From patchwork Thu Apr 28 13:31:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567767 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E81D0C433FE for ; Thu, 28 Apr 2022 13:33:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347270AbiD1Ngi (ORCPT ); Thu, 28 Apr 2022 09:36:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347245AbiD1Ngf (ORCPT ); Thu, 28 Apr 2022 09:36:35 -0400 Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D14EC22523 for ; Thu, 28 Apr 2022 06:33:19 -0700 (PDT) Received: from pps.filterd (m0250810.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SDVkuJ011009; Thu, 28 Apr 2022 06:33:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=Zsv1MX90teQTJRg6zUloxVxPrTw794jwkB5q0xxZWcw=; b=KHGDAmwpbvJt//e2/G7HOK0J6sDmQXTJiPkWcXaueBb8bc7u6HlsPUgUCDthpNeqAx62 PqbSd59ALHpjZ52yevZarhrEBXwidT1T+qGgZHyhwy69yX3FP9zJ50tPQCXfGtDW2mjm LunwhBcZ6GgufqglC+hfHrMmcQljGViXIQMlz66GUqXlT+lQQW6fwIpMiB0z8GHtHc7X 8ZoUSV+d2oB5S5W7AQzEWSCDdxPLRQ1VtfVh+f4nTbbNMYwbvVghM2Y1kSRmoqKxpsvH xp37CNtxl0dwsOLbHLcqPVTG/8IGC8s34MNlmMwQDTFSXpEGBPGOh9Jv+YnCAFdnF9k7 2Q== Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2108.outbound.protection.outlook.com [104.47.58.108]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fpshjsc6d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 06:33:07 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cjog+6L+r0hcjLswsisCi5oJUlqo/klek08u9SfRMEvrRo65YIity0umTdC5VByMWMmG2jVX7cn5YSbvOZVVl0zbvje7nSttXKujCpwZdkvZFcQhPUaoPMvvYNQ8tU/kEm2IwNOdMX9uM+TFeG4Vvod27KePG/qV99yIuYWATb8FFEHqrqwFPBL76ZYyfaFy0kMj7gPdj+pEiP9qlpltTYQ+I7d8Cu6QmltKPcdIHyM0INLkjXfVWsKNm/s/i8yJSAXZIQDXtwZzV3Vzvvihh+DmiuaKUtxnK2CRMB6TE86CbDge4bSzk04GQB1UIQMKdwFXM1xbqg+hMkVTfkMrRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Zsv1MX90teQTJRg6zUloxVxPrTw794jwkB5q0xxZWcw=; b=UEFVFeDFadafRPRS0JllZ5wCAH4FOHwo6QeLBKfzGveS+25L66WYp6QSiOD7N2iGG6cC4H86eBZeBDL4hcxrZP1KbAfGecqI6iJq/KiBsknn4W9EJ0O80dwWH7VKsMvk31382TvIqi4YpBcl5oSPkp0lxPljrp//je5Idmv826XGlYQtcSSEY09Pw9LOFnL9qWHTavanoCYdz/FbwHQtwhRJvHqzs4473iImoTDn6RBakLQQa5l116Z18SAtq6wREk1cUqfSnntvbyktPzZdlESKyXM83ucU/ogUP4kS5Ukq+MTJugfs7fXOVZaLd9u3iMEkGf9rzQy9w8ZNyWngHw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by DM5PR11MB1467.namprd11.prod.outlook.com (2603:10b6:4:a::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.14; Thu, 28 Apr 2022 13:33:04 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 13:33:04 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , "David S . Miller" , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 5.4 1/2] hamradio: defer 6pack kfree