[net-next,v3,0/3] net: ipvlan: fix potential UAF problem for phy_dev

Message

Ziyang Xuan (William) March 19, 2022, 9:52 a.m. UTC

There is a known scenario can trigger UAF problem for lower
netdevice as following:

Someone module puts the NETDEV_UNREGISTER event handler to a
work, and lower netdevice is accessed in the work handler. But
when the work is excuted, lower netdevice has been destroyed
because upper netdevice did not get reference to lower netdevice
correctly.

Although it can not happen for ipvlan now because there is no
way to access phy_dev outside ipvlan. But it is necessary to
add the reference operation to phy_dev to avoid the potential
UAF problem in the future.

In addition, add net device refcount tracker to ipvlan and
fix some error comments for ipvtap module.

---
v2->v3:
  - Make it clear that the problem can not happen now but for future.
  - Delete "Fixes: tag" to avoid backporting to stable.
v1->v2:
  - Add "Fixes: tag" for fix patches.

Ziyang Xuan (3):
  net: ipvlan: fix potential UAF problem for phy_dev
  net: ipvlan: add net device refcount tracker
  net: ipvtap: fix error comments

 drivers/net/ipvlan/ipvlan.h      |  1 +
 drivers/net/ipvlan/ipvlan_main.c | 13 +++++++++++++
 drivers/net/ipvlan/ipvtap.c      |  4 ++--
 3 files changed, 16 insertions(+), 2 deletions(-)

Comments

Paolo Abeni March 22, 2022, 9:15 a.m. UTC | #1

Hello,

On Sat, 2022-03-19 at 17:52 +0800, Ziyang Xuan wrote:
> There is a known scenario can trigger UAF problem for lower
> netdevice as following:
> 
> Someone module puts the NETDEV_UNREGISTER event handler to a
> work, and lower netdevice is accessed in the work handler. But
> when the work is excuted, lower netdevice has been destroyed
> because upper netdevice did not get reference to lower netdevice
> correctly.
> 
> Although it can not happen for ipvlan now because there is no
> way to access phy_dev outside ipvlan. But it is necessary to
> add the reference operation to phy_dev to avoid the potential
> UAF problem in the future.
> 
> In addition, add net device refcount tracker to ipvlan and
> fix some error comments for ipvtap module.

This is pure net-next material, and we are now into the merge window -
only fixes allowed. Please repost in 2w, thanks!

Paolo