]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
ax25: add refcount in ax25_dev to avoid UAF bugs
authorDuoming Zhou <duoming@zju.edu.cn>
Fri, 28 Jan 2022 04:47:16 +0000 (12:47 +0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 28 Jan 2022 14:56:47 +0000 (14:56 +0000)
commitd01ffb9eee4af165d83b08dd73ebdf9fe94a519b
treeae3be0b158b4a7dfb2162956ca6b63f22a3eb6c2
parent4e0f718daf97d47cf7dec122da1be970f145c809
ax25: add refcount in ax25_dev to avoid UAF bugs

If we dereference ax25_dev after we call kfree(ax25_dev) in
ax25_dev_device_down(), it will lead to concurrency UAF bugs.
There are eight syscall functions suffer from UAF bugs, include
ax25_bind(), ax25_release(), ax25_connect(), ax25_ioctl(),
ax25_getname(), ax25_sendmsg(), ax25_getsockopt() and
ax25_info_show().

One of the concurrency UAF can be shown as below:

  (USE)                       |    (FREE)
                              |  ax25_device_event
                              |    ax25_dev_device_down
ax25_bind                     |    ...
  ...                         |      kfree(ax25_dev)
  ax25_fillin_cb()            |    ...
    ax25_fillin_cb_from_dev() |
  ...                         |

The root cause of UAF bugs is that kfree(ax25_dev) in
ax25_dev_device_down() is not protected by any locks.
When ax25_dev, which there are still pointers point to,
is released, the concurrency UAF bug will happen.

This patch introduces refcount into ax25_dev in order to
guarantee that there are no pointers point to it when ax25_dev
is released.

Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/ax25.h
net/ax25/af_ax25.c
net/ax25/ax25_dev.c
net/ax25/ax25_route.c