This is a note to let you know that I've just added the patch titled ax25: Fix UAF bugs in ax25 timers to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ax25-fix-uaf-bugs-in-ax25-timers.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Tue Apr 26 09:00:25 AM CEST 2022 From: Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx> Date: Thu, 21 Apr 2022 13:24:22 +0300 Subject: ax25: Fix UAF bugs in ax25 timers To: stable@xxxxxxxxxxxxxxx Cc: Duoming Zhou <duoming@xxxxxxxxxx>, Paolo Abeni <pabeni@xxxxxxxxxx>, Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx> Message-ID: <20220421102422.1206656-8-ovidiu.panait@xxxxxxxxxxxxx> From: Duoming Zhou <duoming@xxxxxxxxxx> commit 82e31755e55fbcea6a9dfaae5fe4860ade17cbc0 upstream. There are race conditions that may lead to UAF bugs in ax25_heartbeat_expiry(), ax25_t1timer_expiry(), ax25_t2timer_expiry(), ax25_t3timer_expiry() and ax25_idletimer_expiry(), when we call ax25_release() to deallocate ax25_dev. One of the UAF bugs caused by ax25_release() is shown below: (Thread 1) | (Thread 2) ax25_dev_device_up() //(1) | ... | ax25_kill_by_device() ax25_bind() //(2) | ax25_connect() | ... ax25_std_establish_data_link() | ax25_start_t1timer() | ax25_dev_device_down() //(3) mod_timer(&ax25->t1timer,..) | | ax25_release() (wait a time) | ... | ax25_dev_put(ax25_dev) //(4)FREE ax25_t1timer_expiry() | ax25->ax25_dev->values[..] //USE| ... ... | We increase the refcount of ax25_dev in position (1) and (2), and decrease the refcount of ax25_dev in position (3) and (4). The ax25_dev will be freed in position (4) and be used in ax25_t1timer_expiry(). The fail log is shown below: ============================================================== [ 106.116942] BUG: KASAN: use-after-free in ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] Read of size 8 at addr ffff88800bda9028 by task swapper/0/0 [ 106.116942] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-06123-g0905eec574 [ 106.116942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-14 [ 106.116942] Call Trace: ... [ 106.116942] ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] call_timer_fn+0x122/0x3d0 [ 106.116942] __run_timers.part.0+0x3f6/0x520 [ 106.116942] run_timer_softirq+0x4f/0xb0 [ 106.116942] __do_softirq+0x1c2/0x651 ... This patch adds del_timer_sync() in ax25_release(), which could ensure that all timers stop before we deallocate ax25_dev. Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx> Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> [OP: backport to 4.19: adjust context] Signed-off-by: Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ax25/af_ax25.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1055,6 +1055,11 @@ static int ax25_release(struct socket *s ax25_destroy_socket(ax25); } if (ax25_dev) { + del_timer_sync(&ax25->timer); + del_timer_sync(&ax25->t1timer); + del_timer_sync(&ax25->t2timer); + del_timer_sync(&ax25->t3timer); + del_timer_sync(&ax25->idletimer); dev_put(ax25_dev->dev); ax25_dev_put(ax25_dev); } Patches currently in stable-queue which might be from ovidiu.panait@xxxxxxxxxxxxx are queue-4.19/ax25-fix-refcount-leaks-caused-by-ax25_cb_del.patch queue-4.19/ax25-fix-uaf-bug-in-ax25_send_control.patch queue-4.19/ax25-fix-uaf-bugs-of-net_device-caused-by-rebinding-operation.patch queue-4.19/ax25-fix-npd-bug-in-ax25_disconnect.patch queue-4.19/ax25-add-refcount-in-ax25_dev-to-avoid-uaf-bugs.patch queue-4.19/ax25-fix-uaf-bugs-in-ax25-timers.patch queue-4.19/ax25-fix-reference-count-leaks-of-ax25_dev.patch queue-4.19/ax25-fix-null-pointer-dereferences-in-ax25-timers.patch