Commit 6c868e0f authored by Wang Hai's avatar Wang Hai Committed by Zicheng Qu
Browse files

e100: Fix possible use after free in e100_xmit_prepare 

stable inclusion
from stable-v5.10.158
commit b775f37d943966f6f77dca402f5a9dedce502c25
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b775f37d943966f6f77dca402f5a9dedce502c25



--------------------------------

[ Upstream commit 45605c75 ]

In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so
e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will
resend the skb. But the skb is already freed, which will cause UAF bug
when the upper layer resends the skb.

Remove the harmful free.

Fixes: 5e5d4942 ("e100: Release skb when DMA mapping is failed in e100_xmit_prepare")
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Reviewed-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
	drivers/net/ethernet/intel/e100.c
[The purpose of the if condition is the same in both cases. In openeuler,
it is `if (pci_dma_mapping_error(nic->pdev, dma_addr))`, and in version
5.10,  it is `if (dma_mapping_error(&nic->pdev->dev, dma_addr))`. Both
are  intended to "map the skb, allowing the upper layer to try later."
Therefore, retain the original `if` condition from openeuler, and
remove the code that frees the skb, aligning with the patch's purpose.]
Signed-off-by: default avatarZicheng Qu <quzicheng@huawei.com>
parent 13325974

drivers/net/ethernet/intel/e100.c

+1 −4
Original line number Diff line number Diff line
@@ -1742,11 +1742,8 @@ static int e100_xmit_prepare(struct nic *nic, struct cb *cb, 
	dma_addr = pci_map_single(nic->pdev,

				  skb->data, skb->len, PCI_DMA_TODEVICE);

	/* If we can't map the skb, have the upper layer try later */

	if (pci_dma_mapping_error(nic->pdev, dma_addr)) {

		dev_kfree_skb_any(skb);

		skb = NULL;

	if (pci_dma_mapping_error(nic->pdev, dma_addr))

		return -ENOMEM;

	}



	/*

	 * Use the last 4 bytes of the SKB payload packet as the CRC, used for