diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-09-17 18:10:24 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-09-17 18:10:25 -0700 |
| commit | e218ae40241c162a752200efec92030d4de1b503 (patch) | |
| tree | 7be50d092f843bb35adac6f55fe43f58e97388fd /net/tls/tls_device.c | |
| parent | 6b957c0a36f5a68d9b210ed2db67fc191d873ba4 (diff) | |
| parent | 893c49a78d9f85e4b8081b908fb7c407d018106a (diff) | |
Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev'
Kuniyuki Iwashima says:
====================
net: Fix UAF of sk_dst_get(sk)->dev.
syzbot caught use-after-free of sk_dst_get(sk)->dev,
which was not fetched under RCU nor RTNL. [0]
Patch 1 ~ 5, 7 fix UAF in smc, tcp, ktls, mptcp
Patch 6 fixes dst ref leak in mptcp
[0]: https://lore.kernel.org/68c237c7.050a0220.3c6139.0036.GAE@google.com
v1: https://lore.kernel.org/20250911030620.1284754-1-kuniyu@google.com
====================
Link: https://patch.msgid.link/20250916214758.650211-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/tls/tls_device.c')
| -rw-r--r-- | net/tls/tls_device.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index f672a62a9a52..a82fdcf19969 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx) /* We assume that the socket is already connected */ static struct net_device *get_netdev_for_sock(struct sock *sk) { - struct dst_entry *dst = sk_dst_get(sk); - struct net_device *netdev = NULL; + struct net_device *dev, *lowest_dev = NULL; + struct dst_entry *dst; - if (likely(dst)) { - netdev = netdev_sk_get_lowest_dev(dst->dev, sk); - dev_hold(netdev); + rcu_read_lock(); + dst = __sk_dst_get(sk); + dev = dst ? dst_dev_rcu(dst) : NULL; + if (likely(dev)) { + lowest_dev = netdev_sk_get_lowest_dev(dev, sk); + dev_hold(lowest_dev); } + rcu_read_unlock(); - dst_release(dst); - - return netdev; + return lowest_dev; } static void destroy_record(struct tls_record_info *record) |