Re: [PATCH net] macsec: avoid use-after-free in macsec_handle_frame()

2020-10-08 Thread patchwork-bot+netdevbpf
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Wed, 7 Oct 2020 01:42:46 -0700 you wrote: > From: Eric Dumazet > > De-referencing skb after call to gro_cells_receive() is not allowed. > We need to fetch skb->len earlier. > > Fixes: 5491e7c6b1a9 ("macsec: enable GRO and

Re: [PATCH net] macsec: avoid use-after-free in macsec_handle_frame()

2020-10-07 Thread Eric Dumazet
On 10/7/20 4:45 PM, Paolo Abeni wrote: > Ah! I completely missed that code path in gro_cells_receive()! > Thank you for pointing that out! > > Acked-by: Paolo Abeni > No problems, thanks for reviewing !

Re: [PATCH net] macsec: avoid use-after-free in macsec_handle_frame()

2020-10-07 Thread Paolo Abeni
On Wed, 2020-10-07 at 16:31 +0200, Eric Dumazet wrote: > On Wed, Oct 7, 2020 at 4:09 PM Paolo Abeni wrote: > > Hi, > > > > On Wed, 2020-10-07 at 01:42 -0700, Eric Dumazet wrote: > > > @@ -1232,9 +1233,10 @@ static rx_handler_result_t > > > macsec_handle_frame(struct sk_buff **pskb) > > > m

Re: [PATCH net] macsec: avoid use-after-free in macsec_handle_frame()

2020-10-07 Thread Paolo Abeni
Hi, On Wed, 2020-10-07 at 01:42 -0700, Eric Dumazet wrote: > @@ -1232,9 +1233,10 @@ static rx_handler_result_t macsec_handle_frame(struct > sk_buff **pskb) > macsec_rxsc_put(rx_sc); > > skb_orphan(skb); > + len = skb->len; > ret = gro_cells_receive(&macsec->gro_cells, skb)