net/dibs: Correct freeing of dmb_clientid_arr

A dibs device interrupt handler can be active after dibs_dev_del() and
may still access dmb_clientid_arr. (UAF)

In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()
dmb_clientid_arr is freed twice (double free).

Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
for now, because no dmbs can be registered before dibs_dev_add().

Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: stable@vger.kernel.org
Co-developed-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Link: https://patch.msgid.link/20260810111432.2334900-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/dibs/dibs_loopback.c b/drivers/dibs/dibs_loopback.c
index fd5caf1e19a8f8ca2ecefcd048f9f1dd47bce927..649e4e375be3326c053952dd52c611396a53ca6c 100644 (file)
--- a/drivers/dibs/dibs_loopback.c
+++ b/drivers/dibs/dibs_loopback.c
@@ -335,7 +335,6 @@ static int dibs_lo_dev_probe(void)
        return 0;
 
 err_reg:
-       kfree(dibs->dmb_clientid_arr);
        /* pairs with dibs_dev_alloc() */
        put_device(&dibs->dev);
        kfree(ldev);

diff --git a/drivers/dibs/dibs_main.c b/drivers/dibs/dibs_main.c
index 4c26fd06973f7c26fd68fe205486033302e35c31..2b53a9d277dcafdfcd54fd5c63b0ce576178cc24 100644 (file)
--- a/drivers/dibs/dibs_main.c
+++ b/drivers/dibs/dibs_main.c
@@ -128,6 +128,7 @@ static void dibs_dev_release(struct device *dev)
 
        dibs = container_of(dev, struct dibs_dev, dev);
 
+       kfree(dibs->dmb_clientid_arr);
        kfree(dibs);
 }
 
@@ -194,12 +195,13 @@ int dibs_dev_add(struct dibs_dev *dibs)
 
        ret = device_add(&dibs->dev);
        if (ret)
-               goto free_client_arr;
+               return ret;
 
        ret = sysfs_create_group(&dibs->dev.kobj, &dibs_dev_attr_group);
        if (ret) {
                dev_err(&dibs->dev, "sysfs_create_group failed for dibs_dev\n");
-               goto err_device_del;
+               device_del(&dibs->dev);
+               return ret;
        }
        mutex_lock(&dibs_dev_list.mutex);
        mutex_lock(&clients_lock);
@@ -214,13 +216,6 @@ int dibs_dev_add(struct dibs_dev *dibs)
        mutex_unlock(&dibs_dev_list.mutex);
 
        return 0;
-
-err_device_del:
-       device_del(&dibs->dev);
-free_client_arr:
-       kfree(dibs->dmb_clientid_arr);
-       return ret;
-
 }
 EXPORT_SYMBOL_GPL(dibs_dev_add);
 
@@ -247,7 +242,6 @@ void dibs_dev_del(struct dibs_dev *dibs)
        mutex_unlock(&dibs_dev_list.mutex);
 
        device_del(&dibs->dev);
-       kfree(dibs->dmb_clientid_arr);
 }
 EXPORT_SYMBOL_GPL(dibs_dev_del);