| Message ID | 20220324023904.7173-1-linma@zju.edu.cn (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v0] mctp: fix netdev reference bug | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
Hi Lin Ma, On Thu, 2022-03-24 at 10:39 +0800, Lin Ma wrote: > In extended addressing mode, function mctp_local_output() fetch netdev > through dev_get_by_index_rcu, which won't increase netdev's reference > counter. Hence, the reference may underflow when mctp_local_output calls > dev_put(), results in possible use after free. > > This patch adds dev_hold() to fix the reference bug. This was already fixed in net-next to increment the refcount in __mctp_dev_get() and use mctp_dev_put(). dc121c008491 ("mctp: make __mctp_dev_get() take a refcount hold") e297db3eadd7 ("mctp: Fix incorrect netdev unref for extended addr") Thanks, Matt
diff --git a/net/mctp/route.c b/net/mctp/route.c index e52cef750500..a9e5d6c40c65 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -817,6 +817,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, return rc; } + dev_hold(dev); rt->dev = __mctp_dev_get(dev); rcu_read_unlock();
In extended addressing mode, function mctp_local_output() fetch netdev through dev_get_by_index_rcu, which won't increase netdev's reference counter. Hence, the reference may underflow when mctp_local_output calls dev_put(), results in possible use after free. This patch adds dev_hold() to fix the reference bug. Fixes: 99ce45d5e7db ("mctp: Implement extended addressing") Signed-off-by: Lin Ma <linma@zju.edu.cn> --- net/mctp/route.c | 1 + 1 file changed, 1 insertion(+)