netdev - Re: [PATCH net] net: fix use-after-free in the netdev_nl_sock_priv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1743386027.4868433-1-xuanzhuo@linux.alibaba.com>
Date: Mon, 31 Mar 2025 09:53:47 +0800
From: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>
To: Taehee Yoo <ap420073@...il.com>
Cc: jdamato@...tly.com,
 sdf@...ichev.me,
 almasrymina@...gle.com,
 ap420073@...il.com,
 davem@...emloft.net,
 kuba@...nel.org,
 pabeni@...hat.com,
 edumazet@...gle.com,
 andrew+netdev@...n.ch,
 horms@...nel.org,
 netdev@...r.kernel.org
Subject: Re: [PATCH net] net: fix use-after-free in the netdev_nl_sock_priv_destroy()

On Fri, 28 Mar 2025 06:22:37 +0000, Taehee Yoo <ap420073@...il.com> wrote:
> In the netdev_nl_sock_priv_destroy(), an instance lock is acquired
> before calling net_devmem_unbind_dmabuf(), then releasing an instance
> lock(netdev_unlock(binding->dev)).
> However, a binding is freed in the net_devmem_unbind_dmabuf().
> So using a binding after net_devmem_unbind_dmabuf() occurs UAF.
> To fix this UAF, it needs to use temporary variable.
>
> Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()")
> Signed-off-by: Taehee Yoo <ap420073@...il.com>

Reviewed-by: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>

> ---
>  net/core/netdev-genl.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index fd1cfa9707dc..3afeaa8c5dc5 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c
> @@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv)
>  {
>  	struct net_devmem_dmabuf_binding *binding;
>  	struct net_devmem_dmabuf_binding *temp;
> +	struct net_device *dev;
>
>  	mutex_lock(&priv->lock);
>  	list_for_each_entry_safe(binding, temp, &priv->bindings, list) {
> -		netdev_lock(binding->dev);
> +		dev = binding->dev;
> +		netdev_lock(dev);
>  		net_devmem_unbind_dmabuf(binding);
> -		netdev_unlock(binding->dev);
> +		netdev_unlock(dev);
>  	}
>  	mutex_unlock(&priv->lock);
>  }
> --
> 2.34.1
>