From 7b9501c21752e4993e39280273db1f8ffdbc4498 Mon Sep 17 00:00:00 2001 From: Lin Ma Date: Fri, 29 Apr 2022 03:33:47 +0000 Subject: [PATCH] hamradio: defer ax25 kfree after unregister_netdev stable inclusion from stable-v4.19.223 commit 896193a02a2981e60c40d4614fd095ce92135ccd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I55483 CVE: CVE-2022-1195 ------------------------------------------------- commit 3e0588c291d6ce225f2b891753ca41d45ba42469 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) ax25_sendmsg | ax25_queue_xmit | dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | mkiss_close ax_xmit | kfree ax_encaps | | Even though there are two synchronization primitives before the kfree: 1. wait_for_completion(&ax->dead). This can prevent the race with routines from mkiss_ioctl. However, it cannot stop the routine coming from upper layer, i.e., the ax25_sendmsg. 2. netif_stop_queue(ax->dev). It seems that this line of code aims to halt the transmit queue but it fails to stop the routine that already being xmit. This patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Huang Guobin Reviewed-by: Wei Yongjun Reviewed-by: Xiu Jianfeng Signed-off-by: Yongqiang Liu --- drivers/net/hamradio/mkiss.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 3b14e6e281d4..cc977d0cb2d9 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -803,13 +803,13 @@ static void mkiss_close(struct tty_struct *tty) */ netif_stop_queue(ax->dev); - /* Free all AX25 frame buffers. */ - kfree(ax->rbuff); - kfree(ax->xbuff); - ax->tty = NULL; unregister_netdev(ax->dev); + + /* Free all AX25 frame buffers. */ + kfree(ax->rbuff); + kfree(ax->xbuff); } /* Perform I/O control on an active ax25 channel. */ -- GitLab