[PATCH net-next] net: ethernet: mtk_eth_soc: use after free in __mtk_ppe_check_skb()

The __mtk_foe_entry_clear() function frees "entry" so we have to use
the _safe() version of hlist_for_each_entry() to prevent a use after
free.

Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
Signed-off-by: Dan Carpenter <redacted>
---
 drivers/net/ethernet/mediatek/mtk_ppe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c
index 282a1f34a88a..683f89f8e3b2 100644
--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
+++ b/drivers/net/ethernet/mediatek/mtk_ppe.c

@@ -600,6 +600,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
 	struct mtk_foe_entry *hwe = &ppe->foe_table[hash];
 	struct mtk_flow_entry *entry;
 	struct mtk_foe_bridge key = {};
+	struct hlist_node *n;
 	struct ethhdr *eh;
 	bool found = false;
 	u8 *tag;

@@ -609,7 +610,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
 	if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND)
 		goto out;
 
-	hlist_for_each_entry(entry, head, list) {
+	hlist_for_each_entry_safe(entry, n, head, list) {
 		if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) {
 			if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) ==
 				     MTK_FOE_STATE_BIND))

-- 
2.20.1

Hello:

This patch was applied to netdev/net-next.git (master)
by David S. Miller [off-list ref]:

On Tue, 12 Apr 2022 12:24:19 +0300 you wrote:

The __mtk_foe_entry_clear() function frees "entry" so we have to use
the _safe() version of hlist_for_each_entry() to prevent a use after
free.

Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
Signed-off-by: Dan Carpenter <redacted>

[...]

Here is the summary with links:
  - [net-next] net: ethernet: mtk_eth_soc: use after free in __mtk_ppe_check_skb()
    https://git.kernel.org/netdev/net-next/c/17a5f6a78dc7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html