after unregister_netdev Date: Thu, 28 Apr 2022 16:31:10 +0300 Message-Id: <20220428133111.916981-1-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 X-ClientProxiedBy: VI1PR04CA0120.eurprd04.prod.outlook.com (2603:10a6:803:f0::18) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4b799287-07ac-47f7-6acb-08da291b9f69 X-MS-TrafficTypeDiagnostic: DM5PR11MB1467:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: S42v0kgXl23962pD2eNBAn1cmW6Td7n0of6yO8Kx4z4iNF4IUFFaQlmrGVd296XK5EUfCpFZbo/Ew+Zrv+FVeGfJf+WRxsOtUf1i/LQ6YCwTkHjzS102XvCzJTItz4U9a5FB70zYdy4rvbgWZLOaktpUNb1EvrsKYHKeOzn4WgguE9xWKvgV5veeu6s5UO/vzZiMq/LBgJFdNA4C0GX554pkLUtwMlhvEwI2fdX5YHqYYBRhVFSTHgiL/AVJxPav7fo4diHNgd9R2nZzvU4gCHhU3vq/AnHrDBdnpC/klFQEkLU7J3Oov03McPL/FoIUCaEY/O125sWnwwF3EU+0DMs84bkwom/SQCm+qxtaf9Gu9aGbovvKCcT11v7WNf4PyRNaJ82tMnPgpIjdxq/lwYSVupFZAeCW5hSyHvv23gDdYv9dHFgimMdBUBqUI5nlJeL9KoYiLj+aBDgppduR/ZRYS/F7knHXAw1l/fg7juXhdyWCB2Kezkh7npfln+e0cn+IA/sCH7JLkzDESM5dWIDKEIfQIbB1gcZkghcXWT1fgXygRlKAAOX+FYwTv9y8PNV37MUcsI1d2892dQmjenQMppiqDrvYKdkPvoULZzMZSBRx/0rY5dyWxWOMWRTARQedF+dNB2ojsoeXyJqLN1EBdUCmyaRQYvenYR7zAajXpumajv2y8IQG1LG3ORRGavuu4ZZP61EXeWEWD/lmtE8rFlRedFWjvg46rgrpIIbpw82iI8UbDV0Iv8BaQrTga+J1qDGn6ySHiqL6NGmugB1QzwXTPD6N9hf/atW6II9vZfSLHMByaTQjVhmh9+d9 X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(2616005)(38100700002)(38350700002)(6666004)(2906002)(6506007)(1076003)(52116002)(44832011)(107886003)(26005)(36756003)(6512007)(186003)(5660300002)(83380400001)(8936002)(6916009)(54906003)(316002)(508600001)(86362001)(6486002)(966005)(4326008)(8676002)(66476007)(66556008)(66946007); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: dwiT34XovY7LJPY9nGddgLCdMHoGQ8UenDEojJjifhNZ1N215+1yx6E7dcGCpmllFAS3bnNBn2n5BpfXs0W2USSkQA5bgw3Ww4Qr2lYZa4x4JJFKR9zO27/LaayIOusFw6MFdGEe6iXq5QG3lIX7C9gqJzJqJ/qtOtmfidpuibPynGV0H5D2w3N6On7uujqyf6FQJieWCwx34HqWyZP5oK/6WnS0xV+/RJ6wRejOqDkFzK2vnI+CHn3AL5oUHW7kE4I1Gt05iswmZxqexROxC5qjFn/MGyGGWq/w/CR+XIQvdgdyweO8X1V/VIwiWKZyo6HeJh+Mv/Xl0HIcPL4NHJtWVtXIOn1BpySpQcCss/yoxe9wd+W8VAxIug8Zmeoqk29NfBqjS3EEN6wVCkVWX231yzWmfC5uimN2PZTmrgpbkSYifsN7XUUOMFV/lDhQ6p4bt62nG243eJJA4ujcJX5naw2JRsic6NjKjCOl0jlRKHdLDySLylQJiHnlqsWKaKI3IkDwTyic0QewEwP356jZY8307F3v9DF8hO+Fr8vUbmzMmV5dXdRb2t6oDSvfEFA7lXRmmJLkHlJv7hhdsMmBU+BYkDHStUVtMYMdV/JqHOTPAEinuZFDlHjrh854ZjIT4wIClR7/zdqlwqFqZXvOZtHs9EE5Nt8l14LBLPygsWC4svFK74DLpJJf8rFaPq6Iicz6iXokEEcZj7c86NgQMs74pARKd+cI7mJ31epJ5i/uGgXFnYOoL95zBcuUh+kirHPPFIyguUWDYYROWWOgNpCxhunS5IC3/CSXSfFQOeWEx5Nap5YaALo2fX/D3Hu0tpAx3oCE3DwLV4BNjYjsQZa8XVgpZpSqAlBr56LDCfK+TeYlqursaqA1EJKZzIyU82aislDmIT5XO+aen1C2/P/