https://github.com/torvalds/linux
Revision c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 authored by Jakub Kicinski on 21 September 2022, 20:10:05 UTC, committed by Jakub Kicinski on 22 September 2022, 14:33:17 UTC
When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.

Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.

Fixes: 83bb623c968e ("bnxt_en: Transmit and retrieve packet timestamps")
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20220921201005.335390-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 3aac7ad
History
Tip revision: c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 authored by Jakub Kicinski on 21 September 2022, 20:10:05 UTC
bnxt: prevent skb UAF after handing over to PTP worker
Tip revision: c31f26c
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
io_uring
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 19.9 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 151 bytes
.gitattributes -rw-r--r-- 62 bytes
.gitignore -rw-r--r-- 1.9 KB
.mailmap -rw-r--r-- 23.7 KB
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 99.1 KB
Kbuild -rw-r--r-- 1.3 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 664.3 KB
Makefile -rw-r--r-- 64.5 KB
README -rw-r--r-- 727 bytes

README

back to top