[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250328062237.3746875-1-ap420073@gmail.com>
Date: Fri, 28 Mar 2025 06:22:37 +0000
From: Taehee Yoo <ap420073@...il.com>
To: davem@...emloft.net,
kuba@...nel.org,
pabeni@...hat.com,
edumazet@...gle.com,
andrew+netdev@...n.ch,
horms@...nel.org,
netdev@...r.kernel.org
Cc: jdamato@...tly.com,
sdf@...ichev.me,
almasrymina@...gle.com,
xuanzhuo@...ux.alibaba.com,
ap420073@...il.com
Subject: [PATCH net] net: fix use-after-free in the netdev_nl_sock_priv_destroy()
In the netdev_nl_sock_priv_destroy(), an instance lock is acquired
before calling net_devmem_unbind_dmabuf(), then releasing an instance
lock(netdev_unlock(binding->dev)).
However, a binding is freed in the net_devmem_unbind_dmabuf().
So using a binding after net_devmem_unbind_dmabuf() occurs UAF.
To fix this UAF, it needs to use temporary variable.
Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()")
Signed-off-by: Taehee Yoo <ap420073@...il.com>
---
net/core/netdev-genl.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
index fd1cfa9707dc..3afeaa8c5dc5 100644
--- a/net/core/netdev-genl.c
+++ b/net/core/netdev-genl.c
@@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv)
{
struct net_devmem_dmabuf_binding *binding;
struct net_devmem_dmabuf_binding *temp;
+ struct net_device *dev;
mutex_lock(&priv->lock);
list_for_each_entry_safe(binding, temp, &priv->bindings, list) {
- netdev_lock(binding->dev);
+ dev = binding->dev;
+ netdev_lock(dev);
net_devmem_unbind_dmabuf(binding);
- netdev_unlock(binding->dev);
+ netdev_unlock(dev);
}
mutex_unlock(&priv->lock);
}
--
2.34.1
Powered by blists - more mailing lists