| Message ID | 8338a74098bc1aafbca14d4612a10d6930fcef1b.1715002910.git.duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ax25: Fix issues of ax25_dev and net_device | expand |
On Mon, May 06, 2024 at 10:08:34PM +0800, Duoming Zhou wrote: > The ax25_addr_ax25dev() exists a reference count leak issue of the > object "ax25_dev" and the ax25_dev_device_down() exists reference > count leak issues of the objects "ax25_dev" and "net_device". > > Memory leak issue in ax25_addr_ax25dev(): > > The reference count of the object "ax25_dev" can be increased multiple > times in ax25_addr_ax25dev(). This will cause a memory leak so far. > > Memory leak issues in ax25_dev_device_down(): > > The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and > then increase the reference count when ax25_dev is added to ax25_dev_list. > As a result, the reference count of ax25_dev is 2. But when the device is > shutting down. The ax25_dev_device_down() drops the reference count once > or twice depending on if we goto unlock_put or not, which will cause > memory leak. > > There is also a reference count leak issue of the object "net_device", > when the ax25 device is shutting down. The ax25_dev_device_down() drops > the reference count of net_device one or zero times depending on if we > goto unlock_put or not, which will cause memory leak. > > In order to solve the above issues, use kernel circular doubly linked > list to implementate ax25_dev_list. As for ax25_addr_ax25dev() issue, > it is impossible for one pointer to be on a list twice. So add a break > in ax25_addr_ax25dev(). As for ax25_dev_device_down() issues, increase > the reference count of ax25_dev once in ax25_dev_device_up() and decrease > the reference count of ax25_dev and net_device after ax25_dev is removed > from the ax25_dev_list. > > Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") > Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> > --- > Changes in v3: > - Use kernel list to implementate ax25_dev_list. > - Solve reference count leak issues in ax25_dev_device_down(). > > include/net/ax25.h | 4 ++-- > net/ax25/ax25_dev.c | 36 ++++++++++++------------------------ > 2 files changed, 14 insertions(+), 26 deletions(-) > > diff --git a/include/net/ax25.h b/include/net/ax25.h > index 0d939e5aee4..92c6aa4f9a6 100644 > --- a/include/net/ax25.h > +++ b/include/net/ax25.h > @@ -216,7 +216,7 @@ typedef struct { > struct ctl_table; > > typedef struct ax25_dev { > - struct ax25_dev *next; > + struct list_head list; > > struct net_device *dev; > netdevice_tracker dev_tracker; > @@ -330,7 +330,7 @@ int ax25_addr_size(const ax25_digi *); > void ax25_digi_invert(const ax25_digi *, ax25_digi *); > > /* ax25_dev.c */ > -extern ax25_dev *ax25_dev_list; > +static struct list_head ax25_dev_list; > extern spinlock_t ax25_dev_lock; > > #if IS_ENABLED(CONFIG_AX25) > diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c > index 282ec581c07..fbaaba0351e 100644 > --- a/net/ax25/ax25_dev.c > +++ b/net/ax25/ax25_dev.c > @@ -22,11 +22,11 @@ > #include <net/sock.h> > #include <linux/uaccess.h> > #include <linux/fcntl.h> > +#include <linux/list.h> > #include <linux/mm.h> > #include <linux/interrupt.h> > #include <linux/init.h> > > -ax25_dev *ax25_dev_list; > DEFINE_SPINLOCK(ax25_dev_lock); > > ax25_dev *ax25_addr_ax25dev(ax25_address *addr) > @@ -34,11 +34,13 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) > ax25_dev *ax25_dev, *res = NULL; > > spin_lock_bh(&ax25_dev_lock); > - for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) > + list_for_each_entry(ax25_dev, &ax25_dev_list, list) { > if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) { > res = ax25_dev; > ax25_dev_hold(ax25_dev); > + break; > } > + } > spin_unlock_bh(&ax25_dev_lock); > > return res; > @@ -52,6 +54,7 @@ void ax25_dev_device_up(struct net_device *dev) > { > ax25_dev *ax25_dev; > > + INIT_LIST_HEAD(&ax25_dev_list); You can't do this, it will empty the list for each new thing added. What I wrote is the way to do it. /* Initialized the list for the first entry */ if (!ax25_dev_list.next) INIT_LIST_HEAD(&ax25_dev_list); Just delete the FIXME. I had thought there is maybe a more beautiful way to do it but actually it's fine. > ax25_dev = kzalloc(sizeof(*ax25_dev), GFP_KERNEL); > if (!ax25_dev) { > printk(KERN_ERR "AX.25: ax25_dev_device_up - out of memory\n"); > @@ -59,7 +62,6 @@ void ax25_dev_device_up(struct net_device *dev) > } > > refcount_set(&ax25_dev->refcount, 1); > - dev->ax25_ptr = ax25_dev; > ax25_dev->dev = dev; > netdev_hold(dev, &ax25_dev->dev_tracker, GFP_KERNEL); > ax25_dev->forward = NULL; > @@ -85,10 +87,9 @@ void ax25_dev_device_up(struct net_device *dev) > #endif > > spin_lock_bh(&ax25_dev_lock); > - ax25_dev->next = ax25_dev_list; > - ax25_dev_list = ax25_dev; > + list_add(&ax25_dev->list, &ax25_dev_list); > spin_unlock_bh(&ax25_dev_lock); > - ax25_dev_hold(ax25_dev); > + dev->ax25_ptr = ax25_dev; Please do this while holding the spinlock, otherwise we're not guaranteed to find find a match in ax25_dev_device_down(). It could race. regards, dan carpenter
> The ax25_addr_ax25dev() exists a reference count leak issue of the > object "ax25_dev" and the ax25_dev_device_down() exists reference > count leak issues of the objects "ax25_dev" and "net_device". I find that such a wording for the introduction of adjustments needs further improvements. How do you think about to offer changes for the affected two function implementations as separate update steps? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.9-rc7#n81 Regards, Markus
diff --git a/include/net/ax25.h b/include/net/ax25.h index 0d939e5aee4..92c6aa4f9a6 100644 --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -216,7 +216,7 @@ typedef struct { struct ctl_table; typedef struct ax25_dev { - struct ax25_dev *next; + struct list_head list; struct net_device *dev; netdevice_tracker dev_tracker; @@ -330,7 +330,7 @@ int ax25_addr_size(const ax25_digi *); void ax25_digi_invert(const ax25_digi *, ax25_digi *); /* ax25_dev.c */ -extern ax25_dev *ax25_dev_list; +static struct list_head ax25_dev_list; extern spinlock_t ax25_dev_lock; #if IS_ENABLED(CONFIG_AX25) diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 282ec581c07..fbaaba0351e 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -22,11 +22,11 @@ #include <net/sock.h> #include <linux/uaccess.h> #include <linux/fcntl.h> +#include <linux/list.h> #include <linux/mm.h> #include <linux/interrupt.h> #include <linux/init.h> -ax25_dev *ax25_dev_list; DEFINE_SPINLOCK(ax25_dev_lock); ax25_dev *ax25_addr_ax25dev(ax25_address *addr) @@ -34,11 +34,13 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) ax25_dev *ax25_dev, *res = NULL; spin_lock_bh(&ax25_dev_lock); - for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) + list_for_each_entry(ax25_dev, &ax25_dev_list, list) { if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) { res = ax25_dev; ax25_dev_hold(ax25_dev); + break; } + } spin_unlock_bh(&ax25_dev_lock); return res; @@ -52,6 +54,7 @@ void ax25_dev_device_up(struct net_device *dev) { ax25_dev *ax25_dev; + INIT_LIST_HEAD(&ax25_dev_list); ax25_dev = kzalloc(sizeof(*ax25_dev), GFP_KERNEL); if (!ax25_dev) { printk(KERN_ERR "AX.25: ax25_dev_device_up - out of memory\n"); @@ -59,7 +62,6 @@ void ax25_dev_device_up(struct net_device *dev) } refcount_set(&ax25_dev->refcount, 1); - dev->ax25_ptr = ax25_dev; ax25_dev->dev = dev; netdev_hold(dev, &ax25_dev->dev_tracker, GFP_KERNEL); ax25_dev->forward = NULL; @@ -85,10 +87,9 @@ void ax25_dev_device_up(struct net_device *dev) #endif spin_lock_bh(&ax25_dev_lock); - ax25_dev->next = ax25_dev_list; - ax25_dev_list = ax25_dev; + list_add(&ax25_dev->list, &ax25_dev_list); spin_unlock_bh(&ax25_dev_lock); - ax25_dev_hold(ax25_dev); + dev->ax25_ptr = ax25_dev; ax25_register_dev_sysctl(ax25_dev); } @@ -111,32 +112,19 @@ void ax25_dev_device_down(struct net_device *dev) /* * Remove any packet forwarding that points to this device. */ - for (s = ax25_dev_list; s != NULL; s = s->next) + list_for_each_entry(s, &ax25_dev_list, list) { if (s->forward == dev) s->forward = NULL; - - if ((s = ax25_dev_list) == ax25_dev) { - ax25_dev_list = s->next; - goto unlock_put; } - while (s != NULL && s->next != NULL) { - if (s->next == ax25_dev) { - s->next = ax25_dev->next; - goto unlock_put; + list_for_each_entry(s, &ax25_dev_list, list) { + if (s == ax25_dev) { + list_del(&s->list); + break; } - - s = s->next; } - spin_unlock_bh(&ax25_dev_lock); dev->ax25_ptr = NULL; - ax25_dev_put(ax25_dev); - return; - -unlock_put: spin_unlock_bh(&ax25_dev_lock); - ax25_dev_put(ax25_dev); - dev->ax25_ptr = NULL; netdev_put(dev, &ax25_dev->dev_tracker); ax25_dev_put(ax25_dev); }
The ax25_addr_ax25dev() exists a reference count leak issue of the object "ax25_dev" and the ax25_dev_device_down() exists reference count leak issues of the objects "ax25_dev" and "net_device". Memory leak issue in ax25_addr_ax25dev(): The reference count of the object "ax25_dev" can be increased multiple times in ax25_addr_ax25dev(). This will cause a memory leak so far. Memory leak issues in ax25_dev_device_down(): The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and then increase the reference count when ax25_dev is added to ax25_dev_list. As a result, the reference count of ax25_dev is 2. But when the device is shutting down. The ax25_dev_device_down() drops the reference count once or twice depending on if we goto unlock_put or not, which will cause memory leak. There is also a reference count leak issue of the object "net_device", when the ax25 device is shutting down. The ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issues, use kernel circular doubly linked list to implementate ax25_dev_list. As for ax25_addr_ax25dev() issue, it is impossible for one pointer to be on a list twice. So add a break in ax25_addr_ax25dev(). As for ax25_dev_device_down() issues, increase the reference count of ax25_dev once in ax25_dev_device_up() and decrease the reference count of ax25_dev and net_device after ax25_dev is removed from the ax25_dev_list. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- Changes in v3: - Use kernel list to implementate ax25_dev_list. - Solve reference count leak issues in ax25_dev_device_down(). include/net/ax25.h | 4 ++-- net/ax25/ax25_dev.c | 36 ++++++++++++------------------------ 2 files changed, 14 insertions(+), 26 deletions(-)