| Message ID | 5a9c53a4-5487-4b8c-9ffa-d8e5343aaaaf@stanley.mountain (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net: Prevent use after free in netif_napi_set_irq_locked() | expand |
On 2025-03-03 5:02 a.m., Dan Carpenter wrote: > The cpu_rmap_put() will call kfree() when the last reference is dropped > so it could result in a use after free when we dereference the same > pointer the next line. Move the cpu_rmap_put() after the dereference. The last call to cpu_rmap_put() that frees the rmap will always be in netif_del_cpu_rmap(). This matches the ref counter initially set in netif_enable_cpu_rmap(). > > Fixes: bd7c00605ee0 ("net: move aRFS rmap management and CPU affinity to core") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > net/core/dev.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/core/dev.c b/net/core/dev.c > index 9189c4a048d7..c102349e04ee 100644 > --- a/net/core/dev.c > +++ b/net/core/dev.c > @@ -7072,8 +7072,8 @@ void netif_napi_set_irq_locked(struct napi_struct *napi, int irq) > put_rmap: > #ifdef CONFIG_RFS_ACCEL > if (napi->dev->rx_cpu_rmap_auto) { > - cpu_rmap_put(napi->dev->rx_cpu_rmap); > napi->dev->rx_cpu_rmap->obj[napi->napi_rmap_idx] = NULL; > + cpu_rmap_put(napi->dev->rx_cpu_rmap); > napi->napi_rmap_idx = -1; > } > #endif
diff --git a/net/core/dev.c b/net/core/dev.c index 9189c4a048d7..c102349e04ee 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -7072,8 +7072,8 @@ void netif_napi_set_irq_locked(struct napi_struct *napi, int irq) put_rmap: #ifdef CONFIG_RFS_ACCEL if (napi->dev->rx_cpu_rmap_auto) { - cpu_rmap_put(napi->dev->rx_cpu_rmap); napi->dev->rx_cpu_rmap->obj[napi->napi_rmap_idx] = NULL; + cpu_rmap_put(napi->dev->rx_cpu_rmap); napi->napi_rmap_idx = -1; } #endif
The cpu_rmap_put() will call kfree() when the last reference is dropped so it could result in a use after free when we dereference the same pointer the next line. Move the cpu_rmap_put() after the dereference. Fixes: bd7c00605ee0 ("net: move aRFS rmap management and CPU affinity to core") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)