Lin Ma f81270125b NFC: NULL out the dev->rfkill to prevent UAF ... [ Upstream commit 1b0e81416a ] Commit 3e3b5dfcd1 ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced. The crash trace in latest kernel (5.18-rc2): [ 68.760105] ================================================================== [ 68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750 [ 68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313 [ 68.760756] [ 68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4 [ 68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 68.760756] Call Trace: [ 68.760756] <TASK> [ 68.760756] dump_stack_lvl+0x57/0x7d [ 68.760756] print_report.cold+0x5e/0x5db [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] kasan_report+0xbe/0x1c0 [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] __lock_acquire+0x3ec1/0x6750 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? register_lock_class+0x18d0/0x18d0 [ 68.760756] lock_acquire+0x1ac/0x4f0 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? mutex_lock_io_nested+0x12c0/0x12c0 [ 68.760756] ? nla_get_range_signed+0x540/0x540 [ 68.760756] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 68.760756] _raw_spin_lock_irqsave+0x39/0x50 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] rfkill_blocked+0xe/0x60 [ 68.760756] nfc_dev_up+0x84/0x260 [ 68.760756] nfc_genl_dev_up+0x90/0xe0 [ 68.760756] genl_family_rcv_msg_doit+0x1f4/0x2f0 [ 68.760756] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230 [ 68.760756] ? security_capable+0x51/0x90 [ 68.760756] genl_rcv_msg+0x280/0x500 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? lock_acquire+0x1ac/0x4f0 [ 68.760756] ? nfc_genl_dev_down+0xe0/0xe0 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] netlink_rcv_skb+0x11b/0x340 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? netlink_ack+0x9c0/0x9c0 [ 68.760756] ? netlink_deliver_tap+0x136/0xb00 [ 68.760756] genl_rcv+0x1f/0x30 [ 68.760756] netlink_unicast+0x430/0x710 [ 68.760756] ? memset+0x20/0x40 [ 68.760756] ? netlink_attachskb+0x740/0x740 [ 68.760756] ? __build_skb_around+0x1f4/0x2a0 [ 68.760756] netlink_sendmsg+0x75d/0xc00 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] sock_sendmsg+0xdf/0x110 [ 68.760756] __sys_sendto+0x19e/0x270 [ 68.760756] ? __ia32_sys_getpeername+0xa0/0xa0 [ 68.760756] ? fd_install+0x178/0x4c0 [ 68.760756] ? fd_install+0x195/0x4c0 [ 68.760756] ? kernel_fpu_begin_mask+0x1c0/0x1c0 [ 68.760756] __x64_sys_sendto+0xd8/0x1b0 [ 68.760756] ? lockdep_hardirqs_on+0xbf/0x130 [ 68.760756] ? syscall_enter_from_user_mode+0x1d/0x50 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] RIP: 0033:0x7f67fb50e6b3 ... [ 68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3 [ 68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003 [ 68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c [ 68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e [ 68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003 [ 68.760756] </TASK> [ 68.760756] [ 68.760756] Allocated by task 279: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] __kasan_kmalloc+0x81/0xa0 [ 68.760756] rfkill_alloc+0x7f/0x280 [ 68.760756] nfc_register_device+0xa3/0x1a0 [ 68.760756] nci_register_device+0x77a/0xad0 [ 68.760756] nfcmrvl_nci_register_dev+0x20b/0x2c0 [ 68.760756] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 68.760756] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 68.760756] tty_ioctl+0x764/0x1310 [ 68.760756] __x64_sys_ioctl+0x122/0x190 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] [ 68.760756] Freed by task 314: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] kasan_set_track+0x21/0x30 [ 68.760756] kasan_set_free_info+0x20/0x30 [ 68.760756] __kasan_slab_free+0x108/0x170 [ 68.760756] kfree+0xb0/0x330 [ 68.760756] device_release+0x96/0x200 [ 68.760756] kobject_put+0xf9/0x1d0 [ 68.760756] nfc_unregister_device+0x77/0x190 [ 68.760756] nfcmrvl_nci_unregister_dev+0x88/0xd0 [ 68.760756] nci_uart_tty_close+0xdf/0x180 [ 68.760756] tty_ldisc_kill+0x73/0x110 [ 68.760756] tty_ldisc_hangup+0x281/0x5b0 [ 68.760756] __tty_hangup.part.0+0x431/0x890 [ 68.760756] tty_release+0x3a8/0xc80 [ 68.760756] __fput+0x1f0/0x8c0 [ 68.760756] task_work_run+0xc9/0x170 [ 68.760756] exit_to_user_mode_prepare+0x194/0x1a0 [ 68.760756] syscall_exit_to_user_mode+0x19/0x50 [ 68.760756] do_syscall_64+0x48/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae This patch just add the null out of dev->rfkill to make sure such dereference cannot happen. This is safe since the device_lock() already protect the check/write from data race. Fixes: 3e3b5dfcd1 ("NFC: reorder the logic in nfc_{un,}register_device") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-14 16:53:48 +02:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:46:30 +01:00
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 10:13:33 +01:00
