From patchwork Thu Apr 28 14:10:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567765 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2374C433F5 for ; Thu, 28 Apr 2022 14:11:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348166AbiD1OO3 (ORCPT ); Thu, 28 Apr 2022 10:14:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60032 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348129AbiD1OOX (ORCPT ); Thu, 28 Apr 2022 10:14:23 -0400 Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EB8136FF5A for ; Thu, 28 Apr 2022 07:11:05 -0700 (PDT) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SBCnXX018532; Thu, 28 Apr 2022 07:10:56 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=eMDkGQBNa7hgVy9Y1iS/MobLGWjQN+yazfJbaTb+BTw=; b=HpV6yVnvt0kPoTgijgGqYJjEMRartzitmZ2O2A4DeUXCTsFkbCNzDKv+xc4+nnHvVjU6 CJe9Mz6Bk7Z2KljAkru7mXnSnclZ4DX/b+2Nf4Qz1pSUV6q6POFLEV04/sEPuTEXkQQe AFPgYhD+MbCKpea+0lgUMcgigX2Va1xWvUAVpD0OTf4iTr0Cvi/jwGXDnE69ceNVfXf6 foa+CPnrOI6JClC54BbZHcF5veTRXOh24XqahKMwdbfRQrvQg1/2Tl+N7rjJKcFu214f gNC1Kd87kOtfESrriQ1IY9kOGbDmULcA+Pu3W5NUstpT+49Kp8vGpgpuVl9u6wGWMxdO 2w== Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2176.outbound.protection.outlook.com [104.47.56.176]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fps57sdss-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 07:10:56 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HXVr1cQqEWAP7NBbh0aWDOZkEga0v+9BMDaOjT9r9kJWM4eNUoa2FeEVg4fkmFLhjEkjGnHahGWmwNCWN1zRGk7jNjqVwwQvCJjTGLUlrzyJvd6n6atCDuJgL+TTBUx5VZfahQtRZn6cs7nh+ie6GdxieYGLzrHeBRIsD6fMu3xis2qCzpQsvrB5PH20x0Whh55PKB02VqMqOEE5a2rV9PAattOMAZzEGsGlXmlpJYbRoDfs6pKVj+kdtIAM1VPcDvpCXmuJXbpNKdj7GObQy68Fz89EuumAGYpMBn7lAx4pIKF+cpM2CliVng/6K9W4RolTrKujV/YMCqlu8NVyFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=eMDkGQBNa7hgVy9Y1iS/MobLGWjQN+yazfJbaTb+BTw=; b=T9ZtxH5PeQm1RV7LQkGDl7iDh4SltQ19oZRQliIyiSaPurdPtrZUP3bYvmdb2P5ZLW6UsZDLWEFg55Re/OO7PNgaTBGPZPFwWhoX66i2GQfZ3g+blG/lFaHGZP6FAeT67JF61R4BSTwjOyF/eW1GCafhNY71db05QaUVGzdJWN9bnzlOVQ+nvvKxuufJBrrV6ktHcW0JCeIxsdL6prlidPeaxImdzGd4Y7WkSmkBmAmkriEiYWQGsnZSWwbqxDgd54sIEhyjGy1jkCyoFHQXtxU1yjHaJeD33EOYzCyWjUOjIUVRU7Ex/KcDKN14qVPdvqkoee5u2TfBHfRFR73YRA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by BN6PR11MB1425.namprd11.prod.outlook.com (2603:10b6:405:9::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.14; Thu, 28 Apr 2022 14:10:53 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 14:10:53 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , "David S . Miller" , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 4.14 1/2] hamradio: defer 6pack kfree after unregister_netdev Date: Thu, 28 Apr 2022 17:10:31 +0300 Message-Id: <20220428141032.1026227-1-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 X-ClientProxiedBy: VE1PR08CA0024.eurprd08.prod.outlook.com (2603:10a6:803:104::37) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 773f047f-c25f-437c-98c9-08da2920e7d9 X-MS-TrafficTypeDiagnostic: BN6PR11MB1425:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: uXlZpYCJCgKIMz9TERBCRk8ZX4c9Xk4+8wUjS+dotW+bKkDhY+PJllv85nKTo74DkPWbWgpPNYK4rfJjTSDhmayuz1LTFPrFHmVqIxjSWa9M3XS2Y5Ra7KaiOr1WGCnWJY0vx8S+Ssr5DepRb22BMItUBg/bw4cq57Bk4pXvnwGHVpbT7Iu/LQh3kRcg9v9OL9njgm2X8BFlUqZGgXUC27fg/EWDrdI/TqPDwnTkx4n1auzCOVCGd4wC58tcU7OSgeoY2jZ1onEWMHliVpe+uOds7lV0sJWavZRuroViBefzwFJAjOcFJ9RJ1JhhyvMfdutsjKQLOOtkkwUQAA8Cs8lZjfnMQCbCCejdXM/JlOToqoTgCC5N8aJqIAHSsd5hP5E5gXeZaYEQnxM1eMhlp7LRzFjPxUdzJ7G6rLgy711ZAKHfxWTpED2pXz8al9xGbn3HbD0MCeLAnq5qxO3/N9edR68fZkeA9gl7t2Jm7mkgooBHd9sFcoOaS5+NqeWOMIFMHCASMEoQqeDyFbtzKp6tVg0kmIm2RC60wUKEx08vqTOHp7eKlOgIj5htWB5xJpP0XRMQQX9VvWS/ejGIeMGqh0jPbsR3Y58xeOkU/8QERAfQ8Kjo3kiND2OShhgzPgyTRNhRO9g2S006nHnJRuq76gNeF7eEARrCd/a+bHA2/vnRhxy/4JZ1s73nAEN0nAGcrKtfmjfBrkhfwa72HomwqUkEX6PkQKDhW3DNo84aLyyBT1C8rQJAXo45HC4PL9c1flyt+1rGvIuswSk/9v2QTo0FdU5vEfF/e63J6ewKQqHk7icv1izsTNPKRE+KZDXQa0glekGZqGuUj8pn+g== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(44832011)(38350700002)(38100700002)(6512007)(26005)(66946007)(5660300002)(2906002)(4326008)(8676002)(8936002)(66556008)(66476007)(36756003)(1076003)(186003)(86362001)(316002)(6486002)(107886003)(966005)(2616005)(54906003)(6916009)(52116002)(508600001)(83380400001)(6506007)(6666004); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: R6Zn1ljXnQQIc9GKGuxmwFxGWlDyzOOQ4O9+EZmcjwm7C6J7g0J1z/Y9eegHEwoh6PnPgNHD4jrAjaTI94+GcKVSR6Fj1fZhr8EOHae8JJOYqaT67eElppTLB/zzX5Q1+Mb6kFbvmgJELrFdkl7WvsSkSuJo1MYM3s+hQLnXeTIXfTWJARa66LoUfJirJs133e9ABRea5ezhhOSx34FZsPFsPRoravXiMQ7Yc1PBU7WAgn9daBAVp/4AiLGUJGxw5WBONQ1ve1kZyr1O3VzO0HoDHWsGjCN6tyXIpwbpVA2dQ0wdf1bs5BRBeYPIdE5sOAvhRnx38GDp8A6dslnNQKk2aUfIV3wAWDdLk8WaQP9OnwPjEGZKlkMUQHN9Qc1Zhry2Iz+oz9nK43ppBAoSpSvmCelIYg9GE7ZG89VCxpREQEyECL4zTm4Wdt/XxtYFRQOErSxwjubGfTVQ8vXcGMjEGacj405wQ2pmsug8JUNtlOztlrlnWnZR1DoZNRcSVQwvzkursQhZtZb3AWXL3vPMO3iZNJThMsDS7VA01FKgHcX1kncpi2Yroh02T7vfSuQNmkQoo4ZzRIgEejLGdzGr9LsdRyiHq5dHr8GQ0rBrpd4yIl+gx7ei7cJ6FHIWg7dqwCeG9aBwFedTa+9n07s/X7gTxafXQiJtKPxgMnJdiDC4fMWwQpO78xzYc9vIuS7N5160fgaXDpq2l9s82cafjuFcqf+FvXNrEZTsWaox6/lQtW0evXezlz4gOOlfg+VrtnAs5FdHuqZGvypYhj/rRxm6KW/9jBzFgTCWgbrhAgYvpTSi4Di6AM6Vl48KTvz/iOCuZDXRm8Dkh2HrRm/lTFwFkj+pVejRJ0JFG8PXcAeghXcQeZkJ3x3nmVU8fG0bCMnkD1ZcnFy4iTGgrCvOOLbZL25mqZ4g8Af8C2DKMTpRwwnH+w7OA8uEjnxjMZfTAneP8WqQDE6hkNLE5hkz8IRV63fk2FKWrPSBB7hcRYxR5amwq/yFdrMxHqT/vx7vFQ+qQ3Q/GFu9XOEOj3MU1gDrbp4JnMiyG2SWaohhdp50oDOs59TY6pjU+fcVpFYu+wUn6qZKPvC0k0w/RN9+h7b7ieFU3OkjMf9vSp2/CkUT2pxGVCufAS0uBR8cW4DaDwSNvhFcBLIz0L+vxPe2rhXb/HtZg/DkkN8DPKkjAZidIFB5OO0DmNtnUFbzj5nZngCLSg/VDMkUuyxGw0oJRxJ3MApbS+ODXHT/PoNYoaA5Dg1hV1Fvz6mViOCHfp73/EjQXHwrihtKZYFHRI04VfQAzgEzdepygeAGo4VCroWAKWJP5tMv08mm7XqZPf2nGAKD90mVNNgplgwoO1HAgr/slUat629CriGOxnMAXd39ji9JZ7OPuKYlsTb0wYNEkyH9e2zimS3DCSNEmbWOwSC5dbbT7CUKIpKVtY89YMECQ1Lr3LDCbqtlAjqBuk24rUR7fw3OmFmIeDgxvVU5+BvK1scLHWn6PNjyF9OSnfmTB202RyPfIU41wv4sCRFI2uuLEAbMen3q0nox7LulieLhKCyNfeHN3U0gOhV3VzDV6mFspGC1HRgFcEV5RDzw/KJjl0XVQ5dPhhtC8WeZWiMaiceethxiEVguw87aXWjoRVdtMSKXNfQAZ3Jdd2f7eGAGYedE9rKYMsNDxhz00wcnlwwwUKlNyg10tMy4ATiMAdk3rQXkwcsmN3LYQgZ/XKfFrODt6fYBmVrk//cB5EedOk0AvBDSOhjSmXY= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 773f047f-c25f-437c-98c9-08da2920e7d9 X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 14:10:53.3242 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MdzhkjB77pl9L8274BTxpmIv9TDchuo8Q9iEkrCgw7kachGFB7tIafgwpG8yv/z+LvvYDaw/QdgctrghGSOKui631SXWWGcT5dUymhkepGE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1425 X-Proofpoint-GUID: atvGlhTz7RD9V2tkAWUSFKSeakdAfttn X-Proofpoint-ORIG-GUID: atvGlhTz7RD9V2tkAWUSFKSeakdAfttn X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 spamscore=0 priorityscore=1501 lowpriorityscore=0 impostorscore=0 phishscore=0 mlxlogscore=764 malwarescore=0 clxscore=1015 adultscore=0 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280088 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | 6pack_close sp_xmit | kfree sp_encaps | | According to the patch "defer ax25 kfree after unregister_netdev", this patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- These commits are part of CVE-2022-1195 patchset. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2056381 [1] https://github.com/torvalds/linux/commit/3e0588c291d6ce225f2b891753ca41d45ba42469 [2] https://github.com/torvalds/linux/commit/b2f37aead1b82a770c48b5d583f35ec22aabb61e [3] https://github.com/torvalds/linux/commit/0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 [4] https://github.com/torvalds/linux/commit/81b1d548d00bcd028303c4f3150fa753b9b8aa71 Commits [1] and [2] are already present in 4.14-stable, this patchset includes backports for [3] and [4] (clean cherry-picks from 5.10 stable). drivers/net/hamradio/6pack.