Patch "ax25: Fix refcount imbalance on inbound connections" has been added to the 6.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ax25: Fix refcount imbalance on inbound connections

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ax25-fix-refcount-imbalance-on-inbound-connections.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6092a21f3f6dda8dad72966bfd716109dc49050e
Author: Lars Kellogg-Stedman <lars@xxxxxxxxxx>
Date:   Wed May 29 17:02:43 2024 -0400

    ax25: Fix refcount imbalance on inbound connections
    
    [ Upstream commit 3c34fb0bd4a4237592c5ecb5b2e2531900c55774 ]
    
    When releasing a socket in ax25_release(), we call netdev_put() to
    decrease the refcount on the associated ax.25 device. However, the
    execution path for accepting an incoming connection never calls
    netdev_hold(). This imbalance leads to refcount errors, and ultimately
    to kernel crashes.
    
    A typical call trace for the above situation will start with one of the
    following errors:
    
        refcount_t: decrement hit 0; leaking memory.
        refcount_t: underflow; use-after-free.
    
    And will then have a trace like:
    
        Call Trace:
        <TASK>
        ? show_regs+0x64/0x70
        ? __warn+0x83/0x120
        ? refcount_warn_saturate+0xb2/0x100
        ? report_bug+0x158/0x190
        ? prb_read_valid+0x20/0x30
        ? handle_bug+0x3e/0x70
        ? exc_invalid_op+0x1c/0x70
        ? asm_exc_invalid_op+0x1f/0x30
        ? refcount_warn_saturate+0xb2/0x100
        ? refcount_warn_saturate+0xb2/0x100
        ax25_release+0x2ad/0x360
        __sock_release+0x35/0xa0
        sock_close+0x19/0x20
        [...]
    
    On reboot (or any attempt to remove the interface), the kernel gets
    stuck in an infinite loop:
    
        unregister_netdevice: waiting for ax0 to become free. Usage count = 0
    
    This patch corrects these issues by ensuring that we call netdev_hold()
    and ax25_dev_hold() for new connections in ax25_accept(). This makes the
    logic leading to ax25_accept() match the logic for ax25_bind(): in both
    cases we increment the refcount, which is ultimately decremented in
    ax25_release().
    
    Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
    Signed-off-by: Lars Kellogg-Stedman <lars@xxxxxxxxxx>
    Tested-by: Duoming Zhou <duoming@xxxxxxxxxx>
    Tested-by: Dan Cross <crossd@xxxxxxxxx>
    Tested-by: Chris Maness <christopher.maness@xxxxxxxxx>
    Reviewed-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240529210242.3346844-2-lars@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 9169efb2f43aa..5fff5930e4deb 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1378,8 +1378,10 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags,
 {
 	struct sk_buff *skb;
 	struct sock *newsk;
+	ax25_dev *ax25_dev;
 	DEFINE_WAIT(wait);
 	struct sock *sk;
+	ax25_cb *ax25;
 	int err = 0;
 
 	if (sock->state != SS_UNCONNECTED)
@@ -1434,6 +1436,10 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags,
 	kfree_skb(skb);
 	sk_acceptq_removed(sk);
 	newsock->state = SS_CONNECTED;
+	ax25 = sk_to_ax25(newsk);
+	ax25_dev = ax25->ax25_dev;
+	netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC);
+	ax25_dev_hold(ax25_dev);
 
 out:
 	release_sock(sk);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux