This is a note to let you know that I've just added the patch titled
net: avoid UAF on deleted altname
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-avoid-uaf-on-deleted-altname.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@xxxxxxxxxx>
Date: Tue, 17 Oct 2023 18:38:15 -0700
Subject: net: avoid UAF on deleted altname
From: Jakub Kicinski <kuba@xxxxxxxxxx>
commit 1a83f4a7c156fa6bbd6b530e89fa3270bf3d9d1b upstream.
Altnames are accessed under RCU (dev_get_by_name_rcu())
but freed by kfree() with no synchronization point.
Each node has one or two allocations (node and a variable-size
name, sometimes the name is netdev->name). Adding rcu_heads
here is a bit tedious. Besides most code which unlists the names
already has rcu barriers - so take the simpler approach of adding
synchronize_rcu(). Note that the one on the unregistration path
(which matters more) is removed by the next fix.
Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist")
Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/dev.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -345,7 +345,6 @@ int netdev_name_node_alt_create(struct n
static void __netdev_name_node_alt_destroy(struct netdev_name_node *name_node)
{
list_del(&name_node->list);
- netdev_name_node_del(name_node);
kfree(name_node->name);
netdev_name_node_free(name_node);
}
@@ -364,6 +363,8 @@ int netdev_name_node_alt_destroy(struct
if (name_node == dev->name_node || name_node->dev != dev)
return -EINVAL;
+ netdev_name_node_del(name_node);
+ synchronize_rcu();
__netdev_name_node_alt_destroy(name_node);
return 0;
@@ -10835,6 +10836,7 @@ void unregister_netdevice_many(struct li
synchronize_net();
list_for_each_entry(dev, head, unreg_list) {
+ struct netdev_name_node *name_node;
struct sk_buff *skb = NULL;
/* Shutdown queueing discipline. */
@@ -10860,6 +10862,9 @@ void unregister_netdevice_many(struct li
dev_uc_flush(dev);
dev_mc_flush(dev);
+ netdev_for_each_altname(dev, name_node)
+ netdev_name_node_del(name_node);
+ synchronize_rcu();
netdev_name_node_alt_flush(dev);
netdev_name_node_free(dev->name_node);
Patches currently in stable-queue which might be from kuba@xxxxxxxxxx are
queue-6.1/net-fix-ifname-in-netlink-ntf-during-netns-move.patch
queue-6.1/net-sched-sch_hfsc-upgrade-rt-to-sc-when-it-becomes-a-inner-curve.patch
queue-6.1/ipv4-fib-annotate-races-around-nh-nh_saddr_genid-and-nh-nh_saddr.patch
queue-6.1/ice-reset-first-in-crash-dump-kernels.patch
queue-6.1/net-phy-bcm7xxx-add-missing-16nm-ephy-statistics.patch
queue-6.1/tcp-check-mptcp-level-constraints-for-backlog-coalescing.patch
queue-6.1/net-smc-return-the-right-falback-reason-when-prefix-checks-fail.patch
queue-6.1/tcp-fix-excessive-tlp-and-rack-timeouts-from-hz-rounding.patch
queue-6.1/net-usb-smsc95xx-fix-an-error-code-in-smsc95xx_reset.patch
queue-6.1/octeon_ep-update-bql-sent-bytes-before-ringing-doorbell.patch
queue-6.1/net-check-for-altname-conflicts-when-changing-netdev-s-netns.patch
queue-6.1/tcp-fix-listen-warning-with-v4-mapped-v6-address.patch
queue-6.1/mptcp-more-conservative-check-for-zero-probes.patch
queue-6.1/ice-fix-over-shifted-variable.patch
queue-6.1/net-avoid-uaf-on-deleted-altname.patch
queue-6.1/net-dsa-bcm_sf2-fix-possible-memory-leak-in-bcm_sf2_mdio_register.patch
queue-6.1/tcp-tsq-relax-tcp_small_queue_check-when-rtx-queue-contains-a-single-skb.patch
queue-6.1/netlink-correct-offload_xstats-size.patch
queue-6.1/tun-prevent-negative-ifindex.patch
queue-6.1/i40e-prevent-crash-on-probe-if-hw-registers-have-invalid-values.patch
queue-6.1/nfc-nci-fix-possible-null-pointer-dereference-in-send_acknowledge.patch
