Commit 3e1553c2 authored by Duoming Zhou's avatar Duoming Zhou Committed by Liu Jian
Browse files

ax25: Fix reference count leak issues of ax25_dev 

stable inclusion
from stable-v6.6.33
commit 38eb01edfdaa1562fa00429be2e33f45383b1b3a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S8I
CVE: CVE-2024-38602

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=38eb01edfdaa1562fa00429be2e33f45383b1b3a



---------------------------

[ Upstream commit b505e0319852b08a3a716b64620168eab21f4ced ]

The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference
count leak issue of the object "ax25_dev".

Memory leak issue in ax25_addr_ax25dev():

The reference count of the object "ax25_dev" can be increased multiple
times in ax25_addr_ax25dev(). This will cause a memory leak.

Memory leak issues in ax25_dev_device_down():

The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and
then increase the reference count when ax25_dev is added to ax25_dev_list.
As a result, the reference count of ax25_dev is 2. But when the device is
shutting down. The ax25_dev_device_down() drops the reference count once
or twice depending on if we goto unlock_put or not, which will cause
memory leak.

As for the issue of ax25_addr_ax25dev(), it is impossible for one pointer
to be on a list twice. So add a break in ax25_addr_ax25dev(). As for the
issue of ax25_dev_device_down(), increase the reference count of ax25_dev
once in ax25_dev_device_up() and decrease the reference count of ax25_dev
after it is removed from the ax25_dev_list.

Fixes: d01ffb9e ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Suggested-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarDuoming Zhou <duoming@zju.edu.cn>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/361bbf2a4b091e120006279ec3b382d73c4a0c17.1715247018.git.duoming@zju.edu.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent fd1c0eb4

net/ax25/ax25_dev.c

+1 −2
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) 
		if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) {

			res = ax25_dev;

			ax25_dev_hold(ax25_dev);

			break;

		}

	spin_unlock_bh(&ax25_dev_lock);
@@ -88,7 +89,6 @@ void ax25_dev_device_up(struct net_device *dev) 
	list_add(&ax25_dev->list, &ax25_dev_list);

	dev->ax25_ptr     = ax25_dev;

	spin_unlock_bh(&ax25_dev_lock);

	ax25_dev_hold(ax25_dev);



	ax25_register_dev_sysctl(ax25_dev);

}
@@ -129,7 +129,6 @@ void ax25_dev_device_down(struct net_device *dev) 
unlock_put:

	dev->ax25_ptr = NULL;

	spin_unlock_bh(&ax25_dev_lock);

	ax25_dev_put(ax25_dev);

	netdev_put(dev, &ax25_dev->dev_tracker);

	ax25_dev_put(ax25_dev);

}