07ov7Ui4aV2xoMdbeayDM/FdhRrtryukEoB0jc7mlwkhhcD9pX+QB+5tPfyS/HoIfCEvIKQdC3aMvr3JW2lyCkq7lbsl9fh9qQdaz38ejtwLtxcNh/tZDS5zHuycJdZDCqEyP46CkTRok1adMepojQEQjMO4fTyB9vP82wBurccpItaa7jajGfrQMWdwxOxOXi1wf4H82bGB1P33UdmSTFz2ODvfX8xQTez8fIala22I0TPhhAN+PQHgYdSgFuz+uraKppnSMgyMYflsPH6ixoO++ZMuFW1X8MaLvBP3CJITzPuCEgcbk1ds/nRCQxKuQpEMMi6wjjDhzdKqfrsfw5BlWrPSQzNAsY+HglHdUn0xTxZMiIX7XVlhl3Dzhbv7z3PxM3E6PfgReyYqBLwL1HD5JC7RQN48n+ViCFgYSWDGFPtlrMB8zddrxCUYIrZckpHWOBfK6ZGLgKt2L66Abt03v6aqcQxpitHnRLU5hy9yf/segr8VXWhm/vTDgUMPxjk0Adb65V/QnQevyGtrqE/zAg3gs6FnYA1pUw00sZ2RXnypGtxKqcUo2OcWMnVlRv1M+QwywtqUGrmpPCUXMEIucWXquC+T0aG2MmRSNmWZuFwSPtUklY1Rs3YscKkgtKYPaDkbWVvSt3I+tqlzfJYw1HFUNXquZMUnRUUd7Qz6wev3eyLzXQRMRQcPstpGIYaaewkRRiTND9q7SH3NsdbZeCVBgtKHCPS5kSiYwVwRB4DCPnOzCpO+/a7wl7r604ISDzAY1avXhHSb8w0VocJIOrxhIYTKvws9D+EGHxihqWVD2jxA9PB5aqR45xXalUFc/r8Y4qAnJkPk= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4b799287-07ac-47f7-6acb-08da291b9f69 X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 13:33:04.6687 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 2zQavv0vVHz8iUnZ5n93laQhnsnYj6JlqmpD2f4aTD3JgthaJOFtJRF5vfXTP6x1x4nEVi3hEMaMDjL27/JztTgAUELD9sxEZC00mimGrjU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1467 X-Proofpoint-GUID: WWzCYLAr9CiyEWIeREHW8BWQcAFxOzpX X-Proofpoint-ORIG-GUID: WWzCYLAr9CiyEWIeREHW8BWQcAFxOzpX X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 spamscore=0 mlxscore=0 malwarescore=0 bulkscore=0 phishscore=0 impostorscore=0 adultscore=0 clxscore=1011 mlxlogscore=764 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280083 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | 6pack_close sp_xmit | kfree sp_encaps | | According to the patch "defer ax25 kfree after unregister_netdev", this patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- These commits are part of CVE-2022-1195 patchset. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2056381 [1] https://github.com/torvalds/linux/commit/3e0588c291d6ce225f2b891753ca41d45ba42469 [2] https://github.com/torvalds/linux/commit/b2f37aead1b82a770c48b5d583f35ec22aabb61e [3] https://github.com/torvalds/linux/commit/0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 [4] https://github.com/torvalds/linux/commit/81b1d548d00bcd028303c4f3150fa753b9b8aa71 Commits [1] and [2] are already present in 5.4-stable, this patchset includes backports for [3] and [4] (clean cherry-picks from 5.10 stable). drivers/net/hamradio/6pack.