mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
1,156,947 Commits 103 Branches 5,012 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Shigeru Yoshida d1a11bbdbb net: caif: Fix use-after-free in cfusbl_device_notify() 
[ Upstream commit 9781e98a97 ]

syzbot reported use-after-free in cfusbl_device_notify() [1].  This
causes a stack trace like below:

BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214

CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
 call_netdevice_notifiers net/core/dev.c:1997 [inline]
 netdev_wait_allrefs_any net/core/dev.c:10227 [inline]
 netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341
 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

When unregistering a net device, unregister_netdevice_many_notify()
sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers
with NETDEV_UNREGISTER, and adds the device to the todo list.

Later on, devices in the todo list are processed by netdev_run_todo().
netdev_run_todo() waits devices' reference count become 1 while
rebdoadcasting NETDEV_UNREGISTER notification.

When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple
times, the parent device might be freed.  This could cause UAF.
Processing NETDEV_UNREGISTER multiple times also causes inbalance of
reference count for the module.

This patch fixes the issue by accepting only first NETDEV_UNREGISTER
notification.

Fixes: 7ad65bf68d ("caif: Add support for CAIF over CDC NCM USB interface")
CC: sjur.brandeland@stericsson.com <sjur.brandeland@stericsson.com>
Reported-by: syzbot+b563d33852b893653a9e@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=c3bfd8e2450adab3bffe4d80821fbbced600407f [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Link: https://lore.kernel.org/r/20230301163913.391304-1-syoshida@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-03-17 08:57:54 +01:00
Documentation usb: gadget: uvc: Make bSourceID read/write 2023-03-11 13:50:44 +01:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
arch powerpc: dts: t1040rdb: fix compatible string for Rev A boards 2023-03-17 08:57:52 +01:00
block block: fix scan partition for exclusively open device again 2023-03-17 08:57:50 +01:00
certs certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-31 17:53:01 +09:00
crypto crypto: rsa-pkcs1pad - Use akcipher_request_complete 2023-03-10 09:28:18 +01:00
drivers net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver 2023-03-17 08:57:53 +01:00
fs ext4: Fix possible corruption when moving a directory 2023-03-17 08:57:51 +01:00
include bus: mhi: ep: Change state_lock to mutex 2023-03-17 08:57:49 +01:00
init Kbuild fixes for v6.2 (3rd) 2023-01-21 10:56:37 -08:00
io_uring io_uring/uring_cmd: ensure that device supports IOPOLL 2023-03-17 08:57:45 +01:00
ipc Non-MM patches for 6.2-rc1. 2022-12-12 17:28:58 -08:00
kernel fork: allow CLONE_NEWTIME in clone3 flags 2023-03-17 08:57:46 +01:00
lib cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG 2023-03-10 09:29:06 +01:00
mm memory tier: release the new_memtier in find_create_memory_tier() 2023-03-10 09:29:50 +01:00
net net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:57:54 +01:00
rust rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks 2023-01-16 00:54:35 +01:00
samples ftrace: Export ftrace_free_filter() to modules 2023-01-24 11:20:58 -05:00
scripts gcc-plugins: drop -std=gnu++11 to fix GCC 13 build 2023-03-10 09:29:11 +01:00
security ima: Align ima_file_mmap() parameters with mmap_file LSM hook 2023-03-10 09:29:36 +01:00
sound ASoC: mediatek: mt8195: add missing initialization 2023-03-11 13:50:37 +01:00
tools perf stat: Fix counting when initial delay configured 2023-03-17 08:57:53 +01:00
usr usr/gen_init_cpio.c: remove unnecessary -1 values from int file 2022-10-03 14:21:44 -07:00
virt KVM: Register /dev/kvm as the _very_ last thing during initialization 2023-03-10 09:29:33 +01:00
.clang-format iommufd for 6.2 2022-12-14 09:15:43 -08:00
.cocciconfig
…
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore *.rpm 2022-12-30 17:22:14 +09:00
.mailmap 12 hotfixes, mostly against mm/. Five of these fixes are cc:stable. 2023-02-13 14:09:20 -08:00
.rustfmt.toml rust: add `.rustfmt.toml` 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: update SCTP maintainers 2023-02-02 11:35:33 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS audit: update the mailing list in MAINTAINERS 2023-02-25 11:13:29 +01:00
Makefile Linux 6.2.6 2023-03-13 10:26:43 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.