diff options
| author | Taehee Yoo <ap420073@gmail.com> | 2025-03-28 06:22:37 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-03-31 16:44:49 -0700 |
| commit | 42f342387841891bbbd15e25d33eb510a0cf7a9a (patch) | |
| tree | 7e2f5ac3ca3a21fb6e478630c0453a46b9ac7c95 /net | |
| parent | 5c6052802dfbae291ce9032636fb2f7bd0c705e3 (diff) | |
net: fix use-after-free in the netdev_nl_sock_priv_destroy()
In the netdev_nl_sock_priv_destroy(), an instance lock is acquired
before calling net_devmem_unbind_dmabuf(), then releasing an instance
lock(netdev_unlock(binding->dev)).
However, a binding is freed in the net_devmem_unbind_dmabuf().
So using a binding after net_devmem_unbind_dmabuf() occurs UAF.
To fix this UAF, it needs to use temporary variable.
Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250328062237.3746875-1-ap420073@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/netdev-genl.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c index fd1cfa9707dc..3afeaa8c5dc5 100644 --- a/net/core/netdev-genl.c +++ b/net/core/netdev-genl.c @@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv) { struct net_devmem_dmabuf_binding *binding; struct net_devmem_dmabuf_binding *temp; + struct net_device *dev; mutex_lock(&priv->lock); list_for_each_entry_safe(binding, temp, &priv->bindings, list) { - netdev_lock(binding->dev); + dev = binding->dev; + netdev_lock(dev); net_devmem_unbind_dmabuf(binding); - netdev_unlock(binding->dev); + netdev_unlock(dev); } mutex_unlock(&priv->lock); } |