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 02d6f3ad9aca..82507a688efe 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -679,9 +679,11 @@ static void sixpack_close(struct tty_struct *tty) del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); - /* Free all 6pack frame buffers. */ + /* Free all 6pack frame buffers after unreg. */ kfree(sp->rbuff); kfree(sp->xbuff); + + free_netdev(sp->dev); } /* Perform I/O control on an active 6pack channel. */ From patchwork Thu Apr 28 13:31:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567482 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC9BDC433EF for ; Thu, 28 Apr 2022 13:33:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347277AbiD1Ngi (ORCPT ); Thu, 28 Apr 2022 09:36:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347272AbiD1Ngg (ORCPT ); Thu, 28 Apr 2022 09:36:36 -0400 Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53E89674C0 for ; Thu, 28 Apr 2022 06:33:22 -0700 (PDT) Received: from pps.filterd (m0250810.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SDVkuK011009; Thu, 28 Apr 2022 06:33:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=CpIRz8I+aNU1NAv5F+azGnufrahGImcAu/jN7otehdo=; b=sjRR+QmwPPUIN31ndsAe/8reFC8HYl0InM1VXNYTPrLiQjnM5NvE3I6eeSVvpQZRz1sY Z/Mwqr1/DWbTUM1Az7Iasq0HwlePZXbTRlfp55WtpQ3PWs8d6Ezt080TX10Se37Q0Mz+ tRzE/PeqKuibMJMPrW+/uC9ULNZSRbkT61I+t5SjNTIMu/TdXzdAJwKkNlhajaP3lGoc l2hSKQ2Q+88LdGbZg4bhnYsGPM5tzr7y/8z40Pxmgnq4luSCZa3K+9nuUNjMOhIeMM8o uOeXL+PkcwLcyateFG1ehE37NR6cH8HCvANQxuXCJelRRiK2v5rl4qCHYQGtWsEadh1G MA== Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2108.outbound.protection.outlook.com [104.47.58.108]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fpshjsc6d-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 06:33:07 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bkrw1iwiqUY6QfKTsgGf4sEPn7GAv+c7Tic5hdXHuMNP5rvLqgHm9m/YhBy7OiR54PaAs6DcZJg+G94xznD7GedPrPPcMEDj4Ra0ZP9VP18NrBYfJuyVpsDlJxiAvWo9RYX1UcpM4vatHb1mEQZZ/7qTQdOb/PC8HQbcwmlSpdsNlMd2IGu/QfexgWpTdlTev6QOm59I+OCHCpvM4TOcaJ9iERLNZlEko0wGDqHQBxEb24SADlGY6VQOEKDcWfm1TyCvvFswPmhnHNAru6PBCyYA1h7yYDKaxMQs16qy0rw61RLwf7a1i3rZwPnvaY2xejOQk7AGNfFSmOzKEyxqYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=CpIRz8I+aNU1NAv5F+azGnufrahGImcAu/jN7otehdo=; b=mtxyvu27OyWNVEmTW4G9GHkaTSE8s9tz8j73d+m3Iwu/UJ01cFEHSzp8d00LlNwIpk1UgV1yF7X9QZkcG4BYmJhsXhJYpfQxDv69ZGoMcYpHSfx7XDs0MTw7ArXl6+vg1s+LlNPbCGkYnksYekUAzrHxrdJ9EgbpPS6cs6e/yc9QeYLbpoISkqze8Vz9vl4rVmx3bnnm/rSmSI0poRNXIJDK1lCSGdmBViKYZsMLYPJHMpBwsbE67JNsuTVb/HPMmo8+o2zEQFdYrU61oUw1xvh5/aDL/sRR/JI9uhqy52jN/b/MSXVYdyNKEWoTUivBtCdiJI0dlDjAYSwcGyPICg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by DM5PR11MB1467.namprd11.prod.outlook.com (2603:10b6:4:a::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.14; Thu, 28 Apr 2022 13:33:06 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 13:33:06 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , Jakub Kicinski , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 5.4 2/2] hamradio: remove needs_free_netdev to avoid UAF Date: Thu, 28 Apr 2022 16:31:11 +0300 Message-Id: <20220428133111.916981-2-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220428133111.916981-1-ovidiu.panait@windriver.com> References: <20220428133111.916981-1-ovidiu.panait@windriver.com> X-ClientProxiedBy: VI1PR04CA0120.eurprd04.prod.outlook.com (2603:10a6:803:f0::18) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 36194ddd-a09e-40e2-6b2a-08da291ba0ab X-MS-TrafficTypeDiagnostic: DM5PR11MB1467:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: jii85v6M8LJPzwp/w6JyRCntl+3cScTs13zx6WBVJdtKUFbrP+GvNn/pW13lDtlS1EUV2xTOHoSHfbgOxYAYfA4s3R+mCcwJV4J9SPVlD57LomEaCFAMGduLwm1vwRUBL3TJIJr/I/4BxfVcxPilvdsIanijUD1M6XCo5Q81kN4q85+cPrXiGOqlDgFzOyuEBcvERExYq6/HzgKBhV1tJj3r3PaJQreyJ/gLzouA1bdZb55k1RfpQSjZJnhAmydeeQN5I5OujsM+1CIW7Qw9VICbgr/Eah08FE5K2nAtoJ3/55aOjXPAxh40uyJd1nQdvl6t8mvXDKkejf5igQa5RIbsgIUaftoM7egZOjROEHVtqliudHBNlj7l/AjBTA2u40510zmRzM+58+Vkz9z6tSdZM4yK8nIWVCiy7rbAMfj4+3Ecrhl1CY0dsmFsfmbJzJXg+9SPzQshRJLS7P41nNagQaX5mO8KYdeByzVGUe/3mxq4FYdtYmlA9pRr5yME3CdfPsp04Q9IY1cR+ucJ02V6P3J7A1cSwcj6P+huBlZPZiZFRQxFm4ztjmcem3g6ZVNuhdnAvw5VDBGJCWZgHJm0AbNhXUHtxY4Xv8mgUI7lo8hmN1CCdko8YDmHFE5sDPcCk2IfFKMPswjIEjxDad3bvc0qOh4Jg6MOzQB3LcRsV7HBusYwlexOojcYmH3qgsueyJYKjevGTFp/Z/iXQzS6TyKgzhETxnifItpTYe3TyWDaSEjknL20YbND1n2iJPrF0s2FIoh5n4R1SLGj5uUjRC+TEC1Yi914IzKCKDA= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(2616005)(38100700002)(38350700002)(6666004)(2906002)(6506007)(1076003)(52116002)(44832011)(107886003)(26005)(36756003)(6512007)(186003)(5660300002)(83380400001)(8936002)(6916009)(54906003)(316002)(508600001)(86362001)(6486002)(966005)(4326008)(8676002)(66476007)(66556008)(66946007); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: sN+CfLaqLjTFK1z9mjRJODWT/OWVd7JNoHbctCr6OBUqGgm1U7r9ArpOtfVDursFlnNBCZ5eGDJGythwAmZfQ0IGpUNzEAIruvdDd2BGslyQZ3H2zXYUo1mX0daVhkeOx61PVJhVr3wu1vvOmP/YGp7V2c2PScalzuQb880/PeIDdGX5w0K1CUDkRjEfDjoNhEgV7uPc35UhmtEEs3u3uynWBbNTZLUWlqaQQBymyDQHdHI2ttsDjPP12syzfSw5dIAZcT3gSoPuz3M2Rb2DB50S7xk1U8cWCwDRQWd4d1qU/NJzm7O1FOBqa6Q+jvzA6zI3J9ZCoqk/w1xEv6Hql2041sjshA/oyNpy4IBvU1D+ZqQR52V9nPMwYceDHtm89z2blMeXij/lyMeihPr1wa6A6KQ67Td1Jzl5B82zpfARL5nY7ELJzq9H1sT2qpq79ddZ18IVPUbkn5WaXRUgIZGxx3aDbbaWF6Gr3QK5lKe3Q93JPFX0mgQTTm8TbHEGcF/I+AaLZU2p8NP951+hb/6QCg3wO86LqTL1uhsq4vJcrdOheOd8MMsaoyD0Nsh36Eu6AGnddbBckF7f1HmLQNjEbxT1JscMxyIHjcNu/WBRv2NQsUMqNReYwkmH2BJqslO1MzOwZdNSSb8UxqgikmzHp/v/zyLxJYWpxXEInz0tRSjY+7VExJ63e2Jbt8zxAQQ/xsmNlmBeLT3p5FrB5CRpcJogLHDr+ddMzO3Y2BAORG5+UbV+cVQ/tbYCD7LYQ3n2/kDO4zrkeVcHYh6bQH0QBWp/Y/wb/XC2qONHVaZchBz6SrqTeoaLG1GCxBiS3MoW8SMLG9/lSVMVmeixwR+HY7GtCMBaHgPC+/WvsVluuKYwW9K6/sVKwsaSaDJVNlun3y1h2P5MXAi8IvGYDxiw1nesYJa9XS27wEZVByRDkcgQTQdSCU6hBrs5PzDwHoWgACsv7l6S1zesVNSbxDAyoPCSAjuu78BH3muR/HdNABLUcDWSc5ViCcx3IdDGFrU/dND8EoBU8cu/LptwjDsKMyTCriHuqFUF/DxKA2ZihnsHWf2D20AiR2FlZ9gF0tRJ9pc4HDgiizRm8UNm12WrPZkixHMvRf4oIsyOLOqd2BpBqxJ+rWHyq6+KgugXWUhEESvtbVMXAXK1Lvsh4dsAWmzlLVo+1ZCzBT085653pdGkbE09ZDsBj81kreLeuQwAFX6wSNtuokyga9cCtj/1kdpuQ0jUrIZEirwSEX9qEDnf3Dw4zyuP4YYvBswImOQxl6kgrYKc+AI9Va/lciKWqI5N0tapuS4LDomy0N6wFqadpx+AUsWlHNo9Ld/3HJGPNSAqk1zCta05sOwDABLhO9q5bAcXwq10EegqVxpztUaVvUU0SrcI0HWy14EPXAxmbP23rNGSd0MEfqIA3USL9KsNlBHv4a5GIagi8Ju9LAE3tXJYBtmabyve6758nLSLjdzuO3WIS6aELoWqYjdsDKxJiuggQo6xWcPWrNjyOriPZ+1OFr6/XTWkopb6FsYXIxv2qeKSSU6EFABm+FoD/Yt6Cg6a091K+0V3P8UjUZVvmpqzEQLtYylG2U2ax/WyLhq2bJSmCVijEZDaqgNOxTHHVskhnUOWPDQnRCm1hr4a7/jZWdcjsyXkNY+bCpiwYNu1/D6KWCIPS7+3OR0GQ0MOswFae4MYGvc6BqxLQ/Y6nzh8evBjChvHgZ5fOaPZGnyNSbguqUA1C6YelimaefMnk651+QtGlniFGwY= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 36194ddd-a09e-40e2-6b2a-08da291ba0ab X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 13:33:06.4665 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: EFU7FCiJda/v2NoewrT2oU9mpkagXFEy6szzT1/1xVVXF8G/4t+TKpGFGH24ByLhOC1XdRPQxVVhN5Ems2iAjkDJvzPSIwE5Cyki86KOTA0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1467 X-Proofpoint-GUID: SknsB0V4kMsRZ910KW1V7o-qNpU3oPND X-Proofpoint-ORIG-GUID: SknsB0V4kMsRZ910KW1V7o-qNpU3oPND X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 spamscore=0 mlxscore=0 malwarescore=0 bulkscore=0 phishscore=0 impostorscore=0 adultscore=0 clxscore=1015 mlxlogscore=838 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280083 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 81b1d548d00bcd028303c4f3150fa753b9b8aa71 upstream. The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev = true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 82507a688efe..83dc1c2c3b84 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -311,7 +311,6 @@ static void sp_setup(struct net_device *dev) { /* Finish setting up the DEVICE info. */ dev->netdev_ops = &sp_netdev_ops; - dev->needs_free_netdev = true; dev->mtu = SIXP_MTU; dev->hard_header_len = AX25_MAX_HEADER_LEN; dev->header_ops = &ax25_header_ops;