Skip to content

Commit

Permalink
Merge branch 'macvlan-uaf'
Browse files Browse the repository at this point in the history
Ziyang Xuan says:

====================
net: macvlan: fix potential UAF problem for lowerdev

Add the reference operation to lowerdev of macvlan to avoid
the potential UAF problem under the following known scenario:

Someone module puts the NETDEV_UNREGISTER event handler to a
work, and lowerdev is accessed in the work handler. But when
the work is excuted, lowerdev has been destroyed because upper
macvlan did not get reference to lowerdev correctly.

In addition, add net device refcount tracker to macvlan.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
David S. Miller committed Mar 14, 2022
2 parents de29aff + 1f4a598 commit d96657d
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 1 deletion.
14 changes: 13 additions & 1 deletion drivers/net/macvlan.c
Original file line number Diff line number Diff line change
Expand Up @@ -889,7 +889,7 @@ static void macvlan_set_lockdep_class(struct net_device *dev)
static int macvlan_init(struct net_device *dev)
{
struct macvlan_dev *vlan = netdev_priv(dev);
const struct net_device *lowerdev = vlan->lowerdev;
struct net_device *lowerdev = vlan->lowerdev;
struct macvlan_port *port = vlan->port;

dev->state = (dev->state & ~MACVLAN_STATE_MASK) |
Expand All @@ -911,6 +911,9 @@ static int macvlan_init(struct net_device *dev)

port->count += 1;

/* Get macvlan's reference to lowerdev */
dev_hold_track(lowerdev, &vlan->dev_tracker, GFP_KERNEL);

return 0;
}

Expand Down Expand Up @@ -1173,6 +1176,14 @@ static const struct net_device_ops macvlan_netdev_ops = {
.ndo_features_check = passthru_features_check,
};

static void macvlan_dev_free(struct net_device *dev)
{
struct macvlan_dev *vlan = netdev_priv(dev);

/* Get rid of the macvlan's reference to lowerdev */
dev_put_track(vlan->lowerdev, &vlan->dev_tracker);
}

void macvlan_common_setup(struct net_device *dev)
{
ether_setup(dev);
Expand All @@ -1184,6 +1195,7 @@ void macvlan_common_setup(struct net_device *dev)
dev->priv_flags |= IFF_UNICAST_FLT | IFF_CHANGE_PROTO_DOWN;
dev->netdev_ops = &macvlan_netdev_ops;
dev->needs_free_netdev = true;
dev->priv_destructor = macvlan_dev_free;
dev->header_ops = &macvlan_hard_header_ops;
dev->ethtool_ops = &macvlan_ethtool_ops;
}
Expand Down
1 change: 1 addition & 0 deletions include/linux/if_macvlan.h
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ struct macvlan_dev {
struct hlist_node hlist;
struct macvlan_port *port;
struct net_device *lowerdev;
netdevice_tracker dev_tracker;
void *accel_priv;
struct vlan_pcpu_stats __percpu *pcpu_stats;

Expand Down

0 comments on commit d96657d

Please sign in to comment.