target/linux/generic/backport-5.15/702-v5.19-14-net-ethernet-mtk_eth_soc-use-after-free-in-__mtk_ppe.patch

   1 From: Dan Carpenter <dan.carpenter@oracle.com>
   2 Date: Tue, 12 Apr 2022 12:24:19 +0300
   3 Subject: [PATCH] net: ethernet: mtk_eth_soc: use after free in
   4  __mtk_ppe_check_skb()
   5
   6 The __mtk_foe_entry_clear() function frees "entry" so we have to use
   7 the _safe() version of hlist_for_each_entry() to prevent a use after
   8 free.
   9
  10 Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
  11 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  12 Signed-off-by: David S. Miller <davem@davemloft.net>
  13 ---
  14
  15 --- a/drivers/net/ethernet/mediatek/mtk_ppe.c
  16 +++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
  17 @@ -600,6 +600,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe
  18         struct mtk_foe_entry *hwe = &ppe->foe_table[hash];
  19         struct mtk_flow_entry *entry;
  20         struct mtk_foe_bridge key = {};
  21 +       struct hlist_node *n;
  22         struct ethhdr *eh;
  23         bool found = false;
  24         u8 *tag;
  25 @@ -609,7 +610,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe
  26         if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND)
  27                 goto out;
  28
  29 -       hlist_for_each_entry(entry, head, list) {
  30 +       hlist_for_each_entry_safe(entry, n, head, list) {
  31                 if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) {
  32                         if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) ==
  33                                      MTK_FOE_STATE_BIND))