Patch "net: rswitch: Avoid use-after-free in rswitch_poll()" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: rswitch: Avoid use-after-free in rswitch_poll()

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-rswitch-avoid-use-after-free-in-rswitch_poll.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 33c47a3e7e22ff343e98fc57b8cad019a3be6729
Author: Radu Rendec <rrendec@xxxxxxxxxx>
Date:   Tue Jul 2 17:08:37 2024 -0400

    net: rswitch: Avoid use-after-free in rswitch_poll()
    
    [ Upstream commit 9a0c28efeec6383ef22e97437616b920e7320b67 ]
    
    The use-after-free is actually in rswitch_tx_free(), which is inlined in
    rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
    same pointer, the skb is first freed using dev_kfree_skb_any(), then the
    value in skb->len is used to update the interface statistics.
    
    Let's move around the instructions to use skb->len before the skb is
    freed.
    
    This bug is trivial to reproduce using KFENCE. It will trigger a splat
    every few packets. A simple ARP request or ICMP echo request is enough.
    
    Fixes: 271e015b9153 ("net: rswitch: Add unmap_addrs instead of dma address in each desc")
    Signed-off-by: Radu Rendec <rrendec@xxxxxxxxxx>
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@xxxxxxxxxxx>
    Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@xxxxxxxxxxxx>
    Link: https://patch.msgid.link/20240702210838.2703228-1-rrendec@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index dcab638c57fe8..24c90d8f5a442 100644
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -871,13 +871,13 @@ static void rswitch_tx_free(struct net_device *ndev)
 		dma_rmb();
 		skb = gq->skbs[gq->dirty];
 		if (skb) {
+			rdev->ndev->stats.tx_packets++;
+			rdev->ndev->stats.tx_bytes += skb->len;
 			dma_unmap_single(ndev->dev.parent,
 					 gq->unmap_addrs[gq->dirty],
 					 skb->len, DMA_TO_DEVICE);
 			dev_kfree_skb_any(gq->skbs[gq->dirty]);
 			gq->skbs[gq->dirty] = NULL;
-			rdev->ndev->stats.tx_packets++;
-			rdev->ndev->stats.tx_bytes += skb->len;
 		}
 		desc->desc.die_dt = DT_EEMPTY;
 	}