diff options
| author |   Saeed Mahameed <saeedm@nvidia.com> | 2022-03-11 16:53:53 -0800 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2022-03-14 15:04:39 -0700 |
| commit | 8772cc499bff844cf00d1b0b4428633d77c60a0d (patch) | |
| tree | 4acacb0b1d781390f5e03e885220db1729518b95 /drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | |
| parent | net/mlx4_en: use kzalloc (diff) | |
| download | linux-dev-8772cc499bff844cf00d1b0b4428633d77c60a0d.tar.xz linux-dev-8772cc499bff844cf00d1b0b4428633d77c60a0d.zip | |
net/mlx5e: Fix use-after-free in mlx5e_stats_grp_sw_update_stats
We need to sync page pool stats only for active channels. Reading ethtool
stats on a down netdev or a netdev with modified number of channels will
result in a user-after-free, trying to access page pools that are freed
already.
BUG: KASAN: use-after-free in mlx5e_stats_grp_sw_update_stats+0x465/0xf80
Read of size 8 at addr ffff888004835e40 by task ethtool/720
Fixes: cc10e84b2ec3 ("mlx5: add support for page_pool_get_stats")
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Reported-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Joe Damato <jdamato@fastly.com>
Link: https://lore.kernel.org/r/20220312005353.786255-1-saeed@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/mellanox/mlx5/core/en_stats.c')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c index 336e4d04c5f2..bdc870f9c2f3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c @@ -521,14 +521,15 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(sw) memset(s, 0, sizeof(*s)); + for (i = 0; i < priv->channels.num; i++) /* for active channels only */ + mlx5e_stats_update_stats_rq_page_pool(priv->channels.c[i]); + for (i = 0; i < priv->stats_nch; i++) { struct mlx5e_channel_stats *channel_stats = priv->channel_stats[i]; int j; - mlx5e_stats_update_stats_rq_page_pool(priv->channels.c[i]); - mlx5e_stats_grp_sw_update_stats_rq_stats(s, &channel_stats->rq); mlx5e_stats_grp_sw_update_stats_xdpsq(s, &channel_stats->rq_xdpsq); mlx5e_stats_grp_sw_update_stats_ch_stats(s, &channel_stats->ch); |