| Message ID | 20220405132206.55291-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | ec4eb8a86ade4d22633e1da2a7d85a846b7d1798 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | drivers: net: slip: fix NPD bug in sl_tx_timeout() | expand |
On 05. 04. 22, 15:22, Duoming Zhou wrote: > When a slip driver is detaching, the slip_close() will act to > cleanup necessary resources and sl->tty is set to NULL in > slip_close(). Meanwhile, the packet we transmit is blocked, > sl_tx_timeout() will be called. Although slip_close() and > sl_tx_timeout() use sl->lock to synchronize, we don`t judge > whether sl->tty equals to NULL in sl_tx_timeout() and the > null pointer dereference bug will happen. > > (Thread 1) | (Thread 2) > | slip_close() > | spin_lock_bh(&sl->lock) > | ... > ... | sl->tty = NULL //(1) > sl_tx_timeout() | spin_unlock_bh(&sl->lock) > spin_lock(&sl->lock); | > ... | ... > tty_chars_in_buffer(sl->tty)| > if (tty->ops->..) //(2) | > ... | synchronize_rcu() > > We set NULL to sl->tty in position (1) and dereference sl->tty > in position (2). > > This patch adds check in sl_tx_timeout(). If sl->tty equals to > NULL, sl_tx_timeout() will goto out. It makes sense. unregister_netdev() (to kill the timer) is called only later in slip_close(). Reviewed-by: Jiri Slaby <jirislaby@kernel.org> > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> > --- > drivers/net/slip/slip.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c > index 88396ff99f0..6865d32270e 100644 > --- a/drivers/net/slip/slip.c > +++ b/drivers/net/slip/slip.c > @@ -469,7 +469,7 @@ static void sl_tx_timeout(struct net_device *dev, unsigned int txqueue) > spin_lock(&sl->lock); > > if (netif_queue_stopped(dev)) { > - if (!netif_running(dev)) > + if (!netif_running(dev) || !sl->tty) > goto out; > > /* May be we must check transmitter timeout here ?
Hello, On Wed, 6 Apr 2022 10:45:05 +0200, Jiri Slaby wrote: > > When a slip driver is detaching, the slip_close() will act to > > cleanup necessary resources and sl->tty is set to NULL in > > slip_close(). Meanwhile, the packet we transmit is blocked, > > sl_tx_timeout() will be called. Although slip_close() and > > sl_tx_timeout() use sl->lock to synchronize, we don`t judge > > whether sl->tty equals to NULL in sl_tx_timeout() and the > > null pointer dereference bug will happen. > > > > (Thread 1) | (Thread 2) > > | slip_close() > > | spin_lock_bh(&sl->lock) > > | ... > > ... | sl->tty = NULL //(1) > > sl_tx_timeout() | spin_unlock_bh(&sl->lock) > > spin_lock(&sl->lock); | > > ... | ... > > tty_chars_in_buffer(sl->tty)| > > if (tty->ops->..) //(2) | > > ... | synchronize_rcu() > > > > We set NULL to sl->tty in position (1) and dereference sl->tty > > in position (2). > > > > This patch adds check in sl_tx_timeout(). If sl->tty equals to > > NULL, sl_tx_timeout() will goto out. > > It makes sense. unregister_netdev() (to kill the timer) is called only > later in slip_close(). > > Reviewed-by: Jiri Slaby <jirislaby@kernel.org> > Thanks for your time and approve my patch. Best regards, Duoming Zhou
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Tue, 5 Apr 2022 21:22:06 +0800 you wrote: > When a slip driver is detaching, the slip_close() will act to > cleanup necessary resources and sl->tty is set to NULL in > slip_close(). Meanwhile, the packet we transmit is blocked, > sl_tx_timeout() will be called. Although slip_close() and > sl_tx_timeout() use sl->lock to synchronize, we don`t judge > whether sl->tty equals to NULL in sl_tx_timeout() and the > null pointer dereference bug will happen. > > [...] Here is the summary with links: - drivers: net: slip: fix NPD bug in sl_tx_timeout() https://git.kernel.org/netdev/net/c/ec4eb8a86ade You are awesome, thank you!
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 88396ff99f0..6865d32270e 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -469,7 +469,7 @@ static void sl_tx_timeout(struct net_device *dev, unsigned int txqueue) spin_lock(&sl->lock); if (netif_queue_stopped(dev)) { - if (!netif_running(dev)) + if (!netif_running(dev) || !sl->tty) goto out; /* May be we must check transmitter timeout here ?
When a slip driver is detaching, the slip_close() will act to cleanup necessary resources and sl->tty is set to NULL in slip_close(). Meanwhile, the packet we transmit is blocked, sl_tx_timeout() will be called. Although slip_close() and sl_tx_timeout() use sl->lock to synchronize, we don`t judge whether sl->tty equals to NULL in sl_tx_timeout() and the null pointer dereference bug will happen. (Thread 1) | (Thread 2) | slip_close() | spin_lock_bh(&sl->lock) | ... ... | sl->tty = NULL //(1) sl_tx_timeout() | spin_unlock_bh(&sl->lock) spin_lock(&sl->lock); | ... | ... tty_chars_in_buffer(sl->tty)| if (tty->ops->..) //(2) | ... | synchronize_rcu() We set NULL to sl->tty in position (1) and dereference sl->tty in position (2). This patch adds check in sl_tx_timeout(). If sl->tty equals to NULL, sl_tx_timeout() will goto out. Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/net/slip/slip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)