Commit d03b79f4 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

net: atm: fix /proc/net/atm/lec handling 



/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d13a3824

net/atm/lec.c

+3 −2
Original line number Diff line number Diff line
@@ -909,7 +909,6 @@ static void *lec_itf_walk(struct lec_state *state, loff_t *l) 
	v = (dev && netdev_priv(dev)) ?

		lec_priv_walk(state, l, netdev_priv(dev)) : NULL;

	if (!v && dev) {

		dev_put(dev);

		/* Partial state reset for the next time we get called */

		dev = NULL;

	}
@@ -933,6 +932,7 @@ static void *lec_seq_start(struct seq_file *seq, loff_t *pos) 
{

	struct lec_state *state = seq->private;



	mutex_lock(&lec_mutex);

	state->itf = 0;

	state->dev = NULL;

	state->locked = NULL;
@@ -950,8 +950,9 @@ static void lec_seq_stop(struct seq_file *seq, void *v) 
	if (state->dev) {

		spin_unlock_irqrestore(&state->locked->lec_arp_lock,

				       state->flags);

		dev_put(state->dev);

		state->dev = NULL;

	}

	mutex_unlock(&lec_mutex);

}



static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos)