cancel+0x20/0x20
    [ 1178.907976]  ? sched_clock+0x5/0x10
    [ 1178.907978]  ? sched_clock_cpu+0x18/0x170
    [ 1178.907981]  __do_softirq+0x1c8/0x5fa
    [ 1178.907985]  irq_exit+0x213/0x240
    [ 1178.907987]  smp_apic_timer_interrupt+0xd0/0x330
    [ 1178.907989]  apic_timer_interrupt+0xf/0x20
    [ 1178.907990]  </IRQ>
    [ 1178.907991] RIP: 0010:mwait_idle+0xae/0x370
    
    If the NIC is not actually brought up, there is no need to schedule
    selftest_work, so let's move invoking efx_selftest_async_start()
    into efx_start_all(), and it will be canceled by broughting down.
    
    Fixes: dd40781e3a4e ("sfc: Run event/IRQ self-test asynchronously when interface is brought up")
    Fixes: e340be923012 ("sfc: add ndo_set_vf_mac() function for EF10")
    Debugged-by: Huang Cun <huangcun@xxxxxxxxxxxxxx>
    Cc: Donglin Peng <pengdonglin@xxxxxxxxxxxxxx>
    Suggested-by: Martin Habets <habetsm.xilinx@xxxxxxxxx>
    Signed-off-by: Ding Hui <dinghui@xxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 6a1bff54bc6c3..e6aedd8ebd750 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -541,7 +541,6 @@ int efx_net_open(struct net_device *net_dev)
 	else
 		efx->state = STATE_NET_UP;
 
-	efx_selftest_async_start(efx);
 	return 0;
 }
 
diff --git a/drivers/net/ethernet/sfc/efx_common.c b/drivers/net/ethernet/sfc/efx_common.c
index cc30524c2fe45..361687de308dc 100644
--- a/drivers/net/ethernet/sfc/efx_common.c
+++ b/drivers/net/ethernet/sfc/efx_common.c
@@ -544,6 +544,8 @@ void efx_start_all(struct efx_nic *efx)
 	/* Start the hardware monitor if there is one */
 	efx_start_monitor(efx);
 
+	efx_selftest_async_start(efx);
+
 	/* Link state detection is normally event-driven; we have
 	 * to poll now because we could have missed a change
 	 */



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux