Commit 42f34238 authored by Taehee Yoo's avatar Taehee Yoo Committed by Jakub Kicinski
Browse files

net: fix use-after-free in the netdev_nl_sock_priv_destroy() 



In the netdev_nl_sock_priv_destroy(), an instance lock is acquired
before calling net_devmem_unbind_dmabuf(), then releasing an instance
lock(netdev_unlock(binding->dev)).
However, a binding is freed in the net_devmem_unbind_dmabuf().
So using a binding after net_devmem_unbind_dmabuf() occurs UAF.
To fix this UAF, it needs to use temporary variable.

Fixes: ba6f418f ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()")
Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
Reviewed-by: default avatarMina Almasry <almasrymina@google.com>
Reviewed-by: default avatarXuan Zhuo <xuanzhuo@linux.alibaba.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250328062237.3746875-1-ap420073@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5c605280

net/core/netdev-genl.c

+4 −2
Original line number Diff line number Diff line
@@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv) 
{

	struct net_devmem_dmabuf_binding *binding;

	struct net_devmem_dmabuf_binding *temp;

	struct net_device *dev;



	mutex_lock(&priv->lock);

	list_for_each_entry_safe(binding, temp, &priv->bindings, list) {

		netdev_lock(binding->dev);

		dev = binding->dev;

		netdev_lock(dev);

		net_devmem_unbind_dmabuf(binding);

		netdev_unlock(binding->dev);

		netdev_unlock(dev);

	}

	mutex_unlock(&priv->lock);

}