Patch "net: avoid UAF on deleted altname" has been added to the 6.5-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: avoid UAF on deleted altname

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-avoid-uaf-on-deleted-altname.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@xxxxxxxxxx>
Date: Tue, 17 Oct 2023 18:38:15 -0700
Subject: net: avoid UAF on deleted altname

From: Jakub Kicinski <kuba@xxxxxxxxxx>

commit 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b upstream.

Altnames are accessed under RCU (dev_get_by_name_rcu())
but freed by kfree() with no synchronization point.

Each node has one or two allocations (node and a variable-size
name, sometimes the name is netdev->name). Adding rcu_heads
here is a bit tedious. Besides most code which unlists the names
already has rcu barriers - so take the simpler approach of adding
synchronize_rcu(). Note that the one on the unregistration path
(which matters more) is removed by the next fix.

Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist")
Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 net/core/dev.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -343,7 +343,6 @@ int netdev_name_node_alt_create(struct n
 static void __netdev_name_node_alt_destroy(struct netdev_name_node *name_node)
 {
 	list_del(&name_node->list);
-	netdev_name_node_del(name_node);
 	kfree(name_node->name);
 	netdev_name_node_free(name_node);
 }
@@ -362,6 +361,8 @@ int netdev_name_node_alt_destroy(struct
 	if (name_node == dev->name_node || name_node->dev != dev)
 		return -EINVAL;
 
+	netdev_name_node_del(name_node);
+	synchronize_rcu();
 	__netdev_name_node_alt_destroy(name_node);
 
 	return 0;
@@ -10838,6 +10839,7 @@ void unregister_netdevice_many_notify(st
 	synchronize_net();
 
 	list_for_each_entry(dev, head, unreg_list) {
+		struct netdev_name_node *name_node;
 		struct sk_buff *skb = NULL;
 
 		/* Shutdown queueing discipline. */
@@ -10865,6 +10867,9 @@ void unregister_netdevice_many_notify(st
 		dev_uc_flush(dev);
 		dev_mc_flush(dev);
 
+		netdev_for_each_altname(dev, name_node)
+			netdev_name_node_del(name_node);
+		synchronize_rcu();
 		netdev_name_node_alt_flush(dev);
 		netdev_name_node_free(dev->name_node);
 


Patches currently in stable-queue which might be from kuba@xxxxxxxxxx are

queue-6.5/net-fix-ifname-in-netlink-ntf-during-netns-move.patch
queue-6.5/docs-fix-info-about-representor-identification.patch
queue-6.5/net-sched-sch_hfsc-upgrade-rt-to-sc-when-it-becomes-a-inner-curve.patch
queue-6.5/ipv4-fib-annotate-races-around-nh-nh_saddr_genid-and-nh-nh_saddr.patch
queue-6.5/ice-reset-first-in-crash-dump-kernels.patch
queue-6.5/net-phy-bcm7xxx-add-missing-16nm-ephy-statistics.patch
queue-6.5/tcp-check-mptcp-level-constraints-for-backlog-coalescing.patch
queue-6.5/net-smc-return-the-right-falback-reason-when-prefix-checks-fail.patch
queue-6.5/ice-fix-safe-mode-when-ddp-is-missing.patch
queue-6.5/tcp-fix-excessive-tlp-and-rack-timeouts-from-hz-rounding.patch
queue-6.5/net-usb-smsc95xx-fix-an-error-code-in-smsc95xx_reset.patch
queue-6.5/octeon_ep-update-bql-sent-bytes-before-ringing-doorbell.patch
queue-6.5/net-check-for-altname-conflicts-when-changing-netdev-s-netns.patch
queue-6.5/selftests-mptcp-join-no-rst-when-rm-subflow-addr.patch
queue-6.5/tcp-fix-listen-warning-with-v4-mapped-v6-address.patch
queue-6.5/mptcp-more-conservative-check-for-zero-probes.patch
queue-6.5/net-mdio-mux-fix-c45-access-returning-eio-after-api-change.patch
queue-6.5/ice-fix-over-shifted-variable.patch
queue-6.5/net-avoid-uaf-on-deleted-altname.patch
queue-6.5/net-dsa-bcm_sf2-fix-possible-memory-leak-in-bcm_sf2_mdio_register.patch
queue-6.5/tcp-tsq-relax-tcp_small_queue_check-when-rtx-queue-contains-a-single-skb.patch
queue-6.5/netlink-correct-offload_xstats-size.patch
queue-6.5/tun-prevent-negative-ifindex.patch
queue-6.5/i40e-prevent-crash-on-probe-if-hw-registers-have-invalid-values.patch
queue-6.5/nfc-nci-fix-possible-null-pointer-dereference-in-send_acknowledge.patch



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux