net: hns3: fix for use-after-free when setting ring parameter (ec777890) · Commits · 戴 / test

In hns3_set_ringparam, hns3_uninit_all_ring frees the memory pointed by priv->ring_data[i].ring, and hns3_change_all_ring_bd_num use that pointer without mallocing, which will cause a use-after-free problem. The patch fixes it by not freeing the memory in hns3_uninit_all_ring, and uses hns3_put_ring_config to free it when necessary. Signed-off-by:

Yunsheng Lin <linyunsheng@huawei.com> Signed-off-by:

Peng Li <lipeng321@huawei.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -2967,13 +2967,8 @@ int hns3_uninit_all_ring(struct hns3_nic_priv *priv)
		h->ae_algo->ops->reset_queue(h, i);

		hns3_fini_ring(priv->ring_data[i].ring);
		devm_kfree(priv->dev, priv->ring_data[i].ring);
		hns3_fini_ring(priv->ring_data[i + h->kinfo.num_tqps].ring);
		devm_kfree(priv->dev,
		priv->ring_data[i + h->kinfo.num_tqps].ring);
		}
		devm_kfree(priv->dev, priv->ring_data);

		return 0;
		}

		@@ -3111,6 +3106,8 @@ static void hns3_client_uninit(struct hnae3_handle *handle, bool reset)
		if (ret)
		netdev_err(netdev, "uninit ring error\n");

		hns3_put_ring_config(priv);

		priv->ring_data = NULL;

		free_netdev(netdev);
		@@ -3316,6 +3313,8 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle)
		if (ret)
		netdev_err(netdev, "uninit ring error\n");

		hns3_put_ring_config(priv);

		priv->ring_data = NULL;

		return ret;
		@@ -3422,6 +3421,7 @@ int hns3_set_channels(struct net_device *netdev,
		}

		hns3_uninit_all_ring(priv);
		hns3_put_ring_config(priv);

		org_tqp_num = h->kinfo.num_tqps;
		ret = hns3_modify_tqp_num(netdev, new_tqp_num);

Admin message