From patchwork Thu Apr 28 13:56:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567481 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83B11C433EF for ; Thu, 28 Apr 2022 13:57:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231529AbiD1OAi (ORCPT ); Thu, 28 Apr 2022 10:00:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346899AbiD1OAg (ORCPT ); Thu, 28 Apr 2022 10:00:36 -0400 Received: from mx0b-0064b401.pphosted.com (mx0b-0064b401.pphosted.com [205.220.178.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C538330566 for ; Thu, 28 Apr 2022 06:57:21 -0700 (PDT) Received: from pps.filterd (m0250812.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SDIFVE023542; Thu, 28 Apr 2022 13:57:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=X5z+EGd0+KlYipEv0VJhiQsMzCfbtckeMj2AGTP0QfA=; b=LA/DSpFQjZ2H/oOtu7vpEJd0JD6qshSyzkZ16qo/3nlQUlIhrlxSpl2olxGQCphqj5NJ 6qrIMBDzbwfEOzVXO0HVqpnSG8AVUhGLsa5cfSdXwM8/ds5tMp5oH0VZKBEcB6pvelo9 /HwypoFONA1SlvpjYNKjkqoxfo183phAUIgUbeK4XwY6EWu6pSKwQGUf7vTyXk6LkuNn swKGUTQ4sAclZLvuWsotn1aJ57EGVj/BrWFO/E67Or82Q723tGdtPV22f7wiMzkn7sH/ /aXi/JzjxPCCLcQw16ScLN8cqlLNas1XWRrv51cigb2uXDQDCvd+zfTLUEW1GZiao+5Z hA== Received: from nam12-bn8-obe.outbound.protection.outlook.com (mail-bn8nam12lp2172.outbound.protection.outlook.com [104.47.55.172]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fpske9cv1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 13:57:10 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gf7iN7T8rbF6pGy6JdO/xKBYcqJMOBZKq5NjZDNlpWibYoAUeAqKO51m9Fgcjl6rxldeNxLz1xh0Tn96doXD+tLcaV7DMT1/c1s7YDKWU3/CcVc3uGWAyF9jqAypL7ddJEqPXvgyHJbPomNZH2qBAusxGIFDplCpMcdwZ+XMRbaxlSP4nqGAgbV9Mqj5dWcZdfM18OiNM2NLdlp6jjb+Ti3M17JkwWB4KdxZkroSy8+UmvMTDsGzA8Z6eRVdqcPwGd8dUT38yA6dsuRKbdrAovbjdjcu8EDoMOICjcHz81NLJJ8YqynHHQDizHw23mdgt5RdbmtEndpCp/WQ26WVwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=X5z+EGd0+KlYipEv0VJhiQsMzCfbtckeMj2AGTP0QfA=; b=ljUgbS4HNkRIib2CTwNgi41AIeEgdqOpWfduO9Zucg9dNwCckbPcNEus2hUljh2h/xnUbOiRHZd1Es0ndiKRwfg8I3PYxpmfsPHN2W9ELWtZkLZ4v0/8khLjmcTW9SvLP4R5p4gC5ba2hAeG33IRa2lzVj2yxFMoU/CEduCghjAlHu1VW201N3fXHyCWMFnFbc2XR+aVq1AphxBe6MmpFYmWWy6biWMdVlAid2u8BilnnseuQojYQ0VXG2BoWDTo/7kwfprDtvth+TIEsmwQCK+I7jle78SAfq/8vxCGe/be3nVkVSkMMtoq3wMNbnN3wmUg/LgH2qs8Ofnj+1W7mA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by MN2PR11MB3743.namprd11.prod.outlook.com (2603:10b6:208:f4::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.15; Thu, 28 Apr 2022 13:57:05 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 13:57:05 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , "David S . Miller" , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 4.19 1/2] hamradio: defer 6pack kfree after unregister_netdev Date: Thu, 28 Apr 2022 16:56:47 +0300 Message-Id: <20220428135648.958508-1-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 X-ClientProxiedBy: VI1PR04CA0051.eurprd04.prod.outlook.com (2603:10a6:802:2::22) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0745e101-6231-4c6f-4b80-08da291efa89 X-MS-TrafficTypeDiagnostic: MN2PR11MB3743:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: WqyCyf7HDmVqEs2KRcYksS0vSrPTkvVRBrNnH9n2TGEkORJ2rw/cewvHHQhYJFuBAkgDmkDaEVHi+G8gkWVfFOktjtPcSV+/M8Tr4d+sok3xWeIFZ3tEBnk0h2LHy9bGy2GZEObIRPAQgCK5YUeeQ841uQ12M0zaMa5RhcMqnwQPj6bp6j4rhSMYrUC0tuffAi8qCW6N3cOVMwFBWuCgiJQBAI9fDe+NBZMELOkfnem+pw5fmeE+SOp/P+ucurdYbPW6FmWpHa+bs6hSNjKIHgJK1oKLIvq9mndgNfsenBYVRPCIsaM+bF04ayoYjw/Fb9YJBcWzIrCf9Ol2kPpEdcWwr1iE8HDLDBTlnZ8U3r+05AFamlSufMbJr+c/Ew0qmX2t7w737lG/wcKcZhLMpBiH4jEpxBN/Rw195zs8w9iF3rJEYQoR2KJSFsy3cTN64arwM/w2DS9gMc19hoyC+tPvrXPqguUexqf93FxImcKXdA7JfXYgDYOKw/Bm+9ezhIAsc7Ojt6ETAyTKOHImhwNbs7seCXyNbWhGKng5uDYbwzs2ltpfKDXmRqQ+QKZyYixp6ar2vtrtGvY0ts3hKksMc95yPzSF07TOv/u2bU9rOxfSjnMeGP5qK9xuw6djTu/9A/LtVaTuVmSsFh4luUew5GT1j89LIh8bkUcbPIMprcq+3imU3K46XYzHD5dkKQ8+kEoRfvwN4CUP5alEGdrzCmlzdd86QQfAjzdcTfda0O+22FeQAlcSeUVgqWNCYox8QE0EpIVrfj7PmdD3tYYIORwjBG4V9x9dG/qIfgQwfFuk4Yl3qDCEqsviMhyKNXZoi/MqmkjEzcN+a2itDQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(86362001)(38350700002)(38100700002)(186003)(5660300002)(508600001)(1076003)(44832011)(2616005)(8936002)(107886003)(26005)(6666004)(52116002)(966005)(6506007)(8676002)(6512007)(4326008)(36756003)(2906002)(54906003)(83380400001)(316002)(6486002)(66946007)(6916009)(66476007)(66556008); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: uVHUmZvRzLuj9LcMg4Nq8KSQVfQpLLMXXIFk7yg6NbgO49U2GXJhK9L+DNnYqBQDYS1dgwTpBtAaFvWiG5XkZImRmjTokoEbFP74BiXxytDzVpAWaD05Tn6dNSzp10GwEhsy5R4q3DydiAYw+RK0iioUMOjP9KD/4GMPHf33IeWLKMlgYT41SK7Ktn8TkLfbVpAjBVuaCzfmn/fK3FHb3bqFS3f/7zhlMVhN17kmo8I9ep4eZQRBfWbvv8qxvgDmGC3EEZefyrF66dxLH9JM+5W73g0U8/iSeyHH5v/uA93F0VntZhUNO7XaJJwQeN0GdJ5518ic62adFvMBAAFl2dcHqvFYKGIH7oHagtYhN8UTYNtD7vMVzs5PjybOJ4G1/2COwTOuZy8nBSt+vFSYj7YX0zNwZ9XJ1IXdmYeAsWby9YvFrBfmR8qGpcRrPH8CfXrvBr0hanj2dHQ5krME4w+mWemQaLBH9XDMsYh9fvEc7mvml7XDuOpj+VAx5hD9679j+DUJ3s0ShldHnHslHoue4EHiI4HAQ0Q5X+CyTMMfRlbSOJga1UuezgOgGl6lpP0/HoorFbBrBhN/n/gqslT2StgM55Oo7qpzUb4v7chSy7wD60DV8O5iwRwxJylY4UnOH3d/IxKBWkVfNLxn9w7GVQCn87x/x4SFNBBPWtdYjJgpR2USFmnpAs+N32edKuoS3ucA3aO8m2gWurXw/MynhmW/wSDZnTBoijIR1tmAb1gtXZmsBllGntRJSPfM1rLadGTWe49jXGWmoPmYwg4bobYsuB/Zo3YyJILJQ006nAkOuYO9Zl2ILtcK1dgrpiZ/