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 3d5b2b4899ec..7ff1c6f7eea2 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -690,9 +690,11 @@ static void sixpack_close(struct tty_struct *tty) del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); - /* Free all 6pack frame buffers. */ + /* Free all 6pack frame buffers after unreg. */ kfree(sp->rbuff); kfree(sp->xbuff); + + free_netdev(sp->dev); } /* Perform I/O control on an active 6pack channel. */ From patchwork Thu Apr 28 13:56:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ovidiu Panait X-Patchwork-Id: 567766 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4493CC433F5 for ; Thu, 28 Apr 2022 13:57:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347716AbiD1OAh (ORCPT ); Thu, 28 Apr 2022 10:00:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231529AbiD1OAf (ORCPT ); Thu, 28 Apr 2022 10:00:35 -0400 Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 715BC2ED5B for ; Thu, 28 Apr 2022 06:57:20 -0700 (PDT) Received: from pps.filterd (m0250810.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 23SCOPGt008894; Thu, 28 Apr 2022 06:57:10 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=PPS06212021; bh=mSHQPLE1tL0y2QFgOK2qSZ5zYRzWJxnAgm9IlF8QJIA=; b=kM5IKkPfkB81h2ra/ruIZQ217stxGvWG3bSRSn/izeG5VGVpRb0MiNKSzV+jrz00r7kV NSrWboDdqVeiTSLE3Ci8WjJ5sujkQfZhvzIHuygXyk6JhEEe+2QTKTj8i3q4uTSIuH5f XjnhI2oz9wUA/EP89exHlTBCuBU3xB2LOkOi9dKTp3HIcnYYxN3GzZB+8zsNWkwBXNKI FP8L5hgJus4CkjUklkZx1LKfYlqY2CZ0I3YvXyWt0phPrCl4IsJKGqhKCr/BaacxEG4t VfemIF6fl8Eac613lB9rU2ew8nWJIuVIVnHEWOB4XkY905bjcgijegS4pooOa5KPDxtW MQ== Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2177.outbound.protection.outlook.com [104.47.57.177]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3fpshjsd42-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Apr 2022 06:57:10 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UH0qbES2QCCsYHFTZaTqUxyRhq62yy+NEN7uvqN+i+BW+7Z+z8BxEbhR9pZ+OpgbCK4OYgiI8iveqPMJSAj71ecvVRUB0gX/4cyrAypd+l31DBL5bgGVbcyjL/ZUcxMAthFyjv/Ig+a2vdTJwTQQS+kPT8xbNubmmhny5cMhSbBNIBZAmv3p3vTnaqvFHnYQaXkB4HrM+iuF9y/VAi4wBVNM/AqRwDhZENi8NGGdidmbwodf6knfsvdMi0sxpZim2W7SV4zFF0WcfoTZ8rVP82LQGCnDyRZI6RXQENiFBhd1L6yV2OlfJeLyjyaGP44SiodjkrNBaQ0tWDMsUF3i/Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=mSHQPLE1tL0y2QFgOK2qSZ5zYRzWJxnAgm9IlF8QJIA=; b=dUWo0PGrAMV6OOQ3Nm4IOATTooehCrLg8YgaYjJmj6TontpKU6safGz30ttwfrx/tgd/XRMZkzajW0A8V/zd9kVbirC1ZLwb0urD9hEI4T3XlgpQBfcswCl3mEa3J8wlLFtc0IEUWnzVG9FxQmhA7cLsGL5br7/RjwHfxi4w4sRC1SrjJ78l4gOqRQJf0ELnp7TFK2xPFIa0GU9bqK5NZdzLz4PFWkz5iLJ1wwZJtA8K3McFGa4ta8jrlxvdKiUYuc1FSpvc/uIakebaTcko1YLo2Shs/5D26U58APBtlj9hvTrF1B6QndPHCF6hbwysEJNP3la/j2+hDYZnBtgDUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) by BN6PR11MB1586.namprd11.prod.outlook.com (2603:10b6:405:f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5206.13; Thu, 28 Apr 2022 13:57:07 +0000 Received: from DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34]) by DM4PR11MB5327.namprd11.prod.outlook.com ([fe80::806f:3f7a:c1be:ff34%7]) with mapi id 15.20.5186.023; Thu, 28 Apr 2022 13:57:07 +0000 From: Ovidiu Panait To: stable@vger.kernel.org Cc: Lin Ma , Jakub Kicinski , Xu Jia , Greg Kroah-Hartman , Ovidiu Panait Subject: [PATCH 4.19 2/2] hamradio: remove needs_free_netdev to avoid UAF Date: Thu, 28 Apr 2022 16:56:48 +0300 Message-Id: <20220428135648.958508-2-ovidiu.panait@windriver.