diff mbox series

net: hso: fix NULL-deref on disconnect regression

Message ID 20210426081149.10498-1-johan@kernel.org
State New
Headers show
Series net: hso: fix NULL-deref on disconnect regression | expand

Commit Message

Johan Hovold April 26, 2021, 8:11 a.m. UTC
Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
unregistration") fixed the racy minor allocation reported by syzbot, but
introduced an unconditional NULL-pointer dereference on every disconnect
instead.

Specifically, the serial device table must no longer be accessed after
the minor has been released by hso_serial_tty_unregister().

Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration")
Cc: stable@vger.kernel.org
Cc: Anirudh Rayabharam <mail@anirudhrb.com>
Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/net/usb/hso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Leonardo Antoniazzi April 26, 2021, 9:29 a.m. UTC | #1
On Mon, 26 Apr 2021 10:11:49 +0200
Johan Hovold <johan@kernel.org> wrote:

> Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
> unregistration") fixed the racy minor allocation reported by syzbot, but
> introduced an unconditional NULL-pointer dereference on every disconnect
> instead.
> 
> Specifically, the serial device table must no longer be accessed after
> the minor has been released by hso_serial_tty_unregister().
> 
> Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration")
> Cc: stable@vger.kernel.org
> Cc: Anirudh Rayabharam <mail@anirudhrb.com>
> Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/net/usb/hso.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
> index 9bc58e64b5b7..3ef4b2841402 100644
> --- a/drivers/net/usb/hso.c
> +++ b/drivers/net/usb/hso.c
> @@ -3104,7 +3104,7 @@ static void hso_free_interface(struct usb_interface *interface)
>  			cancel_work_sync(&serial_table[i]->async_put_intf);
>  			cancel_work_sync(&serial_table[i]->async_get_intf);
>  			hso_serial_tty_unregister(serial);
> -			kref_put(&serial_table[i]->ref, hso_serial_ref_free);
> +			kref_put(&serial->parent->ref, hso_serial_ref_free);
>  		}
>  	}
>  
> -- 
> 2.26.3
> 

hello,

the patch fix the problem

thanks
Johan Hovold April 26, 2021, 9:35 a.m. UTC | #2
On Mon, Apr 26, 2021 at 11:29:11AM +0200, Leonardo Antoniazzi wrote:
> On Mon, 26 Apr 2021 10:11:49 +0200
> Johan Hovold <johan@kernel.org> wrote:
> 
> > Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
> > unregistration") fixed the racy minor allocation reported by syzbot, but
> > introduced an unconditional NULL-pointer dereference on every disconnect
> > instead.
> > 
> > Specifically, the serial device table must no longer be accessed after
> > the minor has been released by hso_serial_tty_unregister().
> > 
> > Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration")
> > Cc: stable@vger.kernel.org
> > Cc: Anirudh Rayabharam <mail@anirudhrb.com>
> > Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > ---

> the patch fix the problem

Thanks for confirming.

Next time, please keep the CC list intact when replying so that everyone
sees that you've tested it.

Johan
Greg KH April 26, 2021, 9:50 a.m. UTC | #3
On Mon, Apr 26, 2021 at 11:35:46AM +0200, Johan Hovold wrote:
> On Mon, Apr 26, 2021 at 11:29:11AM +0200, Leonardo Antoniazzi wrote:
> > On Mon, 26 Apr 2021 10:11:49 +0200
> > Johan Hovold <johan@kernel.org> wrote:
> > 
> > > Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
> > > unregistration") fixed the racy minor allocation reported by syzbot, but
> > > introduced an unconditional NULL-pointer dereference on every disconnect
> > > instead.
> > > 
> > > Specifically, the serial device table must no longer be accessed after
> > > the minor has been released by hso_serial_tty_unregister().
> > > 
> > > Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration")
> > > Cc: stable@vger.kernel.org
> > > Cc: Anirudh Rayabharam <mail@anirudhrb.com>
> > > Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
> > > Signed-off-by: Johan Hovold <johan@kernel.org>
> > > ---
> 
> > the patch fix the problem
> 
> Thanks for confirming.
> 
> Next time, please keep the CC list intact when replying so that everyone
> sees that you've tested it.

Wonderful.  Johan, thanks for the quick fix.

netdev maintainers, mind if I take this fix through my tree to Linus
this week, or can you all get it to him before -rc1 through the
networking tree?

thanks,

greg k-h
patchwork-bot+netdevbpf@kernel.org April 26, 2021, 8 p.m. UTC | #4
Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Mon, 26 Apr 2021 10:11:49 +0200 you wrote:
> Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
> unregistration") fixed the racy minor allocation reported by syzbot, but
> introduced an unconditional NULL-pointer dereference on every disconnect
> instead.
> 
> Specifically, the serial device table must no longer be accessed after
> the minor has been released by hso_serial_tty_unregister().
> 
> [...]

Here is the summary with links:
  - net: hso: fix NULL-deref on disconnect regression
    https://git.kernel.org/netdev/net-next/c/2ad5692db728

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 9bc58e64b5b7..3ef4b2841402 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -3104,7 +3104,7 @@  static void hso_free_interface(struct usb_interface *interface)
 			cancel_work_sync(&serial_table[i]->async_put_intf);
 			cancel_work_sync(&serial_table[i]->async_get_intf);
 			hso_serial_tty_unregister(serial);
-			kref_put(&serial_table[i]->ref, hso_serial_ref_free);
+			kref_put(&serial->parent->ref, hso_serial_ref_free);
 		}
 	}