kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/ethernet
History
Eugeniu Rosca f9f73c58fe ravb: Fix use-after-free on ifconfig eth0 down 
[ Upstream commit 79514ef670 ]

Commit a47b70ea86 ("ravb: unmap descriptors when freeing rings") has
introduced the issue seen in [1] reproduced on H3ULCB board.

Fix this by relocating the RX skb ringbuffer free operation, so that
swiotlb page unmapping can be done first. Freeing of aligned TX buffers
is not relevant to the issue seen in [1]. Still, reposition TX free
calls as well, to have all kfree() operations performed consistently
_after_ dma_unmap_*()/dma_free_*().

[1] Console screenshot with the problem reproduced:

salvator-x login: root
root@salvator-x:~# ifconfig eth0 up
Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: \
       attached PHY driver [Micrel KSZ9031 Gigabit PHY]   \
       (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=235)
IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
root@salvator-x:~#
root@salvator-x:~# ifconfig eth0 down

==================================================================
BUG: KASAN: use-after-free in swiotlb_tbl_unmap_single+0xc4/0x35c
Write of size 1538 at addr ffff8006d884f780 by task ifconfig/1649

CPU: 0 PID: 1649 Comm: ifconfig Not tainted 4.12.0-rc4-00004-g112eb07287d1 #32
Hardware name: Renesas H3ULCB board based on r8a7795 (DT)
Call trace:
[<ffff20000808f11c>] dump_backtrace+0x0/0x3a4
[<ffff20000808f4d4>] show_stack+0x14/0x1c
[<ffff20000865970c>] dump_stack+0xf8/0x150
[<ffff20000831f8b0>] print_address_description+0x7c/0x330
[<ffff200008320010>] kasan_report+0x2e0/0x2f4
[<ffff20000831eac0>] check_memory_region+0x20/0x14c
[<ffff20000831f054>] memcpy+0x48/0x68
[<ffff20000869ed50>] swiotlb_tbl_unmap_single+0xc4/0x35c
[<ffff20000869fcf4>] unmap_single+0x90/0xa4
[<ffff20000869fd14>] swiotlb_unmap_page+0xc/0x14
[<ffff2000080a2974>] __swiotlb_unmap_page+0xcc/0xe4
[<ffff2000088acdb8>] ravb_ring_free+0x514/0x870
[<ffff2000088b25dc>] ravb_close+0x288/0x36c
[<ffff200008aaf8c4>] __dev_close_many+0x14c/0x174
[<ffff200008aaf9b4>] __dev_close+0xc8/0x144
[<ffff200008ac2100>] __dev_change_flags+0xd8/0x194
[<ffff200008ac221c>] dev_change_flags+0x60/0xb0
[<ffff200008ba2dec>] devinet_ioctl+0x484/0x9d4
[<ffff200008ba7b78>] inet_ioctl+0x190/0x194
[<ffff200008a78c44>] sock_do_ioctl+0x78/0xa8
[<ffff200008a7a128>] sock_ioctl+0x110/0x3c4
[<ffff200008365a70>] vfs_ioctl+0x90/0xa0
[<ffff200008365dbc>] do_vfs_ioctl+0x148/0xc38
[<ffff2000083668f0>] SyS_ioctl+0x44/0x74
[<ffff200008083770>] el0_svc_naked+0x24/0x28

The buggy address belongs to the page:
page:ffff7e001b6213c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffff7e001b6213e0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8006d884f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8006d884f700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8006d884f780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff8006d884f800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8006d884f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Disabling lock debugging due to kernel taint
root@salvator-x:~#

Fixes: a47b70ea86 ("ravb: unmap descriptors when freeing rings")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-07-05 14:40:27 +02:00
..
3com 3c59x: use IS_ENABLED() instead of checking for built-in or module 2016-09-12 20:27:57 -07:00
8390 net: ethernet: ax88796: avoid null pointer dereference 2016-08-01 13:32:51 -07:00
adaptec net: adaptec: starfire: add checks for dma mapping errors 2017-06-17 06:41:53 +02:00
adi net: bfin_mac: Fix a few spelling fixes 2016-08-13 15:14:56 -07:00
aeroflex net: ethernet: greth: use phy_ethtool_{get|set}_link_ksettings 2016-08-08 15:42:21 -07:00
agere net: ethernet: et131x: constify ethtool_ops structures 2016-08-31 09:22:30 -07:00
allwinner net: ethernet: sun4i-emac: use phy_ethtool_{get|set}_link_ksettings 2016-06-22 16:22:41 -04:00
alteon drivers/net: remove all references to obsolete Ethernet-HOWTO 2015-06-23 06:50:35 -07:00
altera net: ethernet: altera: TSE: do not use tx queue lock in tx completion handler 2016-12-02 12:10:25 -05:00
amazon net: ena: change the return type of ena_set_push_mode() to be void. 2016-08-23 17:42:33 -07:00
amd amd-xgbe: Check xgbe_init() return code 2017-07-05 14:40:23 +02:00
apm drivers: net: xgene: fix: Coalescing values for v2 hardware 2016-11-01 12:04:52 -04:00
apple net: macmace: Allow modular build 2015-09-29 21:11:13 -07:00
arc net: arc_emac: don't pass multicast packets to kernel in non-multicast mode 2016-11-15 19:58:13 -05:00
atheros alx: fix error handling in __alx_open 2016-09-15 20:15:26 -04:00
aurora net: ethernet: aurora: nb8800: fix fixed-link phydev leaks 2016-11-29 23:17:02 -05:00
broadcom bnxt_en: Fix "uninitialized variable" bug in TPA code path. 2017-07-05 14:40:21 +02:00
brocade bna: Add synchronization for tx ring. 2016-11-09 13:31:10 -05:00
cadence net: macb: ensure ordering write to re-enable RX smoothly 2016-11-29 20:33:55 -05:00
calxeda ethernet: codespell comment spelling fixes 2015-03-08 22:54:22 -04:00
cavium net: thunderx: acpi: fix LMAC initialization 2017-07-05 14:40:25 +02:00
chelsio cxgb4: notify uP to route ctrlq compl to rdma rspq 2017-06-29 13:00:29 +02:00
cirrus net: ep93xx_eth: Do not crash unloading module 2016-12-05 15:35:39 -05:00
cisco enic: fix rq disable 2016-10-29 17:23:39 -04:00
davicom dm9000: Fix irq trigger type setup on non-dt platforms 2016-08-09 15:08:22 -07:00
dec net: fix up a few missing hashtable.h conflict resolutions 2016-08-13 14:51:02 -07:00
dlink sundance: use IS_ENABLED() instead of checking for built-in or module 2016-09-12 20:27:58 -07:00
emulex be2net: fix MAC addr setting on privileged BE3 VFs 2017-07-05 14:40:27 +02:00
ezchip net: nps_enet: Fix module autoload 2016-10-17 13:03:02 -04:00
faraday net/faraday: Stop NCSI device on shutdown 2016-10-04 02:11:51 -04:00
freescale gianfar: Do not reuse pages from emergency reserve 2017-07-05 14:40:22 +02:00
fujitsu treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
hisilicon net: hns: Fix the device being used for dma mapping during TX 2017-06-17 06:41:50 +02:00
hp treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
i825xx i825xx: use IS_ENABLED() instead of checking for built-in or module 2016-09-12 20:27:58 -07:00
ibm ibmveth: Add a proper check for the availability of the checksum features 2017-07-05 14:40:23 +02:00
intel igb: add i211 to i210 PHY workaround 2017-03-22 12:43:35 +01:00
marvell net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put() 2017-03-15 10:02:42 +08:00
mediatek net-next: ethernet: mediatek: change the compatible string 2017-06-17 06:41:55 +02:00
mellanox net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV 2017-07-05 14:40:27 +02:00
micrel drivers: net: Don't print unpopulated net_device name 2016-05-17 12:30:19 -04:00
microchip kthread: kthread worker API cleanup 2016-10-11 15:06:33 -07:00
moxa treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
myricom myri10ge: fix sleeping with bh disabled 2016-04-28 14:21:14 -04:00
natsemi natsemi: use IS_ENABLED() instead of checking for built-in or module 2016-09-12 20:27:59 -07:00
