[PATCH net-next 14/23] {topost} net: hns3: fix for use-after-free when setting ring parameter

[Peng Li]

From: Yunsheng Lin <linyunsh...@huawei.com>

In hns3_set_ringparam, hns3_uninit_all_ring frees the
memory pointed by priv->ring_data[i].ring, and
hns3_change_all_ring_bd_num use that pointer without mallocing,
which will cause a use-after-free problem.

The patch fixes it by not freeing the memory in
hns3_uninit_all_ring, and uses hns3_put_ring_config to free it
when necessary.

Signed-off-by: Yunsheng Lin <linyunsh...@huawei.com>
Signed-off-by: Peng Li <lipeng...@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 
b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index f50245d..2bed73e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2955,13 +2955,8 @@ int hns3_uninit_all_ring(struct hns3_nic_priv *priv)
                        h->ae_algo->ops->reset_queue(h, i);
 
                hns3_fini_ring(priv->ring_data[i].ring);
-               devm_kfree(priv->dev, priv->ring_data[i].ring);
                hns3_fini_ring(priv->ring_data[i + h->kinfo.num_tqps].ring);
-               devm_kfree(priv->dev,
-                          priv->ring_data[i + h->kinfo.num_tqps].ring);
        }
-       devm_kfree(priv->dev, priv->ring_data);
-
        return 0;
 }
 
@@ -3099,6 +3094,8 @@ static void hns3_client_uninit(struct hnae3_handle 
*handle, bool reset)
        if (ret)
                netdev_err(netdev, "uninit ring error\n");
 
+       hns3_put_ring_config(priv);
+
        priv->ring_data = NULL;
 
        free_netdev(netdev);
@@ -3304,6 +3301,8 @@ static int hns3_reset_notify_uninit_enet(struct 
hnae3_handle *handle)
        if (ret)
                netdev_err(netdev, "uninit ring error\n");
 
+       hns3_put_ring_config(priv);
+
        priv->ring_data = NULL;
 
        return ret;
@@ -3421,6 +3420,7 @@ int hns3_set_channels(struct net_device *netdev,
        }
 
        hns3_uninit_all_ring(priv);
+       hns3_put_ring_config(priv);
 
        org_tqp_num = h->kinfo.num_tqps;
        ret = hns3_modify_tqp_num(netdev, new_tqp_num);
-- 
2.9.3