From: Marc Kleine-Budde <mkl@pengutronix.de>
To: Ziyang Xuan <william.xuanziyang@huawei.com>
Cc: robin@protonic.nl, linux@rempel-privat.de,
socketcan@hartkopp.net, davem@davemloft.net, kuba@kernel.org,
linux-can@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] can: j1939: fix UAF for rx_kref of j1939_priv
Date: Sun, 17 Oct 2021 12:43:29 +0200 [thread overview]
Message-ID: <20211017104329.ccz3r5lsadqpbuj5@pengutronix.de> (raw)
In-Reply-To: <20210926104757.2021540-1-william.xuanziyang@huawei.com>
[-- Attachment #1: Type: text/plain, Size: 1684 bytes --]
On 26.09.2021 18:47:57, Ziyang Xuan wrote:
> It will trigger UAF for rx_kref of j1939_priv as following.
>
> cpu0 cpu1
> j1939_sk_bind(socket0, ndev0, ...)
> j1939_netdev_start
> j1939_sk_bind(socket1, ndev0, ...)
> j1939_netdev_start
> j1939_priv_set
> j1939_priv_get_by_ndev_locked
> j1939_jsk_add
> .....
> j1939_netdev_stop
> kref_put_lock(&priv->rx_kref, ...)
> kref_get(&priv->rx_kref, ...)
> REFCOUNT_WARN("addition on 0;...")
>
> ====================================================
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
> RIP: 0010:refcount_warn_saturate+0x169/0x1e0
> Call Trace:
> j1939_netdev_start+0x68b/0x920
> j1939_sk_bind+0x426/0xeb0
> ? security_socket_bind+0x83/0xb0
>
> The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
> protect.
>
> Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
> Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Added to linux-can/testing, added stable on Cc.
Thanks,
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung West/Dortmund | Phone: +49-231-2826-924 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
prev parent reply other threads:[~2021-10-17 10:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-26 10:47 [PATCH net] can: j1939: fix UAF for rx_kref of j1939_priv Ziyang Xuan
2021-10-08 11:34 ` Oleksij Rempel
2021-10-17 10:43 ` Marc Kleine-Budde [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211017104329.ccz3r5lsadqpbuj5@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rempel-privat.de \
--cc=netdev@vger.kernel.org \
--cc=robin@protonic.nl \
--cc=socketcan@hartkopp.net \
--cc=william.xuanziyang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.