diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2025-01-14 11:20:06 +0100 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2025-01-14 11:20:07 +0100 |
| commit | 0865b9fdb27219db79f3687bc50a0b534b437ee7 (patch) | |
| tree | 730ac22f6f3ff63e097c5711d7394d1fe856ec87 /drivers/net/pfcp.c | |
| parent | 644f9108f3a505022ef43510e5143cb985e0cf8b (diff) | |
| parent | ffc90e9ca61b0f619326a1417ff32efd6cc71ed2 (diff) | |
Merge branch 'gtp-pfcp-fix-use-after-free-of-udp-tunnel-socket'
Kuniyuki Iwashima says:
====================
gtp/pfcp: Fix use-after-free of UDP tunnel socket.
Xiao Liang pointed out weird netns usages in ->newlink() of
gtp and pfcp.
This series fixes the issues.
Link: https://lore.kernel.org/netdev/20250104125732.17335-1-shaw.leon@gmail.com/
Changes:
v2:
* Patch 1
* Fix uninit/unused local var
v1: https://lore.kernel.org/netdev/20250108062834.11117-1-kuniyu@amazon.com/
====================
Link: https://patch.msgid.link/20250110014754.33847-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'drivers/net/pfcp.c')
| -rw-r--r-- | drivers/net/pfcp.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/drivers/net/pfcp.c b/drivers/net/pfcp.c index 69434fd13f96..68d0d9e92a22 100644 --- a/drivers/net/pfcp.c +++ b/drivers/net/pfcp.c @@ -206,8 +206,8 @@ static int pfcp_newlink(struct net *net, struct net_device *dev, goto exit_del_pfcp_sock; } - pn = net_generic(dev_net(dev), pfcp_net_id); - list_add_rcu(&pfcp->list, &pn->pfcp_dev_list); + pn = net_generic(net, pfcp_net_id); + list_add(&pfcp->list, &pn->pfcp_dev_list); netdev_dbg(dev, "registered new PFCP interface\n"); @@ -224,7 +224,7 @@ static void pfcp_dellink(struct net_device *dev, struct list_head *head) { struct pfcp_dev *pfcp = netdev_priv(dev); - list_del_rcu(&pfcp->list); + list_del(&pfcp->list); unregister_netdevice_queue(dev, head); } @@ -247,11 +247,16 @@ static int __net_init pfcp_net_init(struct net *net) static void __net_exit pfcp_net_exit(struct net *net) { struct pfcp_net *pn = net_generic(net, pfcp_net_id); - struct pfcp_dev *pfcp; + struct pfcp_dev *pfcp, *pfcp_next; + struct net_device *dev; LIST_HEAD(list); rtnl_lock(); - list_for_each_entry(pfcp, &pn->pfcp_dev_list, list) + for_each_netdev(net, dev) + if (dev->rtnl_link_ops == &pfcp_link_ops) + pfcp_dellink(dev, &list); + + list_for_each_entry_safe(pfcp, pfcp_next, &pn->pfcp_dev_list, list) pfcp_dellink(pfcp->dev, &list); unregister_netdevice_many(&list); |