diff options
| author | Duoming Zhou <duoming@zju.edu.cn> | 2022-01-28 05:47:16 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-01-28 15:56:47 +0100 |
| commit | d01ffb9eee4af165d83b08dd73ebdf9fe94a519b (patch) | |
| tree | ae3be0b158b4a7dfb2162956ca6b63f22a3eb6c2 /net/wireless | |
| parent | ax25: improve the incomplete fix to avoid UAF and NPD bugs (diff) | |
| download | linux-d01ffb9eee4af165d83b08dd73ebdf9fe94a519b.tar.xz linux-d01ffb9eee4af165d83b08dd73ebdf9fe94a519b.zip | |
ax25: add refcount in ax25_dev to avoid UAF bugs
If we dereference ax25_dev after we call kfree(ax25_dev) in
ax25_dev_device_down(), it will lead to concurrency UAF bugs.
There are eight syscall functions suffer from UAF bugs, include
ax25_bind(), ax25_release(), ax25_connect(), ax25_ioctl(),
ax25_getname(), ax25_sendmsg(), ax25_getsockopt() and
ax25_info_show().
One of the concurrency UAF can be shown as below:
(USE) | (FREE)
| ax25_device_event
| ax25_dev_device_down
ax25_bind | ...
... | kfree(ax25_dev)
ax25_fillin_cb() | ...
ax25_fillin_cb_from_dev() |
... |
The root cause of UAF bugs is that kfree(ax25_dev) in
ax25_dev_device_down() is not protected by any locks.
When ax25_dev, which there are still pointers point to,
is released, the concurrency UAF bug will happen.
This patch introduces refcount into ax25_dev in order to
guarantee that there are no pointers point to it when ax25_dev
is released.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/wireless')
0 files changed, 0 insertions, 0 deletions