pQD52CbM/KxGgw1HTyNOlWmuwDKdcP2HE2KG3pQPtX32eCYbSAE6ETaG+g5ZHLXMjmgp4nrkSq9nIRqPrzYFipB5hniN+pTAh0KMg5fbg4Utl0yoXBzOhSlc+aCZCapeSohTbCSqDBuo0FBFX6zJMML0OFPrGmOoQRrPiWO0LHTMo47Oj9k+7QGMyYZnK2j+VgaYXuDj7vlbaFwScLfU+gen7QV/khpYkt3nAsKGLzF/c2Zkmr+ToMoJr4KU4g5SAHGnEP4Iuld7kqGhXlul7jsLR3W5ImJxxyA7MNpbE9Y0e5/DjP9wAf8H0y2pHhDPc3CMrxha3nsw1acryHH5qoF0Yu5P38tZlV0U4n0/uqdlLBgzuCMxmQZJqtKULSoPH8a/2pRm7dvnEM0X0XhJ9WI6/NmSiFalvJz0dg4ZZnZLtw+0svr/XmhSnIdsny8v9xNPvDWqgmqduWTGKSgjEaYZoHfUxeJqinBoelNCV6l4tjhqujCMtsL+VRCt+emcubm9kvWL//4IJctz/6LiHke/+g1CZ2Avy1v64HKLF6mdj9nqyoaMoVJVYLJl4JpnLywdCnABzkv/x38oW14KA02jbGGvmTb+CF1EhSc5fnWgYQ6RvVF/L5thPqUczsyNcH4uAp6MYkbu3+XW0I1+U26h0103OFwFS6OCmql88G3Z1zNz27C0a9Z/SU1v5vmc1gZOJTveGS+PmPNtZ4tXFQl3QoEpSsR54Tq0lRwyyJtPKub4flhL56DTQAcl6y2fDgfKUtG+Att7HnBtAwX6M0bfMoA0sJfqB/OkXR5bZqslOLcAx+Ovq3zx8K4EtOAIFR/jwjpCbD/CQs8J0Wt9ZRDYf/IslgqKngmUCm7weKTQDvNzRSdaUFIBr8vYHdKPuaDJH/Vlhf2c14y+ETf6EYo6STiN4ifuHTp7R6g= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0745e101-6231-4c6f-4b80-08da291efa89 X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 13:57:05.6655 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: euDeYYwhvfXX8r1UdzFB2v8b+/+Ls6V3lJlQ9v0KLh0YlQ/TrpY5nUeSMSLaql0pHISSMoU7xnpElojIPLG6FB9oa9X+4R/3Uau2K9ZV9SU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB3743 X-Proofpoint-ORIG-GUID: GosL_8cuTvxzqhNGxpgIqM4urP39i3R- X-Proofpoint-GUID: GosL_8cuTvxzqhNGxpgIqM4urP39i3R- X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 mlxlogscore=764 clxscore=1015 malwarescore=0 impostorscore=0 mlxscore=0 adultscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 spamscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280086 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | 6pack_close sp_xmit | kfree sp_encaps | | According to the patch "defer ax25 kfree after unregister_netdev", this patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- These commits are part of CVE-2022-1195 patchset. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2056381 [1] https://github.com/torvalds/linux/commit/3e0588c291d6ce225f2b891753ca41d45ba42469 [2] https://github.com/torvalds/linux/commit/b2f37aead1b82a770c48b5d583f35ec22aabb61e [3] https://github.com/torvalds/linux/commit/0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 [4] https://github.com/torvalds/linux/commit/81b1d548d00bcd028303c4f3150fa753b9b8aa71 Commits [1] and [2] are already present in 4.19-stable, this patchset includes backports for [3] and [4] (clean cherry-picks from 5.10 stable). drivers/net/hamradio/6pack.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 29431e3eebee..381febb99bc3 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -679,9 +679,11 @@ static void sixpack_close(struct tty_struct *tty) del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); - /* Free all 6pack frame buffers. */ + /* Free all 6pack frame buffers after unreg. */ kfree(sp->rbuff); kfree(sp->xbuff); + + free_netdev(sp->dev); } /* Perform I/O control on an active 6pack channel. */ From patchwork Thu Apr 28 14:10:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567480 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B816C433FE for ; Thu, 28 Apr 2022 14:11:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348143AbiD1OOa (ORCPT ); Thu, 28 Apr 2022 10:14:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348139AbiD1OOY (ORCPT ); Thu, 28 Apr 2022 10:14:24 -0400 Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DD5B712D6 for ; Thu, 28 Apr 2022 07:11:09 -0700 (PDT) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SBCnXY018532; Thu, 28 Apr 2022 07:10:57 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=oLlLbso0+22WbydvYZ79DcC3J1W/dB16hp5knY2/e5s=; b=cQ1hwFXLC0KJ650lQ2D6cPhOIW3IRllszNcdYF/B0HD6bOcE1JgN9RQvXXvP6zo50Wt+ YSd6tw9Uq5rwmtbgNicLvV4UE1pEpjU8+ApdXjtKmQEZO2s+mY+x/ZMD/pFoNK+Ct2rD khfxwO6L3KKd9ZMBB7RMum5IRQ7Ianb35DSXmr76ukgKRir/7MucMpgVZRy3A6ZV245P 9zp1xE6xUdYdWf1xqPyEtCtoeUfnILeQt04bC9QSdz3QE9V6lCgJgKnEEy97Xe2bwhj+ I6UXwhBktoT8IfsiSs0Wvc2KY1MaocAnfVboWXY2BYl9KC1LIWwEW8VTtkN0YO9qJ3qx Kg== Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2176.outbound.protection.outlook.com [104.47.56.176]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fps57sdss-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 07:10:57 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SVme8LuLM14CTh+H/HXHyN2kVbWYNdWYv8gBdwFQLshrOh6p2aRSkfAM/GJwickp7LsXBPfRQ1oryvB5g2QoyzPT53NEvqZtetRdLhcec2x+L1FeSRObE2NULpEMtf/Tc8OERB8X4lfPkcNDrdA76HkzQxU2RjRS2zt8yrj75xF7Zgi4UY5NgvfwotY5l7cuamNzRzlxCx+V1JHLdEB9dfBMX6KiErYu5cHsg21pHCYiVJXKx+PL0NJxA4Opcn1m8AoAe46lko3liP1vIg0IYotfd3UAIC/TtZcKuCaji9mDQWa3ZiTWknnnaPyn+30RLQzCmc4B9nhF5Yxh7cCQtQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oLlLbso0+22WbydvYZ79DcC3J1W/dB16hp5knY2/e5s=; b=NTixEw5k76da5a/4PbzbHxpQoZTkhQ2rmRxhqSbia2wqXxDqw0R17ymUGhaUsf3XnjzdvogY++ORvI3p4yhTUaC+Pvf9p1QxQIpKcTN7xPlxTzniG+14jNYpN2LqunmzfZKhdjtpxQktk1j1cLIqTQ0oBxPuPeZKL+fgw54/wUM2Xmwv2vDhObF75/qpteQkChHEEkGqsRxHGgu85UG57WYVpOcnWGWj12HbyzagaaZojJjkvUwHUDAPHsOoT5/tGhvsSXrRDPINNRjDBXldiF5AlBIUHKZWs03SA8XBnaxUA3MkiTRPq5RJ9jW9YRe9GHQhd4zNhONJtkCvlwnwHQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by BN6PR11MB1425.namprd11.prod.outlook.com (2603:10b6:405:9::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.14; Thu, 28 Apr 2022 14:10:55 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 14:10:55 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , Jakub Kicinski , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 4.14 2/2] hamradio: remove needs_free_netdev to avoid UAF Date: Thu, 28 Apr 2022 17:10:32 +0300 Message-Id: <20220428141032.1026227-2-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220428141032.1026227-1-ovidiu.panait@windriver.com> References: <20220428141032.1026227-1-ovidiu.panait@windriver.com> X-ClientProxiedBy: VE1PR08CA0024.eurprd08.prod.outlook.com (2603:10a6:803:104::37) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 3b822fea-737f-4637-43bd-08da2920e8db X-MS-TrafficTypeDiagnostic: BN6PR11MB1425:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: K/0fFGa4ADCPEHvtuXBPitCavGVN5JdbwbUxaz1Kii3JtjOBd8cLUfoyxUom0CaUXM6Ca7eNo/ATJLAoQsvaxLB32BQr1ALLUALOTA/MrnsxhXUes2Ls4+l9jdiT+nxiGkfHI3EyOKoeGM8NRq+pzfeQf55jd6c+0VXJbP8dzPsQpAJA/NpojlGpFQ65LhXFe4dl4l2wHVpHM3jhoxmFskDfpx4jjfWlcr/l3IA4yKHkiCwJbviC5fxgIV/5rU5rRptRTlSc4ZVKTxr8qrLFxl3dRGTzS5xUGAZRdz5HLymh9eWYTMnjAKNm7rLmnPYTdBR4CTwoPSvkizDbb1Omq53E/VAIe921FpbYPttQ473uQdRZTRA2NS7mWtTZzSHRqRDie4DaKZyMQpEEFMHr/ZqDQGFlglJVsjE4FXQ6seqaYqv8mZASk0hDe6pPQ7jDn7cH4KTFNZHtSmv/S1hctaVXiMTrKoHX/W1k6ORu9DTRZWW7Zp7a1S5snsJF2kpDNdWK6gRCKEjzvRQR3dl9l7fonGMs72HSBHxIhMju6VpjUH+iMWgZIaO7mKpr+3CMdMJGrVkv18UQapePWutQsIOqXr4bPuDOZquly0jYlwl6lEPqvZtMtR9RnmvhdpBEs9ZCCQ2kj5b+uQwOIlVObVZcM1c4UHM8YUjFKVew4GKKzSXTAXN8pq7yV5m/6MSv3wlezJy/LqFliAbUM/nEZQsRodmXs2adTtNFkj7FUk8yReb0Mbdy18jX6od+4g04p/fyY35s3D6pHKhSyWBcHDYulXga5QlTMvS3jBkiPF0= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(44832011)(38350700002)(38100700002)(6512007)(26005)(66946007)(5660300002)(2906002)(4326008)(8676002)(8936002)(66556008)(66476007)(36756003)(1076003)(186003)(86362001)(316002)(6486002)(107886003)(966005)(2616005)(54906003)(6916009)(52116002)(508600001)(83380400001)(6506007)(6666004); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ISY2N3hRVzOu84vgFvHHnkWJUbxFQ90XSy68OYfiSiV5MBnbnL2QN9L1ZqphnnTOEbC3qvOTHZkG1xOcqXW1r5p2OvreCCPY2NA3aFwPwFmbKXv8E2L8IcsuhgDBwc61WAdpmQiQOV0/lmJaEUCudwXsa7JGnyTwHY345Y/2Yq8kKO2LJ9BcQPaJoKe/aPFu9Pf6fbEbx7pehrdNWCb5rtomKCQvhGNLHK0OTNsGsKRY6m7zBnA8hY6AnxYZl8ZjYusuNw+NWu8Ap7sLT8KNLrWAXzgCKT53gmFK2ikqvLRGQSqfueZp7VhKoXazulb/zw3Vu1jKh1KasKVOpDePxDvHzxBFHsVL1HAleloWigBr/lexh9oFYNGTv6v9C7gvKCgh0fQDaSrw3RWL3D5Bckz0XGMOtt8QT97oij3I1QAkZOWDEATzX4KtBJHle9h1WPlHo5xETu/TcgEeULQ8svrytOLdofRU1rapkByhMKQIhRcec/pQBwszkapOS4AWe9t6i0WAvjogA4HmEu/q4+3O060thdaVPLyrq8HtXxarFrOSapjORwuOgXnFM7BFTiiIpCnDU5RLlPjWSadTL1Vd8IhMFcIpnf7o6+PLHc3IQewQHj4t848D2s2qv9SU98SO4l6xKRK55V/hGoGWDYDGvn7oOwhSVlQ7A1qr6ObVHC0D1IwlXVdTa3/OrWwxP3aFn+4f6YG6VSbQ0Prcl9w6bnAdHlIiBT2IqZpVBBP/puJJQDO0afdQEMjawRj4OM0T3j3G03fByXU7XvAesFpPdUVldhEXTSX4vi5KCZwsjdLOEt7y+z/zl2829wZpxfwwyhS7shmKlybp871zTHO499aJsudGmXAceQTa2IQEnx7xiyqERllM/jLPXtHe0T/k/+GwwFBHPr2fAVgAZAjAfKwuPCYnMdodDQOJv5TzgizXwcj2Aue+GGu9XhBHjFVBvp7WRN06KbXt7O4X/zH86OoeBrShgG70zAw3J8kvJ50sQ9y5jwIj9lBrgEUBXkqI8UhyXXe2dfb3hDbBsbYnh3YgLfO9bzhe3Otd1TEbispELQti77yXMdi4naqFC7HrnYdgHgraD9P5mX4dmowcEBb0LeOmsPS64c+gkmoMTLhqZUbowHlkw7T7wbVC7fIxM/r1OWdyAPJ+0vy/mia4w3zaY8xYK+AMMYlxNA1ZPULvbCiuMZ/xHIZAA1E3cYFi8mnrtAE4EB4yolW2lArme1aloiCDu/pkRs/ak2z26mf7oIt3dntRy6PnAmc459G0xKfV2kHVPHnQrkmKIFiFxRUKP5BPCPkQy/EsAtuQz6xTxDiEf7nr8QXFYmDCKFYQbqUS9baRiEjyGu4OCDnrf5w3veV9bQD91xxmtCMEK5oFnmM5l7FmmD0xMyyQNebeWQCYkUnX+D74Aeiox5Mq0eAJlywFlfNQvW329TWNGtzIFVgHIrrJW1EfJSo0/n5Z5Z6P3CBVMwtriX82haDlVI8ySU+9eINNoLSpsXztVTn024P6Ia8u2kxk/2YTjeMEfwsx/Ut/OZq0tapzsFG91lyZ+CN45DNBkLve6yoDd/EldrWD5pCc3xjGwugOWLL6zKHabeopyNopvIHmQM2D3jXNS5QdUXaQoB/teni3Ka5FgDM6mvWBNL3uFbJxWjgaJ/GbTuA9VhAg6xiaySxFTm3/unjjbHfkOi3SATfeXeIgwly27+LLFIgXdDDnEnykJJ8AroeBhrwF2sL/M775rRfPWqt2KNYZtPzwT68= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3b822fea-737f-4637-43bd-08da2920e8db X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 14:10:55.0128 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: yYd/uIa+BlB2RgXGz7V/zTETK2mXRuI/XwZtqX4hr2d3H29iAKMz3Zhm8yREdxD0U117+YgyllF9SJayzLvpJccAI/KJg4Tsf7/GgwjHCVU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1425 X-Proofpoint-GUID: DtZMZD6u37FeuIyzYmbGJ5b5omfqbotz X-Proofpoint-ORIG-GUID: DtZMZD6u37FeuIyzYmbGJ5b5omfqbotz X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 spamscore=0 priorityscore=1501 lowpriorityscore=0 impostorscore=0 phishscore=0 mlxlogscore=838 malwarescore=0 clxscore=1015 adultscore=0 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280088 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 81b1d548d00bcd028303c4f3150fa753b9b8aa71 upstream. The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev = true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 7ff1c6f7eea2..2d239c014541 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -311,7 +311,6 @@ static void sp_setup(struct net_device *dev) { /* Finish setting up the DEVICE info. */ dev->netdev_ops = &sp_netdev_ops; - dev->needs_free_netdev = true; dev->mtu = SIXP_MTU; dev->hard_header_len = AX25_MAX_HEADER_LEN; dev->header_ops = &ax25_header_ops;