korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-24 12:44:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
48f044a784
linux/net/ax25
History
Duoming Zhou fd819ad3ec ax25: fix use-after-free bugs caused by ax25_ds_del_timer 
When the ax25 device is detaching, the ax25_dev_device_down()
calls ax25_ds_del_timer() to cleanup the slave_timer. When
the timer handler is running, the ax25_ds_del_timer() that
calls del_timer() in it will return directly. As a result,
the use-after-free bugs could happen, one of the scenarios
is shown below:

      (Thread 1)          |      (Thread 2)
                          | ax25_ds_timeout()
ax25_dev_device_down()    |
  ax25_ds_del_timer()     |
    del_timer()           |
  ax25_dev_put() //FREE   |
                          |  ax25_dev-> //USE

In order to mitigate bugs, when the device is detaching, use
timer_shutdown_sync() to stop the timer.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240329015023.9223-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-04-02 17:59:44 -07:00
..
af_ax25.c net: implement lockless SO_PRIORITY 2023-10-01 19:09:54 +01:00
ax25_addr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_dev.c ax25: fix use-after-free bugs caused by ax25_ds_del_timer 2024-04-02 17:59:44 -07:00
ax25_ds_in.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_ds_subr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_ds_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_iface.c ax25: constify dev_addr passing 2021-10-13 09:40:45 -07:00
ax25_in.c ax25: constify dev_addr passing 2021-10-13 09:40:45 -07:00
ax25_ip.c ax25: use skb_expand_head 2021-08-03 11:21:39 +01:00
ax25_out.c ax25: constify dev_addr passing 2021-10-13 09:40:45 -07:00
ax25_route.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-02-03 17:36:16 -08:00
ax25_std_in.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_std_subr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_std_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ax25_subr.c ax25: Fix ax25 session cleanup problems 2022-06-02 10:37:57 +02:00
ax25_timer.c net: avoid overflow when rose /proc displays timer information. 2022-08-05 19:00:02 -07:00
ax25_uid.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
Kconfig ax25: Kconfig: Update link for linux-ax25.org 2023-09-18 12:56:58 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysctl_net_ax25.c ax.25: Update to register_net_sysctl_sz 2023-08-15 15:26:17 -07:00