lkml.org 
[lkml]   [2021]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 149/179] net: vlan: fix underflow for the real_dev refcnt
    Date
    From: Ziyang Xuan <william.xuanziyang@huawei.com>

    [ Upstream commit 01d9cc2dea3fde3bad6d27f464eff463496e2b00 ]

    Inject error before dev_hold(real_dev) in register_vlan_dev(),
    and execute the following testcase:

    ip link add dev dummy1 type dummy
    ip link add name dummy1.100 link dummy1 type vlan id 100
    ip link del dev dummy1

    When the dummy netdevice is removed, we will get a WARNING as following:

    =======================================================================
    refcount_t: decrement hit 0; leaking memory.
    WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0

    and an endless loop of:

    =======================================================================
    unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824

    That is because dev_put(real_dev) in vlan_dev_free() be called without
    dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev
    underflow.

    Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of
    ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev
    symmetrical.

    Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()")
    Reported-by: Petr Machata <petrm@nvidia.com>
    Suggested-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Link: https://lore.kernel.org/r/20211126015942.2918542-1-william.xuanziyang@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/8021q/vlan.c | 3 ---
    net/8021q/vlan_dev.c | 3 +++
    2 files changed, 3 insertions(+), 3 deletions(-)

    diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
    index a3a0a5e994f5a..abaa5d96ded24 100644
    --- a/net/8021q/vlan.c
    +++ b/net/8021q/vlan.c
    @@ -184,9 +184,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
    if (err)
    goto out_unregister_netdev;

    - /* Account for reference in struct vlan_dev_priv */
    - dev_hold(real_dev);
    -
    vlan_stacked_transfer_operstate(real_dev, dev, vlan);
    linkwatch_fire_event(dev); /* _MUST_ call rfc2863_policy() */

    diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
    index aeeb5f90417b5..8602885c8a8e0 100644
    --- a/net/8021q/vlan_dev.c
    +++ b/net/8021q/vlan_dev.c
    @@ -615,6 +615,9 @@ static int vlan_dev_init(struct net_device *dev)
    if (!vlan->vlan_pcpu_stats)
    return -ENOMEM;

    + /* Get vlan's reference to real_dev */
    + dev_hold(real_dev);
    +
    return 0;
    }

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-29 19:43    [W:2.579 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site