net: avoid UAF on deleted altname
Altnames are accessed under RCU (dev_get_by_name_rcu()) but freed by kfree() with no synchronization point. Each node has one or two allocations (node and a variable-size name, sometimes the name is netdev->name). Adding rcu_heads here is a bit tedious. Besides most code which unlists the names already has rcu barriers - so take the simpler approach of adding synchronize_rcu(). Note that the one on the unregistration path (which matters more) is removed by the next fix. Fixes: ff927412 ("net: introduce name_node struct to be used in hashlist") Reviewed-by:Jiri Pirko <jiri@nvidia.com> Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Paolo Abeni <pabeni@redhat.com>
parent
7663d522
Please register or sign in to comment