ax25: add refcount in ax25_dev to avoid UAF bugs
If we dereference ax25_dev after we call kfree(ax25_dev) in ax25_dev_device_down(), it will lead to concurrency UAF bugs. There are eight syscall functions suffer from UAF bugs, include ax25_bind(), ax25_release(), ax25_connect(), ax25_ioctl(), ax25_getname(), ax25_sendmsg(), ax25_getsockopt() and ax25_info_show(). One of the concurrency UAF can be shown as below: (USE) | (FREE) | ax25_device_event | ax25_dev_device_down ax25_bind | ... ... | kfree(ax25_dev) ax25_fillin_cb() | ... ax25_fillin_cb_from_dev() | ... | The root cause of UAF bugs is that kfree(ax25_dev) in ax25_dev_device_down() is not protected by any locks. When ax25_dev, which there are still pointers point to, is released, the concurrency UAF bug will happen. This patch introduces refcount into ax25_dev in order to guarantee that there are no pointers point to it when ax25_dev is released. Signed-off-by:Duoming Zhou <duoming@zju.edu.cn> Signed-off-by:
David S. Miller <davem@davemloft.net>
parent
4e0f718d
-
mentioned in commit 87563a04
-
mentioned in commit 5ea00fc6
-
mentioned in commit 5ddae8d0
-
mentioned in commit b20a5ab0
-
mentioned in commit 9af0fd5c
-
mentioned in commit 452ae92b
-
mentioned in commit bc706d89
-
mentioned in commit 418993bb
-
mentioned in commit 9e1e088a
-
mentioned in commit 1db0b2c5
-
mentioned in commit ef0a2a05
-
mentioned in commit 9f444ded
-
mentioned in commit c44a453f
-
mentioned in commit e2b558fe
-
mentioned in commit a518be57
-
mentioned in commit de55a133
Please register or sign in to comment