| Message ID | 20250328062237.3746875-1-ap420073@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 42f342387841891bbbd15e25d33eb510a0cf7a9a |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: fix use-after-free in the netdev_nl_sock_priv_destroy() | expand |
On Fri, 28 Mar 2025 06:22:37 +0000 Taehee Yoo wrote: > In the netdev_nl_sock_priv_destroy(), an instance lock is acquired > before calling net_devmem_unbind_dmabuf(), then releasing an instance > lock(netdev_unlock(binding->dev)). > However, a binding is freed in the net_devmem_unbind_dmabuf(). > So using a binding after net_devmem_unbind_dmabuf() occurs UAF. > To fix this UAF, it needs to use temporary variable. > > Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") > Signed-off-by: Taehee Yoo <ap420073@gmail.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Thanks!
On Thu, Mar 27, 2025 at 11:22 PM Taehee Yoo <ap420073@gmail.com> wrote: > > In the netdev_nl_sock_priv_destroy(), an instance lock is acquired > before calling net_devmem_unbind_dmabuf(), then releasing an instance > lock(netdev_unlock(binding->dev)). > However, a binding is freed in the net_devmem_unbind_dmabuf(). > So using a binding after net_devmem_unbind_dmabuf() occurs UAF. > To fix this UAF, it needs to use temporary variable. > > Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") > Signed-off-by: Taehee Yoo <ap420073@gmail.com> Reviewed-by: Mina Almasry <almasrymina@google.com>
On Fri, 28 Mar 2025 06:22:37 +0000, Taehee Yoo <ap420073@gmail.com> wrote: > In the netdev_nl_sock_priv_destroy(), an instance lock is acquired > before calling net_devmem_unbind_dmabuf(), then releasing an instance > lock(netdev_unlock(binding->dev)). > However, a binding is freed in the net_devmem_unbind_dmabuf(). > So using a binding after net_devmem_unbind_dmabuf() occurs UAF. > To fix this UAF, it needs to use temporary variable. > > Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") > Signed-off-by: Taehee Yoo <ap420073@gmail.com> Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> > --- > net/core/netdev-genl.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c > index fd1cfa9707dc..3afeaa8c5dc5 100644 > --- a/net/core/netdev-genl.c > +++ b/net/core/netdev-genl.c > @@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv) > { > struct net_devmem_dmabuf_binding *binding; > struct net_devmem_dmabuf_binding *temp; > + struct net_device *dev; > > mutex_lock(&priv->lock); > list_for_each_entry_safe(binding, temp, &priv->bindings, list) { > - netdev_lock(binding->dev); > + dev = binding->dev; > + netdev_lock(dev); > net_devmem_unbind_dmabuf(binding); > - netdev_unlock(binding->dev); > + netdev_unlock(dev); > } > mutex_unlock(&priv->lock); > } > -- > 2.34.1 >
On Fri, Mar 28, 2025 at 06:22:37AM +0000, Taehee Yoo wrote: > In the netdev_nl_sock_priv_destroy(), an instance lock is acquired > before calling net_devmem_unbind_dmabuf(), then releasing an instance > lock(netdev_unlock(binding->dev)). > However, a binding is freed in the net_devmem_unbind_dmabuf(). > So using a binding after net_devmem_unbind_dmabuf() occurs UAF. > To fix this UAF, it needs to use temporary variable. > > Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") > Signed-off-by: Taehee Yoo <ap420073@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Fri, 28 Mar 2025 06:22:37 +0000 you wrote: > In the netdev_nl_sock_priv_destroy(), an instance lock is acquired > before calling net_devmem_unbind_dmabuf(), then releasing an instance > lock(netdev_unlock(binding->dev)). > However, a binding is freed in the net_devmem_unbind_dmabuf(). > So using a binding after net_devmem_unbind_dmabuf() occurs UAF. > To fix this UAF, it needs to use temporary variable. > > [...] Here is the summary with links: - [net] net: fix use-after-free in the netdev_nl_sock_priv_destroy() https://git.kernel.org/netdev/net/c/42f342387841 You are awesome, thank you!
diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c index fd1cfa9707dc..3afeaa8c5dc5 100644 --- a/net/core/netdev-genl.c +++ b/net/core/netdev-genl.c @@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv) { struct net_devmem_dmabuf_binding *binding; struct net_devmem_dmabuf_binding *temp; + struct net_device *dev; mutex_lock(&priv->lock); list_for_each_entry_safe(binding, temp, &priv->bindings, list) { - netdev_lock(binding->dev); + dev = binding->dev; + netdev_lock(dev); net_devmem_unbind_dmabuf(binding); - netdev_unlock(binding->dev); + netdev_unlock(dev); } mutex_unlock(&priv->lock); }
In the netdev_nl_sock_priv_destroy(), an instance lock is acquired before calling net_devmem_unbind_dmabuf(), then releasing an instance lock(netdev_unlock(binding->dev)). However, a binding is freed in the net_devmem_unbind_dmabuf(). So using a binding after net_devmem_unbind_dmabuf() occurs UAF. To fix this UAF, it needs to use temporary variable. Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") Signed-off-by: Taehee Yoo <ap420073@gmail.com> --- net/core/netdev-genl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)