linux-kernel - Re: [PATCH net v5 4/4] ax25: Change kfree() in ax25_dev_free() to ax25_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240507141326.GA1050877@maili.marvell.com>
Date: Tue, 7 May 2024 19:43:26 +0530
From: Ratheesh Kannoth <rkannoth@...vell.com>
To: Duoming Zhou <duoming@....edu.cn>
CC: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-hams@...r.kernel.org>, <pabeni@...hat.com>, <kuba@...nel.org>,
        <edumazet@...gle.com>, <jreuter@...na.de>, <dan.carpenter@...aro.org>
Subject: Re: [PATCH net v5 4/4] ax25: Change kfree() in ax25_dev_free() to
 ax25_dev_put()

On 2024-05-07 at 12:33:42, Duoming Zhou (duoming@....edu.cn) wrote:
> The object "ax25_dev" is managed by reference counting. Thus it should
> not be directly released by a kfree() call in ax25_dev_free(). Replace
> it with a ax25_dev_put() call instead.
>
> Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
> Suggested-by: Dan Carpenter <dan.carpenter@...aro.org>
> Signed-off-by: Duoming Zhou <duoming@....edu.cn>
> ---
>  net/ax25/ax25_dev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
> index c6ab9b0f0be..2a40c78f6a0 100644
> --- a/net/ax25/ax25_dev.c
> +++ b/net/ax25/ax25_dev.c
> @@ -195,7 +195,7 @@ void __exit ax25_dev_free(void)
>  	list_for_each_entry_safe(s, n, &ax25_dev_list, list) {
>  		netdev_put(s->dev, &s->dev_tracker);
>  		list_del(&s->list);
> -		kfree(s);
> +		ax25_dev_put(s);
The commit message "The object "ax25_dev" is managed by reference counting"
seems be not making sense here.  in case ref > 0 after the ax25_dev_put().
ax25_dev_put(s) is not initiating any mechanism to come back and recheck.

>  	}
>  	spin_unlock_bh(&ax25_dev_lock);
>  }
> --
> 2.17.1
>