ax25: Fix reference count leak issues of ax25_dev

mainline inclusion
from mainline-v6.10-rc1
commit b505e0319852b08a3a716b64620168eab21f4ced
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S8I
CVE: CVE-2024-38602

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b505e0319852b08a3a716b64620168eab21f4ced



---------------------------

The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference
count leak issue of the object "ax25_dev".

Memory leak issue in ax25_addr_ax25dev():

The reference count of the object "ax25_dev" can be increased multiple
times in ax25_addr_ax25dev(). This will cause a memory leak.

Memory leak issues in ax25_dev_device_down():

The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and
then increase the reference count when ax25_dev is added to ax25_dev_list.
As a result, the reference count of ax25_dev is 2. But when the device is
shutting down. The ax25_dev_device_down() drops the reference count once
or twice depending on if we goto unlock_put or not, which will cause
memory leak.

As for the issue of ax25_addr_ax25dev(), it is impossible for one pointer
to be on a list twice. So add a break in ax25_addr_ax25dev(). As for the
issue of ax25_dev_device_down(), increase the reference count of ax25_dev
once in ax25_dev_device_up() and decrease the reference count of ax25_dev
after it is removed from the ax25_dev_list.

Fixes: d01ffb9e ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/361bbf2a4b091e120006279ec3b382d73c4a0c17.1715247018.git.duoming@zju.edu.cn


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Conflicts:
	net/ax25/ax25_dev.c
[The conflict occurs because the commit a968c799("ax25: merge repeat
codes in ax25_dev_device_down()") and a7d6e36b9ad0("ax25: Use kernel
universal linked list to implement ax25_dev_list") are not merged]
Signed-off-by: Liu Jian <liujian56@huawei.com>