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220428135648.958508-1-ovidiu.panait@windriver.com> References: <20220428135648.958508-1-ovidiu.panait@windriver.com> X-ClientProxiedBy: VI1PR04CA0051.eurprd04.prod.outlook.com (2603:10a6:802:2::22) To DM4PR11MB5327.namprd11.prod.outlook.com (2603:10b6:5:392::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 27be9011-98f0-43bc-acb1-08da291efb7c X-MS-TrafficTypeDiagnostic: BN6PR11MB1586:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 6jsIxuX93ag6SgWfOW4wK4Z/eSdfWPFrlLVmjzdbQXr+AAl5peZrRtA9xx2x86zDNkiNDFUNgAyJ7e3n9qSJKjnPqeQ6y6aOK28ss3aa/dmesgs7vNBfwkd7bgNT3kFDN1f57gFC4dIlJmFin3JcZYrLe5AGdQP0Kvu8KF8xuoPljJKcWFw2IId6QlVkBPx1dmHrk2qB5YCKXCfQvQf9JgQu5cYgDVGT6HUvv6D74eggHNdRWU6A7MVIBoaos2I6ziP3AAgkUXv4WPJMonnVmNQ48wglysFvPi9fTEq/pxNMKmPZ30JxnxNQHLTeykn3w5Fc2SbvdfN4NTx6LsDLc9NTj0AEhVXCspMWpinaAfSc9qMBBsaIrvanojUTITZgJr8uzRsNmx2M/6AzU8bIjilPwZhQSJCoC45dimav5u1kqUsdyDmoJDGcVGRarpkz+m6EHx9OezXfUplaGPiiyRR4qykkXoSn4Dtqmx2jo25l2Ws+vj8uYhpknCQzsBU+0LNVqHtgyOZTNRbLm/7u4h0VFyYhOsDZqw2gKckz5BPPYRhrYqXixSast8vOh9QtzoIvjHYtcLLAcOUcrZENN+2EmXBh5eWUiwiMU7kUF/4tdBfgDV1u51eX12fcBB/dB9qDaOuzgHy5fx2wXou/yYE96YpvVUVMmPAsYsuSpxZNrJb9MgGOQ0gx3/SiGeYUY8XuzCNSfis3JWBonBbYOAUjxD+FVGKm6/lks0bNCqwDtiNffv79sjikeFOHzyU1A91M0DWlsHJtxSY/YAs6u3V4pDJUw3vN9itfR030A0Q= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM4PR11MB5327.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(2906002)(44832011)(36756003)(5660300002)(66946007)(66476007)(316002)(186003)(66556008)(83380400001)(8676002)(4326008)(6916009)(8936002)(54906003)(52116002)(86362001)(2616005)(107886003)(966005)(6486002)(508600001)(38100700002)(38350700002)(6666004)(26005)(1076003)(6512007)(6506007); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 7VhoHNxXbvd+6oAUKHRAUyOJY7TvbiGDBv3o7+r1Hp2TtyNd4Dw+LURoPN9c6SFkJKEcuqndfSSdIdJcXndffRsrlv4H0GpD9wVzxIwhTIhymgxGGBvMNgkJe1Px6J/QlAljx2CRcYkhWdeZzrg7NOREkHt3k2HjkP4MwSpXTRNt4vJbsVHxbEtHnheYEf6RMExAigOEHsKwYXmkzY0e4bMSbDbcGqPYNrpt25iBaM4ge1wINdr1yN8QTnTsdfUprClZIY3qylzydHT5bNJoULt0mydnOGnrXuRsQ2OoKTaNH4LZTTLnTddMRRhrPocsG2GSwB6DPYtiZJvtr8Uen84iWcE45XtybVf0bXCKFz7ArX8B3/fmOcaZvybRP6JUJI5UBf2g/IKLbY3nk/ot5DY8p2hCAwq5naYRkpbPelQX7jepGNXT2cSjBOpZqNA2jGgxRDb/v1gMfGr27mw1bUnUBNW8hBFJ2eM8trU4ieTqoNx3wX3AYPNAys3k1cU+ZL4+ms9gvxjIhn6gXQiEYPz77u20Qvdcy8ih25EHhA8i8iWZ6B/QIIzWYXriYmHSFT4om0CZJZUFs/DoUtqpfmDTnGmPORRZPX6dWarrJ4zQwQN7zetyBR3JEUz5izVuiMypvqg09MWxAARtI6GaMFv7jaKeiFs29JHyUJAZttumVIaBIo88nQW2stBLG1LDVSguiZTBQf4DrViSPSSlvq0nw8b8tclFJVtXZrLUEDsjxzaTlLRuxuFmd8IJyNojI6s9nvHhY3j53ck3gHMh4ZfH5O5+z6ZgS+n6k3gbiWG0c9b3p0Po3b8exxCtmboSyg2Al/JFU+Xn8uj/je2Tj0YookgsLqoNjVFy45WmGbpvBO70+yjmfQ8USDqrrcP8IFJm3idtPa7lk2YmnzDWQUPXH2NHYBYjqbvtds6ljC58cjkJzEXvQ51f3RbEzRo7i7zAS5Bjdsa5GQGKFwhKwBnQK4CVu9LCvdKuExqzVgzPTouSoM+MUK60iphI1lz/1Jl6BEb96Jl3bTEvoNU9IV3BgiFgnOc4XOL60ZVg4YqO2mfmXtl29xh5gBPuUgSgboLmUwJAzCSVtLaDXY4aUMrCtCKVYmn5IavCME0eFR63NbA++pCgeNO+S2j9lI3eo6m5kDoh8nutgAa+093G1OzlI2dVoLkFEDs7zD8BXlL3zzenIHl/FRMhzaNUCVtl4F9OKMX3grs4Lkq3xh1+Im3vD7Gx7hgcTQbaRkjjxQyDygYthJcZTlPsubrtNgCJgwyhqYQysaMd0SqyR9PySGK3kLeAPCdbPWoIijpyKS4v/P5+m5pxwvKZ0WfLZF6FQjX61lJmsng6U4QMR5tC0Pm+t3WAFKOlU/ghMwZpH6xWwbRq4bebi+DYTYVVTpIrQ7E07rwEiHC6PpM08WM7Z6jpoOVk2JhvhY6ookwdiERisu1GCmoQ2fMz0G1n7tdE2sXF9+2ClDUxyhtA3Y4YAN6GqxxzcVGUhSn4lXETAXI6BSRH5pjtOjyFKAuFTQu8sAgaJ9iziOfWb9YG5hixF6yz9D0sDfim3NNfZsuVOKfQiH7w8b7AUty6fS/CNhfyU+nvpIQz+8N/qMndVaI3JwQEYmhjBg7kk+QsK04lZ7Cx4KdA+MHXJG69ODY7hIchErhSNj9y5/syXM0dCEdaNOgH1OAcCmeuyTXtupZh6NZbYpKckpcEuusoZwYhcQFgY4NwQeeACBgKfCeeH/1eSRiJCrRjNhWiS45AwhDiIy8= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 27be9011-98f0-43bc-acb1-08da291efb7c X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5327.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 13:57:07.2760 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 5IJ3x/pJSlibFpo5pvExGQkbQ4EObWyCztaGbPJXZsfiLuiFL2jFPsrIlFHiGLEDmI+8eCfrhepu79wPk9KAzG6eGF08H8U27YaDwp5o3Ac= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1586 X-Proofpoint-GUID: TMHncyvZQYdsnSgpbh6tG9Gusjow40wZ X-Proofpoint-ORIG-GUID: TMHncyvZQYdsnSgpbh6tG9Gusjow40wZ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-04-28_01,2022-04-28_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 spamscore=0 mlxscore=0 malwarescore=0 bulkscore=0 phishscore=0 impostorscore=0 adultscore=0 clxscore=1015 mlxlogscore=838 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204280086 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 81b1d548d00bcd028303c4f3150fa753b9b8aa71 upstream. The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev = true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ovidiu Panait --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 381febb99bc3..87094189af74 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -311,7 +311,6 @@ static void sp_setup(struct net_device *dev) { /* Finish setting up the DEVICE info. */ dev->netdev_ops = &sp_netdev_ops; - dev->needs_free_netdev = true; dev->mtu = SIXP_MTU; dev->hard_header_len = AX25_MAX_HEADER_LEN; dev->header_ops = &ax25_header_ops;