| Message ID | 20200824200650.21982-1-Jason@zx2c4.com |
|---|---|
| State | New |
| Headers | show |
| Series | [net] net: read dev->needs_free_netdev before potentially freeing dev | expand |
On Mon, Aug 24, 2020 at 10:07 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote: > I believe that the bug Dan reported would easily be fixed as well by > just setting dev->needs_free_netdev=true and removing the call to > free_netdev(dev) in wg_destruct, in wireguard. If you think that this is > the more proper fix -- and that the problem actually isn't this flow in > dev.c and any code that might hit this UaF is wrong -- let me know and > I'll send in a patch for wireguard instead. I think ppp might be hit by the same bug, actually. netdev_run_todo->ppp_dev_priv_destructor()->ppp_destroy_interface()->free_netdev(dev), followed by "if (dev->needs_free_netdev)".
On Mon, Aug 24, 2020 at 10:06:50PM +0200, Jason A. Donenfeld wrote: > If dev->needs_free_netdev is true, it means that netdev_run_todo should > call free_netdev(dev) after it calls dev->priv_destructor. If > dev->needs_free_netdev is false, then it means that either > dev->priv_destructor is taking care of calling free_netdev(dev), or > something else, elsewhere, is doing that. In this case, branching on > "if (dev->needs_free_netdev)" after calling dev->priv_destructor is a > potential UaF. This patch fixes the issue by reading > dev->needs_free_netdev before calling dev->priv_destructor. > No, I misread the code. Sorry. This patch is not required. We can use "dev" up to the end of the function where we do: /* Free network device */ kobject_put(&dev->dev.kobj); That's where the final reference is released. regards, dan carpenter
diff --git a/net/core/dev.c b/net/core/dev.c index 7df6c9617321..abe53c2fae8c 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10073,6 +10073,8 @@ void netdev_run_todo(void) while (!list_empty(&list)) { struct net_device *dev = list_first_entry(&list, struct net_device, todo_list); + bool needs_free_netdev = dev->needs_free_netdev; + list_del(&dev->todo_list); if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) { @@ -10097,7 +10099,7 @@ void netdev_run_todo(void) #endif if (dev->priv_destructor) dev->priv_destructor(dev); - if (dev->needs_free_netdev) + if (needs_free_netdev) free_netdev(dev); /* Report a network device has been unregistered */
If dev->needs_free_netdev is true, it means that netdev_run_todo should call free_netdev(dev) after it calls dev->priv_destructor. If dev->needs_free_netdev is false, then it means that either dev->priv_destructor is taking care of calling free_netdev(dev), or something else, elsewhere, is doing that. In this case, branching on "if (dev->needs_free_netdev)" after calling dev->priv_destructor is a potential UaF. This patch fixes the issue by reading dev->needs_free_netdev before calling dev->priv_destructor. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- I believe that the bug Dan reported would easily be fixed as well by just setting dev->needs_free_netdev=true and removing the call to free_netdev(dev) in wg_destruct, in wireguard. If you think that this is the more proper fix -- and that the problem actually isn't this flow in dev.c and any code that might hit this UaF is wrong -- let me know and I'll send in a patch for wireguard instead. net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.28.0