shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 10:58:48 +09:00
Code Issues Packages Projects Releases Wiki Activity

can: raw: add missing refcount for memory leak fix

Browse Source 
commit c275a176e4 upstream.

Commit ee8b94c851 ("can: raw: fix receiver memory leak") introduced
a new reference to the CAN netdevice that has assigned CAN filters.
But this new ro->dev reference did not maintain its own refcount which
lead to another KASAN use-after-free splat found by Eric Dumazet.

This patch ensures a proper refcount for the CAN nedevice.

Fixes: ee8b94c851 ("can: raw: fix receiver memory leak")
Reported-by: Eric Dumazet <edumazet@google.com>
Cc: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20230821144547.6658-3-socketcan@hartkopp.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Oliver Hartkopp
2023-08-21 16:45:47 +02:00
committed by Greg Kroah-Hartman
parent 930f3f1649
commit ef56cc8889
1 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
net/can/raw.c
View File

@@ -283,8 +283,10 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg,
case NETDEV_UNREGISTER: case NETDEV_UNREGISTER:
lock_sock(sk); lock_sock(sk);
/* remove current filters & unregister */ /* remove current filters & unregister */
if (ro->bound) if (ro->bound) {
raw_disable_allfilters(dev_net(dev), dev, sk); raw_disable_allfilters(dev_net(dev), dev, sk);
dev_put(dev);
}
if (ro->count > 1) if (ro->count > 1)
kfree(ro->filter); kfree(ro->filter);
@@ -388,10 +390,12 @@ static int raw_release(struct socket *sock)
/* remove current filters & unregister */ /* remove current filters & unregister */
if (ro->bound) { if (ro->bound) {
if (ro->dev) if (ro->dev) {
raw_disable_allfilters(dev_net(ro->dev), ro->dev, sk); raw_disable_allfilters(dev_net(ro->dev), ro->dev, sk);
else dev_put(ro->dev);
} else {
raw_disable_allfilters(sock_net(sk), NULL, sk); raw_disable_allfilters(sock_net(sk), NULL, sk);
}
} }
if (ro->count > 1) if (ro->count > 1)
@@ -442,10 +446,10 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
goto out; goto out;
} }
if (dev->type != ARPHRD_CAN) { if (dev->type != ARPHRD_CAN) {
dev_put(dev);
err = -ENODEV; err = -ENODEV;
goto out; goto out_put_dev;
} }
if (!(dev->flags & IFF_UP)) if (!(dev->flags & IFF_UP))
notify_enetdown = 1; notify_enetdown = 1;
@@ -453,7 +457,9 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
/* filters set by default/setsockopt */ /* filters set by default/setsockopt */
err = raw_enable_allfilters(sock_net(sk), dev, sk); err = raw_enable_allfilters(sock_net(sk), dev, sk);
dev_put(dev); if (err)
goto out_put_dev;
} else { } else {
ifindex = 0; ifindex = 0;
@@ -464,18 +470,28 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
if (!err) { if (!err) {
if (ro->bound) { if (ro->bound) {
/* unregister old filters */ /* unregister old filters */
if (ro->dev) if (ro->dev) {
raw_disable_allfilters(dev_net(ro->dev), raw_disable_allfilters(dev_net(ro->dev),
ro->dev, sk); ro->dev, sk);
else /* drop reference to old ro->dev */
dev_put(ro->dev);
} else {
raw_disable_allfilters(sock_net(sk), NULL, sk); raw_disable_allfilters(sock_net(sk), NULL, sk);
}
} }
ro->ifindex = ifindex; ro->ifindex = ifindex;
ro->bound = 1; ro->bound = 1;
/* bind() ok -> hold a reference for new ro->dev */
ro->dev = dev; ro->dev = dev;
if (ro->dev)
dev_hold(ro->dev);
} }
out: out_put_dev:
/* remove potential reference from dev_get_by_index() */
if (dev)
dev_put(dev);
out:
release_sock(sk); release_sock(sk);
rtnl_unlock(); rtnl_unlock();