)]}'
{
  "commit": "79514ef670e9e575a1fe36922268c439d0f0ca8a",
  "tree": "9ee78429fd7c31359e63299f4ff65da04f845d03",
  "parents": [
    "e3ebdb20fddacded2740a333ff66781e0d28b05c"
  ],
  "author": {
    "name": "Eugeniu Rosca",
    "email": "erosca@de.adit-jv.com",
    "time": "Tue Jun 06 00:08:10 2017 +0200"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Tue Jun 06 16:02:22 2017 -0400"
  },
  "message": "ravb: Fix use-after-free on `ifconfig eth0 down`\n\nCommit a47b70ea86bd (\"ravb: unmap descriptors when freeing rings\") has\nintroduced the issue seen in [1] reproduced on H3ULCB board.\n\nFix this by relocating the RX skb ringbuffer free operation, so that\nswiotlb page unmapping can be done first. Freeing of aligned TX buffers\nis not relevant to the issue seen in [1]. Still, reposition TX free\ncalls as well, to have all kfree() operations performed consistently\n_after_ dma_unmap_*()/dma_free_*().\n\n[1] Console screenshot with the problem reproduced:\n\nsalvator-x login: root\nroot@salvator-x:~# ifconfig eth0 up\nMicrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: \\\n       attached PHY driver [Micrel KSZ9031 Gigabit PHY]   \\\n       (mii_bus:phy_addr\u003de6800000.ethernet-ffffffff:00, irq\u003d235)\nIPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready\nroot@salvator-x:~#\nroot@salvator-x:~# ifconfig eth0 down\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: use-after-free in swiotlb_tbl_unmap_single+0xc4/0x35c\nWrite of size 1538 at addr ffff8006d884f780 by task ifconfig/1649\n\nCPU: 0 PID: 1649 Comm: ifconfig Not tainted 4.12.0-rc4-00004-g112eb07287d1 #32\nHardware name: Renesas H3ULCB board based on r8a7795 (DT)\nCall trace:\n[\u003cffff20000808f11c\u003e] dump_backtrace+0x0/0x3a4\n[\u003cffff20000808f4d4\u003e] show_stack+0x14/0x1c\n[\u003cffff20000865970c\u003e] dump_stack+0xf8/0x150\n[\u003cffff20000831f8b0\u003e] print_address_description+0x7c/0x330\n[\u003cffff200008320010\u003e] kasan_report+0x2e0/0x2f4\n[\u003cffff20000831eac0\u003e] check_memory_region+0x20/0x14c\n[\u003cffff20000831f054\u003e] memcpy+0x48/0x68\n[\u003cffff20000869ed50\u003e] swiotlb_tbl_unmap_single+0xc4/0x35c\n[\u003cffff20000869fcf4\u003e] unmap_single+0x90/0xa4\n[\u003cffff20000869fd14\u003e] swiotlb_unmap_page+0xc/0x14\n[\u003cffff2000080a2974\u003e] __swiotlb_unmap_page+0xcc/0xe4\n[\u003cffff2000088acdb8\u003e] ravb_ring_free+0x514/0x870\n[\u003cffff2000088b25dc\u003e] ravb_close+0x288/0x36c\n[\u003cffff200008aaf8c4\u003e] __dev_close_many+0x14c/0x174\n[\u003cffff200008aaf9b4\u003e] __dev_close+0xc8/0x144\n[\u003cffff200008ac2100\u003e] __dev_change_flags+0xd8/0x194\n[\u003cffff200008ac221c\u003e] dev_change_flags+0x60/0xb0\n[\u003cffff200008ba2dec\u003e] devinet_ioctl+0x484/0x9d4\n[\u003cffff200008ba7b78\u003e] inet_ioctl+0x190/0x194\n[\u003cffff200008a78c44\u003e] sock_do_ioctl+0x78/0xa8\n[\u003cffff200008a7a128\u003e] sock_ioctl+0x110/0x3c4\n[\u003cffff200008365a70\u003e] vfs_ioctl+0x90/0xa0\n[\u003cffff200008365dbc\u003e] do_vfs_ioctl+0x148/0xc38\n[\u003cffff2000083668f0\u003e] SyS_ioctl+0x44/0x74\n[\u003cffff200008083770\u003e] el0_svc_naked+0x24/0x28\n\nThe buggy address belongs to the page:\npage:ffff7e001b6213c0 count:0 mapcount:0 mapping:          (null) index:0x0\nflags: 0x4000000000000000()\nraw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff\nraw: 0000000000000000 ffff7e001b6213e0 0000000000000000 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8006d884f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff8006d884f700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\u003effff8006d884f780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                   ^\n ffff8006d884f800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff8006d884f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nDisabling lock debugging due to kernel taint\nroot@salvator-x:~#\n\nFixes: a47b70ea86bd (\"ravb: unmap descriptors when freeing rings\")\nSigned-off-by: Eugeniu Rosca \u003cerosca@de.adit-jv.com\u003e\nAcked-by: Sergei Shtylyov \u003csergei.shtylyov@cogentembedded.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3cd7989c007dfe46947e2ddb366a904f1af90198",
      "old_mode": 33188,
      "old_path": "drivers/net/ethernet/renesas/ravb_main.c",
      "new_id": "784782da3a85b638e9e2a195fe66b15c72fe0fe5",
      "new_mode": 33188,
      "new_path": "drivers/net/ethernet/renesas/ravb_main.c"
    }
  ]
}