net: atm: fix /proc/net/atm/lec handling

[ Upstream commit d03b79f459c7935cff830d98373474f440bd03ae ]

/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/atm/lec.c b/net/atm/lec.c
index 3f67b84c8f1c9a7ad40c52c03670dc0a8113d212..73078306504c06c0b55334c5601f4f645f43c4da 100644 (file)
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -911,7 +911,6 @@ static void *lec_itf_walk(struct lec_state *state, loff_t *l)
        v = (dev && netdev_priv(dev)) ?
                lec_priv_walk(state, l, netdev_priv(dev)) : NULL;
        if (!v && dev) {
-               dev_put(dev);
                /* Partial state reset for the next time we get called */
                dev = NULL;
        }
@@ -935,6 +934,7 @@ static void *lec_seq_start(struct seq_file *seq, loff_t *pos)
 {
        struct lec_state *state = seq->private;
 
+       mutex_lock(&lec_mutex);
        state->itf = 0;
        state->dev = NULL;
        state->locked = NULL;
@@ -952,8 +952,9 @@ static void lec_seq_stop(struct seq_file *seq, void *v)
        if (state->dev) {
                spin_unlock_irqrestore(&state->locked->lec_arp_lock,
                                       state->flags);
-               dev_put(state->dev);
+               state->dev = NULL;
        }
+       mutex_unlock(&lec_mutex);
 }
 
 static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos)