From: Taehee Yoo Date: Fri, 28 Mar 2025 06:22:37 +0000 (+0000) Subject: net: fix use-after-free in the netdev_nl_sock_priv_destroy() X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=42f342387841891bbbd15e25d33eb510a0cf7a9a;p=users%2Fhch%2Fmisc.git net: fix use-after-free in the netdev_nl_sock_priv_destroy() In the netdev_nl_sock_priv_destroy(), an instance lock is acquired before calling net_devmem_unbind_dmabuf(), then releasing an instance lock(netdev_unlock(binding->dev)). However, a binding is freed in the net_devmem_unbind_dmabuf(). So using a binding after net_devmem_unbind_dmabuf() occurs UAF. To fix this UAF, it needs to use temporary variable. Fixes: ba6f418fbf64 ("net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf()") Signed-off-by: Taehee Yoo Reviewed-by: Jakub Kicinski Reviewed-by: Mina Almasry Reviewed-by: Xuan Zhuo Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250328062237.3746875-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski --- diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c index fd1cfa9707dc..3afeaa8c5dc5 100644 --- a/net/core/netdev-genl.c +++ b/net/core/netdev-genl.c @@ -951,12 +951,14 @@ void netdev_nl_sock_priv_destroy(struct netdev_nl_sock *priv) { struct net_devmem_dmabuf_binding *binding; struct net_devmem_dmabuf_binding *temp; + struct net_device *dev; mutex_lock(&priv->lock); list_for_each_entry_safe(binding, temp, &priv->bindings, list) { - netdev_lock(binding->dev); + dev = binding->dev; + netdev_lock(dev); net_devmem_unbind_dmabuf(binding); - netdev_unlock(binding->dev); + netdev_unlock(dev); } mutex_unlock(&priv->lock); }