Duoming Zhou
418993bbaa
ax25: add refcount in ax25_dev to avoid UAF bugs ...
commit d01ffb9eee4af165d83b08dd73ebdf9fe94a519b upstream.
If we dereference ax25_dev after we call kfree(ax25_dev) in
ax25_dev_device_down(), it will lead to concurrency UAF bugs.
There are eight syscall functions suffer from UAF bugs, include
ax25_bind(), ax25_release(), ax25_connect(), ax25_ioctl(),
ax25_getname(), ax25_sendmsg(), ax25_getsockopt() and
ax25_info_show().
One of the concurrency UAF can be shown as below:
(USE) | (FREE)
| ax25_device_event
| ax25_dev_device_down
ax25_bind | ...
... | kfree(ax25_dev)
ax25_fillin_cb() | ...
ax25_fillin_cb_from_dev() |
... |
The root cause of UAF bugs is that kfree(ax25_dev) in
ax25_dev_device_down() is not protected by any locks.
When ax25_dev, which there are still pointers point to,
is released, the concurrency UAF bug will happen.
This patch introduces refcount into ax25_dev in order to
guarantee that there are no pointers point to it when ax25_dev
is released.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
[OP: backport to 5.4: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-20 09:19:39 +02:00
xen/9p: use alloc/free_pages_exact()
2022-03-11 11:22:39 +01:00
net: vlan: fix underflow for the real_dev refcnt
2021-12-01 09:23:34 +01:00
ax25: add refcount in ax25_dev to avoid UAF bugs
2022-04-20 09:19:39 +02:00
ipv6: make mc_forwarding atomic
2022-04-15 14:18:32 +02:00
Bluetooth: Fix use after free in hci_send_acl
2022-04-15 14:18:34 +02:00
net: bridge: fix stale eth hdr pointer in br_dev_xmit
2022-02-16 12:52:50 +01:00
can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
2021-12-08 09:01:08 +01:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
net: dcb: disable softirqs in dcbnl_flush_dev()
2022-03-08 19:07:51 +01:00
dccp: don't duplicate ccid when cloning dccp sock
2021-09-22 12:26:40 +02:00
net: dsa: Add missing of_node_put() in dsa_port_parse_of
2022-03-23 09:12:07 +01:00
net: ieee802154: Return meaningful error codes from the netlink helpers
2022-02-08 18:24:31 +01:00
net: ipv4: fix route with nexthop object delete warning
2022-04-15 14:18:37 +02:00
ipv6: fix panic when forwarding a pkt with no in6 dev
2022-04-20 09:19:38 +02:00
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
2022-04-15 14:17:56 +02:00
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
2021-09-22 12:26:41 +02:00
llc: only change llc->dev when bind() succeeds
2022-03-28 08:46:48 +02:00
mac80211: fix potential double free on mesh join
2022-03-28 08:46:48 +02:00
net: mpls: Fix notifications when deleting a device
2021-12-08 09:01:12 +01:00
net/ncsi: check for error return from call to nla_put_u32
2022-01-05 12:37:45 +01:00
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
2022-04-15 14:18:20 +02:00
netlabel: fix out-of-bounds memory accesses
2022-04-15 14:18:35 +02:00
af_netlink: Fix shift out of bounds in group mask calculation
2022-04-15 14:18:16 +02:00
nfc: nci: add flush_workqueue to prevent uaf
2022-04-20 09:19:35 +02:00
net: openvswitch: don't send internal clone attribute to the userspace.
2022-04-15 14:18:37 +02:00
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
2022-03-23 09:12:06 +01:00
phonet: refcount leak in pep_sock_accep
2022-01-11 15:23:33 +01:00
rds: memory leak in __rds_conn_create()
2021-12-22 09:29:37 +01:00
rxrpc: fix a race in rxrpc_exit_net()
2022-04-15 14:18:38 +02:00
net/sched: taprio: Check if socket flags are valid
2022-04-20 09:19:35 +02:00
sctp: Initialize daddr on peeled off socket
2022-04-20 09:19:35 +02:00
net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
2022-04-20 09:19:35 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
SUNRPC: Handle low memory situations in call_status()
2022-04-15 14:18:38 +02:00
net: switchdev: do not propagate bridge updates across bridges
2021-10-27 09:54:24 +02:00
tipc: fix the timer expires after interval 100ms
2022-04-15 14:18:17 +02:00
net/tls: fix slab-out-of-bounds bug in decrypt_internal
2022-04-15 14:18:37 +02:00
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
2022-01-27 09:19:53 +01:00
vsock: remove vsock from connected table when connect is interrupted by a signal
2022-02-23 11:59:57 +01:00
cfg80211: hold bss_lock while updating nontrans_list
2022-04-20 09:19:35 +02:00
net/x25: Fix null-ptr-deref caused by x25_disconnect
2022-04-15 14:18:21 +02:00
Revert "xsk: Do not sleep in poll() when need_wakeup set"
2021-12-22 09:29:40 +01:00
xfrm: fix tunnel model fragmentation behavior
2022-04-15 14:17:56 +02:00
418993bbaa