]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ax25: fix reference count leaks of ax25_dev
authorDuoming Zhou <duoming@zju.edu.cn>
Thu, 21 Apr 2022 10:24:16 +0000 (13:24 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 Apr 2022 11:39:45 +0000 (13:39 +0200)
commita518be5772d36fcd0e4815d156e06feb137aad82
treee8b6ae4e50d18a35cf4f955c2bf20aa5c0525339
parente2b558fe507a1ed4c43db2b0057fc6e41f20a14c
ax25: fix reference count leaks of ax25_dev

commit 87563a043cef044fed5db7967a75741cc16ad2b1 upstream.

The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev
to avoid UAF bugs") introduces refcount into ax25_dev, but there
are reference leak paths in ax25_ctl_ioctl(), ax25_fwd_ioctl(),
ax25_rt_add(), ax25_rt_del() and ax25_rt_opt().

This patch uses ax25_dev_put() and adjusts the position of
ax25_addr_ax25dev() to fix reference cout leaks of ax25_dev.

Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220203150811.42256-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[OP: backport to 4.19: adjust context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/net/ax25.h
net/ax25/af_ax25.c
net/ax25/ax25_dev.c
net/ax25/ax25_route.c