Commit 501c8f5e authored by David S. Miller's avatar David S. Miller

Merge branch 'ax25-fixes'

Duoming Zhou says:

====================
ax25: fix NPD and UAF bugs when detaching ax25 device

There are NPD and UAF bugs when detaching ax25 device, we
use lock and refcount to mitigate these bugs.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 928d6fe9 d01ffb9e
...@@ -239,6 +239,7 @@ typedef struct ax25_dev { ...@@ -239,6 +239,7 @@ typedef struct ax25_dev {
#if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER) #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER)
ax25_dama_info dama; ax25_dama_info dama;
#endif #endif
refcount_t refcount;
} ax25_dev; } ax25_dev;
typedef struct ax25_cb { typedef struct ax25_cb {
...@@ -293,6 +294,15 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25) ...@@ -293,6 +294,15 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25)
} }
} }
#define ax25_dev_hold(__ax25_dev) \
refcount_inc(&((__ax25_dev)->refcount))
static __inline__ void ax25_dev_put(ax25_dev *ax25_dev)
{
if (refcount_dec_and_test(&ax25_dev->refcount)) {
kfree(ax25_dev);
}
}
static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev) static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev)
{ {
skb->dev = dev; skb->dev = dev;
......
...@@ -77,6 +77,7 @@ static void ax25_kill_by_device(struct net_device *dev) ...@@ -77,6 +77,7 @@ static void ax25_kill_by_device(struct net_device *dev)
{ {
ax25_dev *ax25_dev; ax25_dev *ax25_dev;
ax25_cb *s; ax25_cb *s;
struct sock *sk;
if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
return; return;
...@@ -85,13 +86,16 @@ static void ax25_kill_by_device(struct net_device *dev) ...@@ -85,13 +86,16 @@ static void ax25_kill_by_device(struct net_device *dev)
again: again:
ax25_for_each(s, &ax25_list) { ax25_for_each(s, &ax25_list) {
if (s->ax25_dev == ax25_dev) { if (s->ax25_dev == ax25_dev) {
sk = s->sk;
sock_hold(sk);
spin_unlock_bh(&ax25_list_lock); spin_unlock_bh(&ax25_list_lock);
lock_sock(s->sk); lock_sock(sk);
s->ax25_dev = NULL; s->ax25_dev = NULL;
release_sock(s->sk); ax25_dev_put(ax25_dev);
release_sock(sk);
ax25_disconnect(s, ENETUNREACH); ax25_disconnect(s, ENETUNREACH);
spin_lock_bh(&ax25_list_lock); spin_lock_bh(&ax25_list_lock);
sock_put(sk);
/* The entry could have been deleted from the /* The entry could have been deleted from the
* list meanwhile and thus the next pointer is * list meanwhile and thus the next pointer is
* no longer valid. Play it safe and restart * no longer valid. Play it safe and restart
...@@ -436,6 +440,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) ...@@ -436,6 +440,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
} }
out_put: out_put:
ax25_dev_put(ax25_dev);
ax25_cb_put(ax25); ax25_cb_put(ax25);
return ret; return ret;
......
...@@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) ...@@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) { if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) {
res = ax25_dev; res = ax25_dev;
ax25_dev_hold(ax25_dev);
} }
spin_unlock_bh(&ax25_dev_lock); spin_unlock_bh(&ax25_dev_lock);
...@@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_device *dev) ...@@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_device *dev)
return; return;
} }
refcount_set(&ax25_dev->refcount, 1);
dev->ax25_ptr = ax25_dev; dev->ax25_ptr = ax25_dev;
ax25_dev->dev = dev; ax25_dev->dev = dev;
dev_hold_track(dev, &ax25_dev->dev_tracker, GFP_ATOMIC); dev_hold_track(dev, &ax25_dev->dev_tracker, GFP_ATOMIC);
...@@ -83,6 +85,7 @@ void ax25_dev_device_up(struct net_device *dev) ...@@ -83,6 +85,7 @@ void ax25_dev_device_up(struct net_device *dev)
