| Message ID | 20230925192351.40744-1-jeremy@jcline.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,net] net: nfc: llcp: Add lock when modifying device list | expand |
On Mon, Sep 25, 2023 at 03:23:51PM -0400, Jeremy Cline wrote: > The device list needs its associated lock held when modifying it, or the > list could become corrupted, as syzbot discovered. > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 > Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") > Signed-off-by: Jeremy Cline <jeremy@jcline.org> Reviewed-by: Simon Horman <horms@kernel.org>
On 25/09/2023 21:23, Jeremy Cline wrote: > The device list needs its associated lock held when modifying it, or the > list could become corrupted, as syzbot discovered. > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 > Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") > Signed-off-by: Jeremy Cline <jeremy@jcline.org> > --- Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 25 Sep 2023 15:23:51 -0400 you wrote: > The device list needs its associated lock held when modifying it, or the > list could become corrupted, as syzbot discovered. > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 > Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") > Signed-off-by: Jeremy Cline <jeremy@jcline.org> > > [...] Here is the summary with links: - [v2,net] net: nfc: llcp: Add lock when modifying device list https://git.kernel.org/netdev/net/c/dfc7f7a988da You are awesome, thank you!
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index f60e424e0607..6705bb895e23 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1636,7 +1636,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0); INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work); + spin_lock(&llcp_devices_lock); list_add(&local->list, &llcp_devices); + spin_unlock(&llcp_devices_lock); return 0; }
The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Signed-off-by: Jeremy Cline <jeremy@jcline.org> --- Changes from v1: added the correct Fixes tag net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+)