linux-kernel - Re: [PATCH rdma-rc] IB/core: fix a UAF for netdev in netdevice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211025163941.GA393143@nvidia.com>
Date:   Mon, 25 Oct 2021 13:39:41 -0300
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Ziyang Xuan <william.xuanziyang@...wei.com>,
        Jiri Pirko <jiri@...dia.com>
Cc:     dledford@...hat.com, leon@...nel.org, mbloch@...dia.com,
        jinpu.wang@...os.com, lee.jones@...aro.org,
        linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH rdma-rc] IB/core: fix a UAF for netdev in netdevice_event
 process

On Mon, Oct 25, 2021 at 11:42:58AM +0800, Ziyang Xuan wrote:
> When a vlan netdev enter netdevice_event process although it is not a
> roce netdev, it will be passed to netdevice_event_work_handler() to
> process. In order to hold the netdev of netdevice_event after
> netdevice_event() return, call dev_hold() to hold the netdev in
> netdevice_queue_work(). But that did not consider the real_dev of a vlan
> netdev, the real_dev can be freed within netdevice_event_work_handler()
> be scheduled. It would trigger the UAF problem for the real_dev like
> following:

I think this is a netdev bug. Under rtnl vlan_dev_real_dev() should
return NULL if the vlan device has passed unregister_vlan_dev()

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 55275ef9a31a7c..1106da84e72559 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -126,6 +126,7 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
        /* Get rid of the vlan's reference to real_dev */
        dev_put(real_dev);
+       vlan->real_dev = NULL;
 }
 
 int vlan_check_real_dev(struct net_device *real_dev,

I'm assuming there is more too it than this, but it is a starting
point.

Jason