lkml.org 
[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 006/125] net: qualcomm: rmnet: Fix potential UAF when unregistering
    Date
    From: Sean Tranchetti <stranche@codeaurora.org>

    [ Upstream commit e7a86c687e64ab24f88330ad24ecc9442ce40c5a ]

    During the exit/unregistration process of the RmNet driver, the function
    rmnet_unregister_real_device() is called to handle freeing the driver's
    internal state and removing the RX handler on the underlying physical
    device. However, the order of operations this function performs is wrong
    and can lead to a use after free of the rmnet_port structure.

    Before calling netdev_rx_handler_unregister(), this port structure is
    freed with kfree(). If packets are received on any RmNet devices before
    synchronize_net() completes, they will attempt to use this already-freed
    port structure when processing the packet. As such, before cleaning up any
    other internal state, the RX handler must be unregistered in order to
    guarantee that no further packets will arrive on the device.

    Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
    Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
    +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
    @@ -66,10 +66,10 @@ static int rmnet_unregister_real_device(
    if (port->nr_rmnet_devs)
    return -EINVAL;

    - kfree(port);
    -
    netdev_rx_handler_unregister(real_dev);

    + kfree(port);
    +
    /* release reference on real_dev */
    dev_put(real_dev);


    \
     
     \ /
      Last update: 2019-11-11 20:05    [W:2.552 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site