From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F2B62DB791; Thu, 30 Jul 2026 15:46:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785426412; cv=none; b=hdF72cvSpmjfDzJL/+ipdQ7ZRzShgGwjdUX9LtvlqcwIlBXgBOieWQDrXermCt2P/1JYGTt8mCsF0FFjhSQHtZ0lZ07qU1/UvknIZ2xpYIBNNjrIabib553Hs8nq8uCQJG7NT4Qj6FHkFKU6foilXmXAuab5Y624dUDtdVfFLIs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785426412; c=relaxed/simple; bh=MRvF1jXCgXL99SaaKcavZYzpRoj63uBij9F/K8Qdk7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jlvg66RGH7KMUGyJvE8J9SmKPYyRCPRo4pEO4Cp4rrNd/wGrhIqy4/MK8+nJ9yt+O2G25u5wiFuZyvjkg4OSxgU//2qHKevoN/3zqkXn6ZktHvoOKG6u02zt37eZJ5OwZ890137y+6T8AfmhjApzLZacMwr2pQkn5H6zqtV9Y4c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dikxhkdG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dikxhkdG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 794F21F000E9; Thu, 30 Jul 2026 15:46:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785426411; bh=mK8Gm2/iRATjhkUQ31jLIPbpylbLDNiRDdvR6dptbME=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dikxhkdGQwgMWW7JIZGf1r8b6KYNrhiOnjjmre3UPkzZa1n/QcDq0qFwcJCnTaeUU tL/+QjxqiysGWys+F6FXvLIRMHMPIfs3oI1THC4e5OoonfhB1bxaWeYkn9yAFxb60V 7gF+QLar2ZACEUYKAoZrZigSR/M6kvr970e6VFT0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sungmin Kang <726ksm@gmail.com>, Jakub Kicinski Subject: [PATCH 6.12 409/602] net: slip: serialize receive against buffer reallocation Date: Thu, 30 Jul 2026 16:13:21 +0200 Message-ID: <20260730141444.560142165@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141435.976815864@linuxfoundation.org> References: <20260730141435.976815864@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sungmin Kang <726ksm@gmail.com> commit ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d upstream. sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock. An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed. Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Sungmin Kang <726ksm@gmail.com> Link: https://patch.msgid.link/20260718073631.1674-1-726ksm@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/slip/slip.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -693,6 +693,8 @@ static void slip_receive_buf(struct tty_ if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) return; + spin_lock_bh(&sl->lock); + /* Read the characters out of the buffer */ while (count--) { if (fp && *fp++) { @@ -708,6 +710,8 @@ static void slip_receive_buf(struct tty_ #endif slip_unesc(sl, *cp++); } + + spin_unlock_bh(&sl->lock); } /************************************