Eric Dumazet d7c4c9e075 ax25: fix incorrect dev_tracker usage ... While investigating a separate rose issue [1], and enabling CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] An ax25_dev can be used by one (or many) struct ax25_cb. We thus need different dev_tracker, one per struct ax25_cb. After this patch is applied, we are able to focus on rose. [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ [2] [ 205.798723] reference already released. [ 205.798732] allocated in: [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] [ 205.798747] __sys_bind+0xea/0x110 [ 205.798753] __x64_sys_bind+0x18/0x20 [ 205.798758] do_syscall_64+0x5c/0x80 [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798768] freed in: [ 205.798770] ax25_release+0x115/0x370 [ax25] [ 205.798778] __sock_release+0x42/0xb0 [ 205.798782] sock_close+0x15/0x20 [ 205.798785] __fput+0x9f/0x260 [ 205.798789] ____fput+0xe/0x10 [ 205.798792] task_work_run+0x64/0xa0 [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 [ 205.798808] do_syscall_64+0x69/0x80 [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798827] ------------[ cut here ]------------ [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 [ 205.799033] Call Trace: [ 205.799035] <TASK> [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 [ 205.799065] ? dev_close_many+0xc8/0x120 [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 [ 205.799076] ? unregister_netdev+0x1d/0x30 [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] [ 205.799084] ? tty_ldisc_close+0x2e/0x40 [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 [ 205.799098] ? tty_vhangup+0x15/0x20 [ 205.799103] ? pty_close+0x127/0x160 [ 205.799108] ? tty_release+0x139/0x5e0 [ 205.799112] ? __fput+0x9f/0x260 [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] [ 205.799135] raw_notifier_call_chain+0x49/0x60 [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 [ 205.799146] dev_close_many+0xc8/0x120 [ 205.799152] unregister_netdevice_many+0x13d/0x890 [ 205.799157] unregister_netdevice_queue+0x90/0xe0 [ 205.799161] unregister_netdev+0x1d/0x30 [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] [ 205.799170] tty_ldisc_close+0x2e/0x40 [ 205.799173] tty_ldisc_hangup+0x137/0x210 [ 205.799178] __tty_hangup.part.0+0x208/0x350 [ 205.799184] tty_vhangup+0x15/0x20 [ 205.799188] pty_close+0x127/0x160 [ 205.799193] tty_release+0x139/0x5e0 [ 205.799199] __fput+0x9f/0x260 [ 205.799203] ____fput+0xe/0x10 [ 205.799208] task_work_run+0x64/0xa0 [ 205.799213] do_exit+0x33b/0xab0 [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 [ 205.799224] do_group_exit+0x35/0xa0 [ 205.799228] __x64_sys_exit_group+0x18/0x20 [ 205.799232] do_syscall_64+0x5c/0x80 [ 205.799238] ? handle_mm_fault+0xba/0x290 [ 205.799242] ? debug_smp_processor_id+0x17/0x20 [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 [ 205.799260] ? irqentry_exit+0x33/0x40 [ 205.799263] ? exc_page_fault+0x87/0x170 [ 205.799268] ? asm_exc_page_fault+0x8/0x30 [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.799277] RIP: 0033:0x7ff6b80eaca1 [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 [ 205.799304] </TASK> Fixes: feef318c85 ("ax25: fix UAF bugs of net_device caused by rebinding operation") Reported-by: Bernard F6BVP <f6bvp@free.fr> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Duoming Zhou <duoming@zju.edu.cn> Link: https://lore.kernel.org/r/20220728051821.3160118-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2022-07-28 22:06:15 -07:00
..
