Re: [PATCH net] mac802154: tx: fix use-after-free

[Stefan Schmidt]

Hello Eric.

On 08.09.20 12:40, Eric Dumazet wrote:

syzbot reported a bug in ieee802154_tx() [1]

A similar issue in ieee802154_xmit_worker() is also fixed in this patch.

[ snip]

Fixes: 409c3b0c5f03 ("mac802154: tx: move stats tx increment")
Signed-off-by: Eric Dumazet <eduma...@google.com>
Reported-by: syzbot <syzkal...@googlegroups.com>
Cc: Alexander Aring <alex.ar...@gmail.com>
Cc: Stefan Schmidt <ste...@datenfreihafen.org>
Cc: linux-w...@vger.kernel.org
---
  net/mac802154/tx.c | 8 +++++---
  1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index 
ab52811523e992f33f0855cdb711a2752b602e15..c829e4a7532564d401c0d2d1f90f56c2fe030b2c
 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -34,11 +34,11 @@ void ieee802154_xmit_worker(struct work_struct *work)
        if (res)
                goto err_tx;

- ieee802154_xmit_complete(&local->hw, skb, false);

-
        dev->stats.tx_packets++;
        dev->stats.tx_bytes += skb->len;

+ ieee802154_xmit_complete(&local->hw, skb, false);

+
        return;

err_tx:

@@ -78,6 +78,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff 
*skb)

/* async is priority, otherwise sync is fallback */

        if (local->ops->xmit_async) {
+               unsigned int len = skb->len;
+
                ret = drv_xmit_async(local, skb);
                if (ret) {
                        ieee802154_wake_queue(&local->hw);
@@ -85,7 +87,7 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff 
*skb)
                }

dev->stats.tx_packets++;

-               dev->stats.tx_bytes += skb->len;
+               dev->stats.tx_bytes += len;
        } else {
                local->tx_skb = skb;
                queue_work(local->workqueue, &local->tx_work);

Thanks for catching this!

This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt