[PATCH net v2] ipconfig: fix use-after-free of device list after ic_close_devs()

[PATCH net v2] ipconfig: fix use-after-free of device list after ic_close_devs()

[Henry Martin]

ic_close_devs() kfree()s every ic_device node but leaves the static
ic_first_dev and ic_dev pointers dangling behind.  When a DHCP
negotiation gets an OFFER but never the matching ACK, ic_bootp_recv()
accepts the OFFER and records ic_dev = <list node>, the round times
out and ic_close_devs() frees the whole list — node included.  The
next failed retry round runs ic_close_devs() once more, evaluating

    selected_dev = ic_dev ? ic_dev->dev : NULL;

against the freed ic_device — an 8-byte use-after-free read.

KASAN confirms:

  BUG: KASAN: slab-use-after-free in ic_close_devs+0x214/0x220
  Read of size 8
    ic_close_devs    <- ip_auto_config
  Allocated by: ip_auto_config (ic_open_devs)
  Freed by:      ic_close_devs <- ip_auto_config

NULL both pointers after the free loop so retry rounds take the
clean empty-list path.

This memory-safety issue was discovered by Tencent CodeBuddy Security.

Cc: stable@vger.kernel.org
Fixes: 46acf7bdbc72 ("Revert "net: ipv4: handle DSA enabled master network devices"")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
Changes in v2:
 - Fixes: tag corrected to the commit that introduced the ic_dev->dev
   dereference that makes this a UAF (46acf7bdbc72); in 2.6.12 ic_dev
   was a struct net_device * that was only compared, never dereferenced.
 - Code comment in ic_close_devs() dropped per review.
 - Message reduced to the memory-safety mechanism (no vulnerability
   framing).

 net/ipv4/ipconfig.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 1b8585404a41..ac4851e59c3b 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -346,6 +346,9 @@ static void __init ic_close_devs(void)
 		kfree(d);
 	}
 	rtnl_unlock();
+
+	ic_first_dev = NULL;
+	ic_dev = NULL;
 }

 /*
--
2.43.7

Re: [PATCH net v2] ipconfig: fix use-after-free of device list after ic_close_devs()

[Simon Horman]

On Sat, Oct 10, 2026 at 04:49:58PM +0800, Henry Martin wrote:
> ic_close_devs() kfree()s every ic_device node but leaves the static
> ic_first_dev and ic_dev pointers dangling behind.  When a DHCP
> negotiation gets an OFFER but never the matching ACK, ic_bootp_recv()
> accepts the OFFER and records ic_dev = <list node>, the round times
> out and ic_close_devs() frees the whole list — node included.  The
> next failed retry round runs ic_close_devs() once more, evaluating
> 
>     selected_dev = ic_dev ? ic_dev->dev : NULL;
> 
> against the freed ic_device — an 8-byte use-after-free read.
> 
> KASAN confirms:
> 
>   BUG: KASAN: slab-use-after-free in ic_close_devs+0x214/0x220
>   Read of size 8
>     ic_close_devs    <- ip_auto_config
>   Allocated by: ip_auto_config (ic_open_devs)
>   Freed by:      ic_close_devs <- ip_auto_config
> 
> NULL both pointers after the free loop so retry rounds take the
> clean empty-list path.
> 
> This memory-safety issue was discovered by Tencent CodeBuddy Security.
> 
> Cc: stable@vger.kernel.org
> Fixes: 46acf7bdbc72 ("Revert "net: ipv4: handle DSA enabled master network devices"")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
> Changes in v2:
>  - Fixes: tag corrected to the commit that introduced the ic_dev->dev
>    dereference that makes this a UAF (46acf7bdbc72); in 2.6.12 ic_dev
>    was a struct net_device * that was only compared, never dereferenced.
>  - Code comment in ic_close_devs() dropped per review.
>  - Message reduced to the memory-safety mechanism (no vulnerability
>    framing).

Thanks for the updates.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v2] ipconfig: fix use-after-free of device list after ic_close_devs()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat, 10 Oct 2026 16:49:58 +0800 you wrote:
> ic_close_devs() kfree()s every ic_device node but leaves the static
> ic_first_dev and ic_dev pointers dangling behind.  When a DHCP
> negotiation gets an OFFER but never the matching ACK, ic_bootp_recv()
> accepts the OFFER and records ic_dev = <list node>, the round times
> out and ic_close_devs() frees the whole list — node included.  The
> next failed retry round runs ic_close_devs() once more, evaluating
> 
> [...]

Here is the summary with links:
  - [net,v2] ipconfig: fix use-after-free of device list after ic_close_devs()
    https://git.kernel.org/netdev/net-next/c/befe96ed37d5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html