6lowpan	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
9p	xen: switch gnttab_end_foreign_access() to take a struct page pointer	2022-05-27 11:05:29 +02:00
802	net: 802: Use memset_startat() to clear struct fields	2021-11-19 11:23:23 +00:00
8021q	vlan: fix memory leak in vlan_newlink()	2022-07-09 12:26:59 +01:00
appletalk	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00
atm	net: SO_RCVMARK socket option for SO_MARK with recvmsg()	2022-04-28 13:08:15 -07:00
ax25	ax25: fix incorrect dev_tracker usage	2022-07-28 22:06:15 -07:00
batman-adv	net: wrap the wireless pointers in struct net_device in an ifdef	2022-05-22 21:51:54 +01:00
bluetooth	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put	2022-07-26 13:35:24 -07:00
bpf	Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2022-05-23 16:07:14 -07:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	bridge: Do not send empty IFLA_AF_SPEC attribute	2022-07-26 15:35:53 +02:00
caif	caif: Fix bitmap data type in "struct caifsock"	2022-07-22 12:51:45 +01:00
can	can: bcm: use call_rcu() instead of costly synchronize_rcu()	2022-07-04 10:33:39 +02:00
ceph	libceph: use swap() macro instead of taking tmp variable	2022-05-25 20:45:13 +02:00
core	tcp: Fix data-races around sysctl knobs related to SYN option.	2022-07-20 10:14:49 +01:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp	Revert "net: Add a second bind table hashed by port and address"	2022-06-16 11:07:59 -07:00
decnet	net: Fix data-races around sysctl_[rw]mem(_offset)?.	2022-07-25 12:42:09 +01:00
dns_resolver
dsa	net: dsa: fix reference counting for LAG FDBs	2022-07-25 19:37:06 -07:00
ethernet	net: ethernet: set default assignment identifier to NET_NAME_ENUM	2022-04-07 21:04:03 -07:00
ethtool	ethtool: Fix get module eeprom fallback	2022-06-17 20:22:16 -07:00
hsr	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
ieee802154	net: SO_RCVMARK socket option for SO_MARK with recvmsg()	2022-04-28 13:08:15 -07:00
ife
ipv4	tcp: md5: fix IPv4-mapped support	2022-07-27 10:18:21 -07:00
ipv6	net: ping6: Fix memleak in ipv6_renew_options().	2022-07-28 10:42:08 -07:00
iucv	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00
kcm	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2022-06-01 17:44:04 -07:00
l2tp	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg	2022-06-08 10:56:43 -07:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()	2022-07-26 13:23:05 -07:00
mac802154	net: mac802154: Fix symbol durations	2022-04-30 20:29:47 +02:00
mctp	Networking changes for 5.19.	2022-05-25 12:22:58 -07:00
mpls	net: mpls: fix memdup.cocci warning	2022-04-07 21:06:41 -07:00
mptcp	mptcp: Do not return EINPROGRESS when subflow creation succeeds	2022-07-26 19:57:55 -07:00
ncsi	net/ncsi: use proper "mellanox" DT vendor prefix	2022-06-23 20:51:06 -07:00
netfilter	netfilter: nft_queue: only allow supported familes and hooks	2022-07-26 21:12:42 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-05-12 16:15:30 -07:00
netrom	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00
nfc	net: nfc: Directly use ida_alloc()/free()	2022-05-28 15:28:47 +01:00
nsh
openvswitch	net: openvswitch: fix parsing of nw_proto for IPv6 fragments	2022-06-23 11:44:01 +02:00
packet	net/af_packet: make sure to pull mac header	2022-06-02 10:15:05 -07:00
phonet	net: remove noblock parameter from recvmsg() entities	2022-04-12 15:00:25 +02:00
psample
qrtr	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00
rds	Linux 5.18	2022-05-24 12:40:28 -03:00
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose	net: rose: fix UAF bug caused by rose_t0timer_expiry	2022-07-06 19:49:11 -07:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-05-23 21:19:17 -07:00
sched	net/sched: cls_api: Fix flow action initialization	2022-07-20 10:54:27 +01:00
sctp	sctp: leave the err path free in sctp_stream_init to sctp_stream_free	2022-07-27 18:23:22 -07:00
smc	tcp: Fix data-races around keepalive sysctl knobs.	2022-07-18 12:21:54 +01:00
strparser
sunrpc	Notable regression fixes:	2022-07-02 11:20:56 -07:00
switchdev	net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device	2022-02-24 21:31:43 -08:00
tipc	net: Fix data-races around sysctl_[rw]mem(_offset)?.	2022-07-25 12:42:09 +01:00
tls	net/tls: Remove the context from the list in tls_device_down	2022-07-24 21:40:56 +01:00
unix	af_unix: Fix a data-race in unix_dgram_peer_wake_me().	2022-06-07 12:07:46 +02:00
vmw_vsock	hyperv-next for 5.19	2022-05-28 11:39:01 -07:00
wireless	wifi: cfg80211: Allow P2P client interface to indicate port authorization	2022-06-29 11:43:15 +02:00
x25	x25: remove redundant pointer dev	2022-05-10 11:59:22 +02:00
xdp	xsk: Clear page contiguity bit when unmapping pool	2022-06-28 22:49:04 +02:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2022-07-20 10:11:58 +01:00
compat.c
devres.c
Kconfig	page_pool: Add allocation stats	2022-03-03 09:55:28 +00:00
Kconfig.debug	net: CONFIG_DEBUG_NET depends on CONFIG_NET	2022-06-02 10:15:05 -07:00
Makefile
socket.c	net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()	2022-06-23 20:56:23 -07:00
sysctl_net.c