802	net/802/garp: fix memleak in garp_request_join()	2021-08-04 12:22:14 +02:00
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 13:58:58 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 12:47:02 +02:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:12:42 +02:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-27 13:15:32 +02:00
batman-adv	batman-adv: Don't skb_split skbuffs with frag_list	2022-05-18 09:18:05 +02:00
bluetooth	Bluetooth: Fix the creation of hdev->name	2022-05-15 19:40:26 +02:00
bpf	bpf: fix panic due to oob in bpf_prog_test_run_skb	2021-12-22 09:17:58 +01:00
bridge	net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.	2022-05-25 08:41:20 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 11:45:33 +02:00
can	net: add missing SOF_TIMESTAMPING_OPT_ID support	2022-04-20 09:08:28 +02:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:07:03 +01:00
core	bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes	2022-06-06 08:20:58 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:01:58 +01:00
dccp	tcp: fix race condition when creating child sockets from syncookies	2022-04-27 13:15:29 +02:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 11:12:18 +02:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-24 08:01:25 +02:00
dsa	net: dsa: Fix duplicate frames flooded by learning	2020-04-02 16:34:24 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:17:59 +01:00
hsr	hsr: use netdev_err() instead of WARN_ONCE()	2021-05-22 10:57:24 +02:00
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:16:29 +01:00
ife
ipv4	secure_seq: use the 64 bits of the siphash for port offset calculation	2022-06-06 08:20:56 +02:00
ipv6	ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL	2022-06-14 16:53:45 +02:00
ipx
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-12-08 10:17:32 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:37:45 +02:00
key	net: af_key: check encryption module availability consistency	2022-06-06 08:20:56 +02:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 11:45:33 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:12:08 +01:00
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 08:22:27 +02:00
mac80211	mac80211: fix rx reordering with non explicit / psmp ack policy	2022-05-25 08:41:21 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-16 11:57:52 +02:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 08:46:55 +01:00
ncsi	net/ncsi: Avoid GFP_KERNEL in response handler	2021-04-16 11:57:51 +02:00
netfilter	ipvs: correctly print the memory size of ip_vs_conn_tab	2022-05-12 12:17:06 +02:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-22 11:45:32 +02:00
netlink	netlink: do not reset transport header in netlink_recvmsg()	2022-05-18 09:18:05 +02:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 11:12:18 +02:00
nfc	NFC: NULL out the dev->rfkill to prevent UAF	2022-06-14 16:53:48 +02:00
nsh
openvswitch	openvswitch: fix OOB access in reserve_sfa_size()	2022-04-27 13:15:31 +02:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-27 13:15:29 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 13:57:37 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 15:38:15 +01:00
qrtr	net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()	2021-03-30 14:40:12 +02:00
rds	net/rds: correct socket tunable error in rds_tcp_tune()	2021-12-08 08:46:55 +01:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:11:57 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-12-08 10:17:32 +01:00
rxrpc	rxrpc: Return an error to sendmsg if call failed	2022-06-14 16:53:46 +02:00
sched	net/sched: cls_u32: fix netns refcount changes in u32_change()	2022-05-12 12:17:04 +02:00
sctp	sctp: check asoc strreset_chunk in sctp_generate_reconf_event	2022-05-12 12:17:07 +02:00
smc	net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending	2022-05-18 09:18:06 +02:00
strparser
sunrpc	Revert "SUNRPC: attempt AF_LOCAL connect on setup"	2022-05-12 12:17:09 +02:00
switchdev
tipc	tipc: rate limit warning for received illegal binding update	2022-02-16 12:44:51 +01:00
tls	net/tls: Fixed return value when tls_complete_pending_work() fails	2018-12-05 19:41:11 +01:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 09:01:00 +01:00
vmw_vsock	vsock: remove vsock from connected table when connect is interrupted by a signal	2022-02-23 11:57:34 +01:00
wimax
wireless	nl80211: Update bss channel on channel switch for P2P_CLIENT	2022-03-23 09:01:34 +01:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-20 09:08:21 +02:00
xfrm	xfrm: policy: match with both mark and mask on user interfaces	2022-04-20 09:08:31 +02:00
compat.c	net: Return the correct errno code	2021-06-30 08:48:47 -04:00
Kconfig
Makefile	net: split out functions related to registering inflight socket files	2021-08-04 12:22:14 +02:00
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-21 09:48:14 +02:00
sysctl_net.c