Re: [PATCH net v4 2/3] netconsole: read np.dev under target_list_lock in local_mac_show()

[Breno Leitao <leitao@debian.org>]

On Wed, Oct 21, 2026 at 03:19:06PM +0100, Gustavo Luiz Duarte wrote:
> local_mac_show() loads nt->np.dev and dereferences it with no lock. It
> can race with the interface going away and netconsole_netdev_event()
> eventually calling netdev_put() and freeing the device before we
> dereference it, leading to a UAF.
> 
> The window is only a few instructions wide, so I could only reproduce it
> with an artificially widened window between the load and the
> dereference:
> 
>   BUG: KASAN: slab-use-after-free in local_mac_show+0x4e/0x80
>   Read of size 8 at addr ffff88800e990458 by task uaf/130
>    local_mac_show+0x4e/0x80
>    configfs_read_iter+0x187/0x260
>    vfs_read+0x453/0x5a0
> 
>   Allocated by task 116:
>    alloc_netdev_mqs+0x78/0x830
>    rtnl_create_link+0x53b/0x5c0
> 
>   Freed by task 121:
>    kfree+0x159/0x420
>    device_release+0x77/0x120
>    kobject_put+0xb5/0x160
>    netdev_run_todo+0x420/0x850
>    rtnl_dellink+0x259/0x5b0
> 
> Two places can free np.dev: (1) netconsole_netdev_event() moves a target
> out of STATE_ENABLED under target_list_lock before netdev_put(), and (2)
> process_resume_target() releases np.dev under dynamic_netconsole_mutex.
> 
> Fixes: 0953864160bd ("[NETPOLL]: no need to store local_mac")
> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com>

Reviewed-by: Breno Leitao <leitao@debian.org>

> @@ -888,10 +888,23 @@ static ssize_t remote_ip_show(struct config_item *item, char *buf)
>  
>  static ssize_t local_mac_show(struct config_item *item, char *buf)
>  {
> -	struct net_device *dev = to_target(item)->np.dev;
> -	static const u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
> +	struct netconsole_target *nt = to_target(item);
> +	unsigned long flags;
> +	u8 mac[ETH_ALEN];
> +
> +	eth_broadcast_addr(mac);

Yeah, this is much nicer than the bcast one. My only concern is that
this is a fix, and it changes quite a few things beyond the fix itself,
which will make backporting it to stable harder.