Commit 17a5f6a7 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

net: ethernet: mtk_eth_soc: use after free in __mtk_ppe_check_skb() 



The __mtk_foe_entry_clear() function frees "entry" so we have to use
the _safe() version of hlist_for_each_entry() to prevent a use after
free.

Fixes: 33fc42de ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2240514c

drivers/net/ethernet/mediatek/mtk_ppe.c

+2 −1
Original line number Diff line number Diff line
@@ -600,6 +600,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) 
	struct mtk_foe_entry *hwe = &ppe->foe_table[hash];

	struct mtk_flow_entry *entry;

	struct mtk_foe_bridge key = {};

	struct hlist_node *n;

	struct ethhdr *eh;

	bool found = false;

	u8 *tag;
@@ -609,7 +610,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) 
	if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND)

		goto out;



	hlist_for_each_entry(entry, head, list) {

	hlist_for_each_entry_safe(entry, n, head, list) {

		if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) {

			if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) ==

				     MTK_FOE_STATE_BIND))