spin_lock_bh(&ax25_dev_lock); spin_lock_bh(&ax25_dev_lock);
ax25_dev->next = ax25_dev_list; ax25_dev->next = ax25_dev_list;
ax25_dev_list = ax25_dev; ax25_dev_list = ax25_dev;
ax25_dev_hold(ax25_dev);
spin_unlock_bh(&ax25_dev_lock); spin_unlock_bh(&ax25_dev_lock);
ax25_register_dev_sysctl(ax25_dev); ax25_register_dev_sysctl(ax25_dev);
...@@ -112,20 +115,22 @@ void ax25_dev_device_down(struct net_device *dev) ...@@ -112,20 +115,22 @@ void ax25_dev_device_down(struct net_device *dev)
if ((s = ax25_dev_list) == ax25_dev) { if ((s = ax25_dev_list) == ax25_dev) {
ax25_dev_list = s->next; ax25_dev_list = s->next;
ax25_dev_put(ax25_dev);
spin_unlock_bh(&ax25_dev_lock); spin_unlock_bh(&ax25_dev_lock);
dev->ax25_ptr = NULL; dev->ax25_ptr = NULL;
dev_put_track(dev, &ax25_dev->dev_tracker); dev_put_track(dev, &ax25_dev->dev_tracker);
kfree(ax25_dev); ax25_dev_put(ax25_dev);
return; return;
} }
while (s != NULL && s->next != NULL) { while (s != NULL && s->next != NULL) {
if (s->next == ax25_dev) { if (s->next == ax25_dev) {
s->next = ax25_dev->next; s->next = ax25_dev->next;
ax25_dev_put(ax25_dev);
spin_unlock_bh(&ax25_dev_lock); spin_unlock_bh(&ax25_dev_lock);
dev->ax25_ptr = NULL; dev->ax25_ptr = NULL;
dev_put_track(dev, &ax25_dev->dev_tracker); dev_put_track(dev, &ax25_dev->dev_tracker);
kfree(ax25_dev); ax25_dev_put(ax25_dev);
return; return;
} }
...@@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_device *dev) ...@@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_device *dev)
} }
spin_unlock_bh(&ax25_dev_lock); spin_unlock_bh(&ax25_dev_lock);
dev->ax25_ptr = NULL; dev->ax25_ptr = NULL;
ax25_dev_put(ax25_dev);
} }
int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
...@@ -149,6 +155,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) ...@@ -149,6 +155,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
if (ax25_dev->forward != NULL) if (ax25_dev->forward != NULL)
return -EINVAL; return -EINVAL;
ax25_dev->forward = fwd_dev->dev; ax25_dev->forward = fwd_dev->dev;
ax25_dev_put(fwd_dev);
break; break;
case SIOCAX25DELFWD: case SIOCAX25DELFWD:
...@@ -161,6 +168,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) ...@@ -161,6 +168,7 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
return -EINVAL; return -EINVAL;
} }
ax25_dev_put(ax25_dev);
return 0; return 0;
} }
......
...@@ -116,6 +116,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) ...@@ -116,6 +116,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
ax25_rt->dev = ax25_dev->dev; ax25_rt->dev = ax25_dev->dev;
ax25_rt->digipeat = NULL; ax25_rt->digipeat = NULL;
ax25_rt->ip_mode = ' '; ax25_rt->ip_mode = ' ';
ax25_dev_put(ax25_dev);
if (route->digi_count != 0) { if (route->digi_count != 0) {
if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) { if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
write_unlock_bh(&ax25_route_lock); write_unlock_bh(&ax25_route_lock);
...@@ -172,6 +173,7 @@ static int ax25_rt_del(struct ax25_routes_struct *route) ...@@ -172,6 +173,7 @@ static int ax25_rt_del(struct ax25_routes_struct *route)
} }
} }
} }
ax25_dev_put(ax25_dev);
write_unlock_bh(&ax25_route_lock); write_unlock_bh(&ax25_route_lock);
return 0; return 0;
...@@ -214,6 +216,7 @@ static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option) ...@@ -214,6 +216,7 @@ static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option)
} }
out: out:
ax25_dev_put(ax25_dev);
write_unlock_bh(&ax25_route_lock); write_unlock_bh(&ax25_route_lock);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment