ax25: add refcount in ax25_dev to avoid UAF bugs

[mirror_ubuntu-jammy-kernel.git] / net / ax25 / ax25_dev.c

diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index 4ac2e0847652a9426b5acf2ebc618520fbaf1751..2c845ff1d036c10303f3a41e393d640c0bfcb828 100644 (file)
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
        for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
                if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) == 0) {
                        res = ax25_dev;
+                       ax25_dev_hold(ax25_dev);
                }
        spin_unlock_bh(&ax25_dev_lock);
 
@@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_device *dev)
                return;
        }
 
+       refcount_set(&ax25_dev->refcount, 1);
        dev->ax25_ptr     = ax25_dev;
        ax25_dev->dev     = dev;
        dev_hold(dev);
@@ -83,6 +85,7 @@ void ax25_dev_device_up(struct net_device *dev)
        spin_lock_bh(&ax25_dev_lock);
        ax25_dev->next = ax25_dev_list;
        ax25_dev_list  = ax25_dev;
+       ax25_dev_hold(ax25_dev);
        spin_unlock_bh(&ax25_dev_lock);
 
        ax25_register_dev_sysctl(ax25_dev);
@@ -112,20 +115,22 @@ void ax25_dev_device_down(struct net_device *dev)
 
        if ((s = ax25_dev_list) == ax25_dev) {
                ax25_dev_list = s->next;
+               ax25_dev_put(ax25_dev);
                spin_unlock_bh(&ax25_dev_lock);
                dev->ax25_ptr = NULL;
                dev_put(dev);
-               kfree(ax25_dev);
+               ax25_dev_put(ax25_dev);
                return;
        }
 
        while (s != NULL && s->next != NULL) {
                if (s->next == ax25_dev) {
                        s->next = ax25_dev->next;
+                       ax25_dev_put(ax25_dev);
                        spin_unlock_bh(&ax25_dev_lock);
                        dev->ax25_ptr = NULL;
                        dev_put(dev);
-                       kfree(ax25_dev);
+                       ax25_dev_put(ax25_dev);
                        return;
                }
 
@@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_device *dev)
        }
        spin_unlock_bh(&ax25_dev_lock);
        dev->ax25_ptr = NULL;
+       ax25_dev_put(ax25_dev);
 }
 
 int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
@@ -149,6 +155,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
                if (ax25_dev->forward != NULL)
                        return -EINVAL;
                ax25_dev->forward = fwd_dev->dev;
+               ax25_dev_put(fwd_dev);
                break;
 
        case SIOCAX25DELFWD:
@@ -161,6 +168,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
                return -EINVAL;
        }
 
+       ax25_dev_put(ax25_dev);
        return 0;
 }