]> www.infradead.org Git - users/dwmw2/linux.git/commit
net: fix use-after-free in the netdev_nl_sock_priv_destroy()
authorTaehee Yoo <ap420073@gmail.com>
Fri, 28 Mar 2025 06:22:37 +0000 (06:22 +0000)
committerJakub Kicinski <kuba@kernel.org>
Mon, 31 Mar 2025 23:44:49 +0000 (16:44 -0700)
commit42f342387841891bbbd15e25d33eb510a0cf7a9a
tree7e2f5ac3ca3a21fb6e478630c0453a46b9ac7c95
parent5c6052802dfbae291ce9032636fb2f7bd0c705e3
net: fix use-after-free in the netdev_nl_sock_priv_destroy()

In the netdev_nl_sock_priv_destroy(), an instance lock is acquired
before calling net_devmem_unbind_dmabuf(), then releasing an instance
lock(netdev_unlock(binding->dev)).
However, a binding is freed in the net_devmem_unbind_dmabuf().
So using a binding after net_devmem_unbind_dmabuf() occurs UAF.
To fix this UAF, it needs to use temporary variable.

Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250328062237.3746875-1-ap420073@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/core/netdev-genl.c