lkml.org 
[lkml]   [2022]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 02/78] hamradio: defer 6pack kfree after unregister_netdev
    Date
    From: Lin Ma <linma@zju.edu.cn>

    commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream.

    There is a possible race condition (use-after-free) like below

    (USE) | (FREE)
    dev_queue_xmit |
    __dev_queue_xmit |
    __dev_xmit_skb |
    sch_direct_xmit | ...
    xmit_one |
    netdev_start_xmit | tty_ldisc_kill
    __netdev_start_xmit | 6pack_close
    sp_xmit | kfree
    sp_encaps |
    |

    According to the patch "defer ax25 kfree after unregister_netdev", this
    patch reorder the kfree after the unregister_netdev to avoid the possible
    UAF as the unregister_netdev() is well synchronized and won't return if
    there is a running routine.

    Signed-off-by: Lin Ma <linma@zju.edu.cn>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/hamradio/6pack.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/net/hamradio/6pack.c
    +++ b/drivers/net/hamradio/6pack.c
    @@ -690,9 +690,11 @@ static void sixpack_close(struct tty_str
    del_timer_sync(&sp->tx_t);
    del_timer_sync(&sp->resync_t);

    - /* Free all 6pack frame buffers. */
    + /* Free all 6pack frame buffers after unreg. */
    kfree(sp->rbuff);
    kfree(sp->xbuff);
    +
    + free_netdev(sp->dev);
    }

    /* Perform I/O control on an active 6pack channel. */

    \
     
     \ /
      Last update: 2022-05-10 15:21    [W:4.062 / U:0.200 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site