Messages in this thread | | | Subject | Re: [PATCH net-next v2 1/3] net: ipvlan: fix potential UAF problem for phy_dev | From | "Ziyang Xuan (William)" <> | Date | Sat, 19 Mar 2022 11:32:10 +0800 |
| |
> On Fri, 18 Mar 2022 09:57:47 +0800 Ziyang Xuan wrote: >> Add the reference operation to phy_dev of ipvlan to avoid >> the potential UAF problem under the following known scenario: >> >> Someone module puts the NETDEV_UNREGISTER event handler to a >> work, and phy_dev is accessed in the work handler. But when >> the work is excuted, phy_dev has been destroyed because upper >> ipvlan did not get reference to phy_dev correctly. >> >> That likes as the scenario occurred by >> commit 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()"). > > There is no equivalent of vlan_dev_real_dev() for ipvlan, AFAICT. > The definition of struct ipvl_dev is private to the driver. I don't > see how a UAF can happen here. > > You should either clearly explain how the bug could happen or clearly > state that there is no possibility of the bug for this driver, and the > patch is just future proofing. > > If the latter is the case we should drop the Fixes tag and prevent this > patch from getting backported into stable. >
It is to prevent ipvlan from occurring the similar problem in the future. For now, there is not way to access phy_dev outside ipvlan module as vlan real_dev using vlan_dev_real_dev(). I will make this clear.
I think it is necessary to protect lower netdevice using the feature of netdevice refcnt. So I do it.
Thank you for your valuable opinions! I believe I can do more and more better with your help.
>> Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") >> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> > . >
| |