This is a note to let you know that I've just added the patch titled net: avoid UAF on deleted altname to the 6.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-avoid-uaf-on-deleted-altname.patch and it can be found in the queue-6.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b Mon Sep 17 00:00:00 2001 From: Jakub Kicinski <kuba@xxxxxxxxxx> Date: Tue, 17 Oct 2023 18:38:15 -0700 Subject: net: avoid UAF on deleted altname From: Jakub Kicinski <kuba@xxxxxxxxxx> commit 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b upstream. Altnames are accessed under RCU (dev_get_by_name_rcu()) but freed by kfree() with no synchronization point. Each node has one or two allocations (node and a variable-size name, sometimes the name is netdev->name). Adding rcu_heads here is a bit tedious. Besides most code which unlists the names already has rcu barriers - so take the simpler approach of adding synchronize_rcu(). Note that the one on the unregistration path (which matters more) is removed by the next fix. Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist") Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx> Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/core/dev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/core/dev.c +++ b/net/core/dev.c @@ -343,7 +343,6 @@ int netdev_name_node_alt_create(struct n static void __netdev_name_node_alt_destroy(struct netdev_name_node *name_node) { list_del(&name_node->list); - netdev_name_node_del(name_node); kfree(name_node->name); netdev_name_node_free(name_node); } @@ -362,6 +361,8 @@ int netdev_name_node_alt_destroy(struct if (name_node == dev->name_node || name_node->dev != dev) return -EINVAL; + netdev_name_node_del(name_node); + synchronize_rcu(); __netdev_name_node_alt_destroy(name_node); return 0; @@ -10838,6 +10839,7 @@ void unregister_netdevice_many_notify(st synchronize_net(); list_for_each_entry(dev, head, unreg_list) { + struct netdev_name_node *name_node; struct sk_buff *skb = NULL; /* Shutdown queueing discipline. */ @@ -10865,6 +10867,9 @@ void unregister_netdevice_many_notify(st dev_uc_flush(dev); dev_mc_flush(dev); + netdev_for_each_altname(dev, name_node) + netdev_name_node_del(name_node); + synchronize_rcu(); netdev_name_node_alt_flush(dev); netdev_name_node_free(dev->name_node); Patches currently in stable-queue which might be from kuba@xxxxxxxxxx are queue-6.5/net-fix-ifname-in-netlink-ntf-during-netns-move.patch queue-6.5/docs-fix-info-about-representor-identification.patch queue-6.5/net-sched-sch_hfsc-upgrade-rt-to-sc-when-it-becomes-a-inner-curve.patch queue-6.5/ipv4-fib-annotate-races-around-nh-nh_saddr_genid-and-nh-nh_saddr.patch queue-6.5/ice-reset-first-in-crash-dump-kernels.patch queue-6.5/net-phy-bcm7xxx-add-missing-16nm-ephy-statistics.patch queue-6.5/tcp-check-mptcp-level-constraints-for-backlog-coalescing.patch queue-6.5/net-smc-return-the-right-falback-reason-when-prefix-checks-fail.patch queue-6.5/ice-fix-safe-mode-when-ddp-is-missing.patch queue-6.5/tcp-fix-excessive-tlp-and-rack-timeouts-from-hz-rounding.patch queue-6.5/net-usb-smsc95xx-fix-an-error-code-in-smsc95xx_reset.patch queue-6.5/octeon_ep-update-bql-sent-bytes-before-ringing-doorbell.patch queue-6.5/net-check-for-altname-conflicts-when-changing-netdev-s-netns.patch queue-6.5/selftests-mptcp-join-no-rst-when-rm-subflow-addr.patch queue-6.5/tcp-fix-listen-warning-with-v4-mapped-v6-address.patch queue-6.5/mptcp-more-conservative-check-for-zero-probes.patch queue-6.5/net-mdio-mux-fix-c45-access-returning-eio-after-api-change.patch queue-6.5/ice-fix-over-shifted-variable.patch queue-6.5/net-avoid-uaf-on-deleted-altname.patch queue-6.5/net-dsa-bcm_sf2-fix-possible-memory-leak-in-bcm_sf2_mdio_register.patch queue-6.5/tcp-tsq-relax-tcp_small_queue_check-when-rtx-queue-contains-a-single-skb.patch queue-6.5/netlink-correct-offload_xstats-size.patch queue-6.5/tun-prevent-negative-ifindex.patch queue-6.5/i40e-prevent-crash-on-probe-if-hw-registers-have-invalid-values.patch queue-6.5/nfc-nci-fix-possible-null-pointer-dereference-in-send_acknowledge.patch