Jialiang Wang 9d933af8fe nfp: fix use-after-free in area_cache_get() ... commit 02e1a114fd upstream. area_cache_get() is used to distribute cache->area and set cache->id, and if cache->id is not 0 and cache->area->kref refcount is 0, it will release the cache->area by nfp_cpp_area_release(). area_cache_get() set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire(). But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is is already set but the refcount is not increased as expected. At this time, calling the nfp_cpp_area_release() will cause use-after-free. To avoid the use-after-free, set cache->id after area_init() and nfp_cpp_area_acquire() complete successfully. Note: This vulnerability is triggerable by providing emulated device equipped with specified configuration. BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1 Call Trace: <TASK> nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884) Allocated by task 1: nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303) nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802) nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230) nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215) nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744) Freed by task 1: kfree (mm/slub.c:4562) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873) nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973) nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48) Signed-off-by: Jialiang Wang <wangjialiang0806@163.com> Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com> Acked-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-12-19 12:36:39 +01:00
..
abm	…
bpf	…
crypto	…
flower	…
nfpcore	nfp: fix use-after-free in area_cache_get()	2022-12-19 12:36:39 +01:00
nic	…
Makefile	…
ccm.c	…
ccm.h	…
ccm_mbox.c	…
devlink_param.c	…
nfp_abi.h	…
nfp_app.c	…
nfp_app.h	…
nfp_app_nic.c	…
nfp_asm.c	…
nfp_asm.h	…
nfp_devlink.c	…
nfp_hwmon.c	…
nfp_main.c	…
nfp_main.h	…
nfp_net.h	…
nfp_net_common.c	…
nfp_net_ctrl.c	…
nfp_net_ctrl.h	…
nfp_net_debugdump.c	…
nfp_net_debugfs.c	…
nfp_net_ethtool.c	nfp: add port from netdev validation for EEPROM access	2022-12-02 17:41:05 +01:00
nfp_net_main.c	…
nfp_net_repr.c	…
nfp_net_repr.h	…
nfp_net_sriov.c	…
nfp_net_sriov.h	…
nfp_netvf_main.c	…
nfp_port.c	…
nfp_port.h	…
nfp_shared_buf.c	…