neterion net: s2io: simplify logical constraint 2016-08-01 13:32:52 -07:00
netronome nfp: bpf: zero extend 4 byte context loads 2016-09-30 02:10:15 -04:00
nuvoton net: ethernet: nuvoton: fix spelling mistake: "aligment" -> "alignment" 2016-08-18 23:29:43 -07:00
nvidia forcedeth: Use setup_timer() 2016-02-25 16:51:05 -05:00
nxp net: lpc_eth: Check clk_prepare_enable() error 2016-08-23 17:10:16 -07:00
oki-semi pch_gbe: replace private tx ring lock with common netif_tx_lock 2016-04-28 17:19:58 -04:00
packetengines treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
pasemi net: ethernet: pasemi_mac: use phy_ethtool_{get|set}_link_ksettings 2016-07-15 16:41:34 -07:00
qlogic net: ethernet: qlogic: set error code on failure 2016-12-05 14:54:18 -05:00
qualcomm net: qcom/emac: fix of_node and phydev leaks 2016-11-27 20:01:15 -05:00
rdc net: r6040: add in missing white space in error message text 2016-09-18 22:22:16 -04:00
realtek r8169: set coherent DMA mask as well as streaming DMA mask 2016-10-15 17:29:38 -04:00
renesas ravb: Fix use-after-free on ifconfig eth0 down 2017-07-05 14:40:27 +02:00
rocker rocker: fix error return code in rocker_world_check_init() 2016-10-26 17:20:36 -04:00
samsung net: ethernet: sxgbe: use phy_ethtool_{get|set}_link_ksettings 2016-06-28 09:12:35 -04:00
seeq treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
sfc sfc: provide dummy definitions of vswitch functions 2017-07-05 14:40:16 +02:00
sgi treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
silan drivers/net: remove all references to obsolete Ethernet-HOWTO 2015-06-23 06:50:35 -07:00
sis sis900: use IS_ENABLED() instead of checking for built-in or module 2016-09-12 20:27:59 -07:00
smsc net: smsc911x: back out silently on probe deferrals 2016-12-09 23:05:16 -05:00
stmicro stmmac: add missing of_node_put 2017-07-05 14:40:20 +02:00
sun sunbmac: Fix compiler warning 2016-11-18 11:18:27 -08:00
synopsys net: ethernet: dwc_eth_qos: fix fixed-link phydev leaks 2016-11-29 23:17:02 -05:00
tehuti net: tehuti: fix typo: "eneble" -> "enable" 2016-08-21 15:21:36 -07:00
ti cpmac: remove hopeless #warning 2017-03-18 19:14:29 +08:00
tile timers, driver/net/ethernet/tile: Initialize the egress timer as pinned 2016-07-07 10:25:14 +02:00
toshiba ps3_gelic: fix spelling mistake in debug message 2016-11-14 13:38:57 -05:00
tundra net/ethernet: tundra: fix dump_eth_one warning in tsi108_eth 2016-08-08 13:08:21 -07:00
via via-velocity: remove null pointer check on array tdinfo->skb_dma 2016-09-09 18:17:33 -07:00
wiznet treewide: remove redundant #include <linux/kconfig.h> 2016-10-11 15:06:33 -07:00
xilinx net: xilinx_emaclite: fix receive buffer overflow 2017-06-17 06:41:49 +02:00
xircom ethernet: xircom: fix spelling mistakes on "excessive collisions" 2016-06-27 04:19:14 -04:00
xscale net: ethernet: ixp4xx_eth: fix spelling mistake in debug message 2016-11-13 13:48:28 -05:00
dnet.c net: ethernet: dnet: use phy_ethtool_{get|set}_link_ksettings 2016-06-28 05:10:26 -04:00
dnet.h net: ethernet: dnet: use phydev from struct net_device 2016-06-28 05:10:26 -04:00
ec_bhf.c net: ec_bhf: Use module_pci_driver 2015-07-08 16:04:06 -07:00
ethoc.c net: ethoc: enable NAPI before poll may be scheduled 2017-06-14 15:05:52 +02:00
fealnx.c treewide: replace dev->trans_start update with helper 2016-05-04 14:16:49 -04:00
jme.c drivers/net/ethernet/jme.c: Deinline jme_reset_mac_processor, save 2816 bytes 2016-04-13 22:57:00 -04:00
jme.h jme: Remove unused #define PFX 2013-11-07 02:14:32 -05:00
Kconfig net: ena: Add a driver for Amazon Elastic Network Adapters (ENA) 2016-08-12 17:12:08 -07:00
korina.c net: korina: Fix NAPI versus resources freeing 2017-07-05 14:40:21 +02:00
lantiq_etop.c net: ethernet: lantiq_etop: Call SET_NETDEV_DEV() 2016-12-08 21:26:58 -05:00
Makefile net: ena: Add a driver for Amazon Elastic Network Adapters (ENA) 2016-08-12 17:12:08 -07:00
netx-eth.c drivers: net: Don't print unpopulated net_device name 2016-05-17 12:30:19 -04:00