queue-6.6/ax25-fix-use-after-free-bugs-caused-by-ax25_ds_del_timer.patch

   1 From fd819ad3ecf6f3c232a06b27423ce9ed8c20da89 Mon Sep 17 00:00:00 2001
   2 From: Duoming Zhou <duoming@zju.edu.cn>
   3 Date: Fri, 29 Mar 2024 09:50:23 +0800
   4 Subject: ax25: fix use-after-free bugs caused by ax25_ds_del_timer
   5
   6 From: Duoming Zhou <duoming@zju.edu.cn>
   7
   8 commit fd819ad3ecf6f3c232a06b27423ce9ed8c20da89 upstream.
   9
  10 When the ax25 device is detaching, the ax25_dev_device_down()
  11 calls ax25_ds_del_timer() to cleanup the slave_timer. When
  12 the timer handler is running, the ax25_ds_del_timer() that
  13 calls del_timer() in it will return directly. As a result,
  14 the use-after-free bugs could happen, one of the scenarios
  15 is shown below:
  16
  17       (Thread 1)          |      (Thread 2)
  18                           | ax25_ds_timeout()
  19 ax25_dev_device_down()    |
  20   ax25_ds_del_timer()     |
  21     del_timer()           |
  22   ax25_dev_put() //FREE   |
  23                           |  ax25_dev-> //USE
  24
  25 In order to mitigate bugs, when the device is detaching, use
  26 timer_shutdown_sync() to stop the timer.
  27
  28 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
  29 Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
  30 Reviewed-by: Simon Horman <horms@kernel.org>
  31 Link: https://lore.kernel.org/r/20240329015023.9223-1-duoming@zju.edu.cn
  32 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  33 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  34 ---
  35  net/ax25/ax25_dev.c |    2 +-
  36  1 file changed, 1 insertion(+), 1 deletion(-)
  37
  38 --- a/net/ax25/ax25_dev.c
  39 +++ b/net/ax25/ax25_dev.c
  40 @@ -105,7 +105,7 @@ void ax25_dev_device_down(struct net_dev
  41         spin_lock_bh(&ax25_dev_lock);
  42
  43  #ifdef CONFIG_AX25_DAMA_SLAVE
  44 -       ax25_ds_del_timer(ax25_dev);
  45 +       timer_shutdown_sync(&ax25_dev->dama.slave_timer);
  46  #endif
  47
  48         /*