Commit e6e61480 authored by Jeongjun Park's avatar Jeongjun Park Committed by Luo Gengkun
Browse files

net/xen-netback: prevent UAF in xenvif_flush_hash() 

stable inclusion
from stable-v5.10.227
commit a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB6
CVE: CVE-2024-49936

Reference: https://git.kernel.org/stable/c/a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c



--------------------------------

[ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ]

During the list_for_each_entry_rcu iteration call of xenvif_flush_hash,
kfree_rcu does not exist inside the rcu read critical section, so if
kfree_rcu is called when the rcu grace period ends during the iteration,
UAF occurs when accessing head->next after the entry becomes free.

Therefore, to solve this, you need to change it to list_for_each_entry_safe.

Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLuo Gengkun <luogengkun2@huawei.com>
parent b558250d

drivers/net/xen-netback/hash.c

+2 −3
Original line number Original line Diff line number Diff line
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, 




static void xenvif_flush_hash(struct xenvif *vif)

static void xenvif_flush_hash(struct xenvif *vif)

{

{

	struct xenvif_hash_cache_entry *entry;

	struct xenvif_hash_cache_entry *entry, *n;

	unsigned long flags;

	unsigned long flags;





	if (xenvif_hash_cache_size == 0)

	if (xenvif_hash_cache_size == 0)
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif) 




	spin_lock_irqsave(&vif->hash.cache.lock, flags);

	spin_lock_irqsave(&vif->hash.cache.lock, flags);





	list_for_each_entry_rcu(entry, &vif->hash.cache.list, link,

	list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {

				lockdep_is_held(&vif->hash.cache.lock)) {

		list_del_rcu(&entry->link);

		list_del_rcu(&entry->link);

		vif->hash.cache.count--;

		vif->hash.cache.count--;

		kfree_rcu(entry, rcu);

		kfree_rcu(entry, rcu);