| Message ID | 20211111141402.7551-1-linma@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 81b1d548d00bcd028303c4f3150fa753b9b8aa71 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v1] hamradio: remove needs_free_netdev to avoid UAF | expand |
On Thu, 11 Nov 2021 22:14:02 +0800 Lin Ma wrote: > The former patch "defer 6pack kfree after unregister_netdev" reorders > the kfree of two buffer after the unregister_netdev to prevent the race > condition. It also adds free_netdev() function in sixpack_close(), which > is a direct copy from the similar code in mkiss_close(). > > However, in sixpack driver, the flag needs_free_netdev is set to true in > sp_setup(), hence the unregister_netdev() will free the netdev > automatically. Therefore, as the sp is netdev_priv, use-after-free > occurs. > > This patch removes the needs_free_netdev = true and just let the > free_netdev to finish this deallocation task. > > Signed-off-by: Lin Ma <linma@zju.edu.cn> Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev")
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Thu, 11 Nov 2021 22:14:02 +0800 you wrote: > The former patch "defer 6pack kfree after unregister_netdev" reorders > the kfree of two buffer after the unregister_netdev to prevent the race > condition. It also adds free_netdev() function in sixpack_close(), which > is a direct copy from the similar code in mkiss_close(). > > However, in sixpack driver, the flag needs_free_netdev is set to true in > sp_setup(), hence the unregister_netdev() will free the netdev > automatically. Therefore, as the sp is netdev_priv, use-after-free > occurs. > > [...] Here is the summary with links: - [v1] hamradio: remove needs_free_netdev to avoid UAF https://git.kernel.org/netdev/net/c/81b1d548d00b You are awesome, thank you!
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index bfdf89e54752..8a19a06b505d 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -306,7 +306,6 @@ static void sp_setup(struct net_device *dev) { /* Finish setting up the DEVICE info. */ dev->netdev_ops = &sp_netdev_ops; - dev->needs_free_netdev = true; dev->mtu = SIXP_MTU; dev->hard_header_len = AX25_MAX_HEADER_LEN; dev->header_ops = &ax25_header_ops;
The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev = true and just let the free_netdev to finish this deallocation task. Signed-off-by: Lin Ma <linma@zju.edu.cn> --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-)