[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ebd0bb9b-8e66-4119-b011-c1a737749fb2@suse.com>
Date: Tue, 1 Jul 2025 15:22:54 +0200
From: Oliver Neukum <oneukum@...e.com>
To: Paolo Abeni <pabeni@...hat.com>, "Peter GJ. Park"
<gyujoon.park@...sung.com>, Oliver Neukum <oneukum@...e.com>,
Andrew Lunn <andrew+netdev@...n.ch>, "David S. Miller"
<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>
Cc: netdev@...r.kernel.org, linux-usb@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: usb: usbnet: fix use-after-free in race on workqueue
Hi,
On 26.06.25 11:21, Paolo Abeni wrote:
>> drivers/net/usb/usbnet.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
>> index c04e715a4c2ade3bc5587b0df71643a25cf88c55..3c5d9ba7fa6660273137c80106746103f84f5a37 100644
>> --- a/drivers/net/usb/usbnet.c
>> +++ b/drivers/net/usb/usbnet.c
>> @@ -1660,6 +1660,9 @@ void usbnet_disconnect (struct usb_interface *intf)
>> usb_free_urb(dev->interrupt);
>> kfree(dev->padding_pkt);
>>
>> + timer_delete_sync(&dev->delay);
>> + tasklet_kill(&dev->bh);
>> + cancel_work_sync(&dev->kevent);
>> free_netdev(net);
> This happens after unregister_netdev(), which calls usbnet_stop() that
> already performs the above cleanup. How the race is supposed to take place?
That is indeed a core question, which we really need an answer to.
Do I interpret dev_close_many() correctly, if I state that the
ndo_stop() method will _not_ be called if the device has never been
opened?
I am sorry to be a stickler here, but if that turns out to be true,
usbnet is not the only driver that has this bug.
TIA
Oliver
Powered by blists - more mailing lists