linux/drivers/net/ethernet/broadcom/bnxt
Jakub Kicinski c31f26c8f6 bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.

Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.

Fixes: 83bb623c96 ("bnxt_en: Transmit and retrieve packet timestamps")
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20220921201005.335390-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-09-22 07:33:17 -07:00
..
Makefile bnxt_en: move coredump functions into dedicated file 2021-10-29 12:13:05 +01:00
bnxt.c bnxt: prevent skb UAF after handing over to PTP worker 2022-09-22 07:33:17 -07:00
bnxt.h bnxt_en: Use PAGE_SIZE to init buffer when multi buffer XDP is not in use 2022-08-23 15:32:07 -07:00
bnxt_coredump.c bnxt_en: use firmware provided max timeout for messages 2022-01-09 16:27:23 -08:00
bnxt_coredump.h bnxt_en: move coredump functions into dedicated file 2021-10-29 12:13:05 +01:00
bnxt_dcb.c bnxt_en: Properly report no pause support on some cards 2022-03-05 11:16:56 +00:00
bnxt_dcb.h bnxt_en: Use struct_group_attr() for memcpy() region 2021-09-25 08:20:48 -07:00
bnxt_debugfs.c
bnxt_debugfs.h
bnxt_devlink.c bnxt_en: set missing reload flag in devlink features 2022-08-23 15:32:13 -07:00
bnxt_devlink.h bnxt: revert hastily merged uAPI aberrations 2022-03-09 19:55:00 -08:00
bnxt_dim.c
bnxt_ethtool.c bnxt_en: implement callbacks for devlink selftests 2022-07-28 21:56:53 -07:00
bnxt_ethtool.h bnxt_en: implement callbacks for devlink selftests 2022-07-28 21:56:53 -07:00
bnxt_fw_hdr.h
bnxt_hsi.h bnxt_en: Update firmware interface to 1.10.2.95 2022-05-13 12:47:40 +01:00
bnxt_hwrm.c bnxt_en: Increase firmware message response DMA wait time 2022-02-20 13:47:15 +00:00
bnxt_hwrm.h bnxt_en: Increase firmware message response DMA wait time 2022-02-20 13:47:15 +00:00
bnxt_nvm_defs.h
bnxt_ptp.c bnxt_en: fix flags to check for supported fw version 2022-09-19 18:22:06 -07:00
bnxt_ptp.h bnxt_en: Configure ptp filters during bnxt open 2022-05-13 12:47:40 +01:00
bnxt_sriov.c bnxt_en: fix NQ resource accounting during vf creation on 57500 chips 2022-08-23 15:32:17 -07:00
bnxt_sriov.h ethernet: constify references to netdev->dev_addr in drivers 2021-10-14 09:22:11 -07:00
bnxt_tc.c flow_offload: reject to offload tc actions in offload drivers 2021-12-19 14:08:47 +00:00
bnxt_tc.h
bnxt_ulp.c eth: bnxt: make ulp_id unsigned to make GCC 12 happy 2022-05-20 17:30:19 -07:00
bnxt_ulp.h eth: bnxt: make ulp_id unsigned to make GCC 12 happy 2022-05-20 17:30:19 -07:00
bnxt_vfr.c devlink: hold the instance lock during eswitch_mode callbacks 2022-03-21 14:11:38 +00:00
bnxt_vfr.h bnxt_en: Free and allocate VF-Reps during error recovery. 2021-04-12 13:20:38 -07:00
bnxt_xdp.c bnxt_en: Use PAGE_SIZE to init buffer when multi buffer XDP is not in use 2022-08-23 15:32:07 -07:00
bnxt_xdp.h bnxt: support transmit and free of aggregation buffers 2022-04-08 11:52:48 +01:00