diff mbox series

[net] net: read dev->needs_free_netdev before potentially freeing dev

Message ID 20200824200650.21982-1-Jason@zx2c4.com
State Rejected
Delegated to: David Miller
Headers show
Series [net] net: read dev->needs_free_netdev before potentially freeing dev | expand

Commit Message

Jason A. Donenfeld Aug. 24, 2020, 8:06 p.m. UTC
If dev->needs_free_netdev is true, it means that netdev_run_todo should
call free_netdev(dev) after it calls dev->priv_destructor. If
dev->needs_free_netdev is false, then it means that either
dev->priv_destructor is taking care of calling free_netdev(dev), or
something else, elsewhere, is doing that. In this case, branching on
"if (dev->needs_free_netdev)" after calling dev->priv_destructor is a
potential UaF. This patch fixes the issue by reading
dev->needs_free_netdev before calling dev->priv_destructor.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.")
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
I believe that the bug Dan reported would easily be fixed as well by
just setting dev->needs_free_netdev=true and removing the call to
free_netdev(dev) in wg_destruct, in wireguard. If you think that this is
the more proper fix -- and that the problem actually isn't this flow in
dev.c and any code that might hit this UaF is wrong -- let me know and
I'll send in a patch for wireguard instead.

 net/core/dev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Jason A. Donenfeld Aug. 24, 2020, 8:35 p.m. UTC | #1
On Mon, Aug 24, 2020 at 10:07 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> I believe that the bug Dan reported would easily be fixed as well by
> just setting dev->needs_free_netdev=true and removing the call to
> free_netdev(dev) in wg_destruct, in wireguard. If you think that this is
> the more proper fix -- and that the problem actually isn't this flow in
> dev.c and any code that might hit this UaF is wrong -- let me know and
> I'll send in a patch for wireguard instead.

I think ppp might be hit by the same bug, actually.
netdev_run_todo->ppp_dev_priv_destructor()->ppp_destroy_interface()->free_netdev(dev),
followed by "if (dev->needs_free_netdev)".
Dan Carpenter Aug. 25, 2020, 8:24 a.m. UTC | #2
On Mon, Aug 24, 2020 at 10:06:50PM +0200, Jason A. Donenfeld wrote:
> If dev->needs_free_netdev is true, it means that netdev_run_todo should
> call free_netdev(dev) after it calls dev->priv_destructor. If
> dev->needs_free_netdev is false, then it means that either
> dev->priv_destructor is taking care of calling free_netdev(dev), or
> something else, elsewhere, is doing that. In this case, branching on
> "if (dev->needs_free_netdev)" after calling dev->priv_destructor is a
> potential UaF. This patch fixes the issue by reading
> dev->needs_free_netdev before calling dev->priv_destructor.
> 

No, I misread the code.  Sorry.  This patch is not required.  We can
use "dev" up to the end of the function where we do:

		/* Free network device */
		kobject_put(&dev->dev.kobj);

That's where the final reference is released.

regards,
dan carpenter
diff mbox series

Patch

diff --git a/net/core/dev.c b/net/core/dev.c
index 7df6c9617321..abe53c2fae8c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10073,6 +10073,8 @@  void netdev_run_todo(void)
 	while (!list_empty(&list)) {
 		struct net_device *dev
 			= list_first_entry(&list, struct net_device, todo_list);
+		bool needs_free_netdev = dev->needs_free_netdev;
+
 		list_del(&dev->todo_list);
 
 		if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
@@ -10097,7 +10099,7 @@  void netdev_run_todo(void)
 #endif
 		if (dev->priv_destructor)
 			dev->priv_destructor(dev);
-		if (dev->needs_free_netdev)
+		if (needs_free_netdev)
 			free_netdev(dev);
 
 		/* Report a network device has been unregistered */