Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e8cfd6d authored by Toshiaki Makita's avatar Toshiaki Makita Committed by David S. Miller
Browse files

tun: Fix use-after-free on XDP_TX 



On XDP_TX we need to free up the frame only when tun_xdp_tx() returns a
negative value. A positive value indicates that the packet is
successfully enqueued to the ptr_ring, so freeing the page causes
use-after-free.

Fixes: 735fc405 ("xdp: change ndo_xdp_xmit API to support bulking")
Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9f80a072

drivers/net/tun.c

+1 −1
Original line number Diff line number Diff line
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, 
		case XDP_TX:

			get_page(alloc_frag->page);

			alloc_frag->offset += buflen;

			if (tun_xdp_tx(tun->dev, &xdp))

			if (tun_xdp_tx(tun->dev, &xdp) < 0)

				goto err_redirect;

			rcu_read_unlock();

			local_bh_enable();