* Re: [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
2026-03-24 22:46 [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Alexander Popov
@ 2026-03-25 8:35 ` Greg KH
2026-03-25 9:23 ` Breno Leitao
2026-03-25 12:34 ` Andrew Lunn
2 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2026-03-25 8:35 UTC (permalink / raw)
To: Alexander Popov
Cc: Andrew Lunn, Jakub Kicinski, David Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Maxime Chevallier, Michal Kubecek,
Gal Pressman, Kory Maincent, Oleksij Rempel, Ido Schimmel,
Heiner Kallweit, Johannes Berg, James Guan, Kees Cook, Paul Moses,
linux-wireless, netdev, linux-kernel, security, notify
On Wed, Mar 25, 2026 at 01:46:02AM +0300, Alexander Popov wrote:
> Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
> the virt_wifi net devices. However, unregistering a virt_wifi device in
> netdev_run_todo() can happen together with the device referenced by
> SET_NETDEV_DEV().
>
> It can result in use-after-free during the ethtool operations performed
> on a virt_wifi device that is currently being unregistered. Such a net
> device can have the `dev.parent` field pointing to the freed memory,
> but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
>
> Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0
> Read of size 2 at addr ffff88810cfc46f8 by task pm/606
>
> Call Trace:
> <TASK>
> dump_stack_lvl+0x4d/0x70
> print_report+0x170/0x4f3
> ? __pfx__raw_spin_lock_irqsave+0x10/0x10
> kasan_report+0xda/0x110
> ? __pm_runtime_resume+0xe2/0xf0
> ? __pm_runtime_resume+0xe2/0xf0
> __pm_runtime_resume+0xe2/0xf0
> ethnl_ops_begin+0x49/0x270
> ethnl_set_features+0x23c/0xab0
> ? __pfx_ethnl_set_features+0x10/0x10
> ? kvm_sched_clock_read+0x11/0x20
> ? local_clock_noinstr+0xf/0xf0
> ? local_clock+0x10/0x30
> ? kasan_save_track+0x25/0x60
> ? __kasan_kmalloc+0x7f/0x90
> ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0
> genl_family_rcv_msg_doit+0x1e7/0x2c0
> ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
> ? __pfx_cred_has_capability.isra.0+0x10/0x10
> ? stack_trace_save+0x8e/0xc0
> genl_rcv_msg+0x411/0x660
> ? __pfx_genl_rcv_msg+0x10/0x10
> ? __pfx_ethnl_set_features+0x10/0x10
> netlink_rcv_skb+0x121/0x380
> ? __pfx_genl_rcv_msg+0x10/0x10
> ? __pfx_netlink_rcv_skb+0x10/0x10
> ? __pfx_down_read+0x10/0x10
> genl_rcv+0x23/0x30
> netlink_unicast+0x60f/0x830
> ? __pfx_netlink_unicast+0x10/0x10
> ? __pfx___alloc_skb+0x10/0x10
> netlink_sendmsg+0x6ea/0xbc0
> ? __pfx_netlink_sendmsg+0x10/0x10
> ? __futex_queue+0x10b/0x1f0
> ____sys_sendmsg+0x7a2/0x950
> ? copy_msghdr_from_user+0x26b/0x430
> ? __pfx_____sys_sendmsg+0x10/0x10
> ? __pfx_copy_msghdr_from_user+0x10/0x10
> ___sys_sendmsg+0xf8/0x180
> ? __pfx____sys_sendmsg+0x10/0x10
> ? __pfx_futex_wait+0x10/0x10
> ? fdget+0x2e4/0x4a0
> __sys_sendmsg+0x11f/0x1c0
> ? __pfx___sys_sendmsg+0x10/0x10
> do_syscall_64+0xe2/0x570
> ? exc_page_fault+0x66/0xb0
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> This fix may be combined with another one in the ethtool subsystem:
> https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
>
> Fixes: d43c65b05b848e0b ("ethtool: runtime-resume netdev parent in ethnl_ops_begin")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alexander Popov <alex.popov@linux.com>
> ---
> drivers/net/wireless/virtual/virt_wifi.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c
> index 885dc7243e8d..97bd39d89e98 100644
> --- a/drivers/net/wireless/virtual/virt_wifi.c
> +++ b/drivers/net/wireless/virtual/virt_wifi.c
> @@ -557,7 +557,6 @@ static int virt_wifi_newlink(struct net_device *dev,
> eth_hw_addr_inherit(dev, priv->lowerdev);
> netif_stacked_transfer_operstate(priv->lowerdev, dev);
>
> - SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
> dev->ieee80211_ptr = kzalloc_obj(*dev->ieee80211_ptr);
>
> if (!dev->ieee80211_ptr) {
> --
> 2.53.0
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
2026-03-24 22:46 [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Alexander Popov
2026-03-25 8:35 ` Greg KH
@ 2026-03-25 9:23 ` Breno Leitao
2026-03-25 12:34 ` Andrew Lunn
2 siblings, 0 replies; 6+ messages in thread
From: Breno Leitao @ 2026-03-25 9:23 UTC (permalink / raw)
To: Alexander Popov
Cc: Andrew Lunn, Jakub Kicinski, David Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Maxime Chevallier, Michal Kubecek,
Gal Pressman, Kory Maincent, Oleksij Rempel, Ido Schimmel,
Heiner Kallweit, Greg KH, Johannes Berg, James Guan, Kees Cook,
Paul Moses, linux-wireless, netdev, linux-kernel, security,
notify
On Wed, Mar 25, 2026 at 01:46:02AM +0300, Alexander Popov wrote:
> Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
> the virt_wifi net devices. However, unregistering a virt_wifi device in
> netdev_run_todo() can happen together with the device referenced by
> SET_NETDEV_DEV().
>
> It can result in use-after-free during the ethtool operations performed
> on a virt_wifi device that is currently being unregistered. Such a net
> device can have the `dev.parent` field pointing to the freed memory,
> but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
>
> Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0
> Read of size 2 at addr ffff88810cfc46f8 by task pm/606
>
> Call Trace:
> <TASK>
> dump_stack_lvl+0x4d/0x70
> print_report+0x170/0x4f3
> ? __pfx__raw_spin_lock_irqsave+0x10/0x10
> kasan_report+0xda/0x110
> ? __pm_runtime_resume+0xe2/0xf0
> ? __pm_runtime_resume+0xe2/0xf0
> __pm_runtime_resume+0xe2/0xf0
> ethnl_ops_begin+0x49/0x270
> ethnl_set_features+0x23c/0xab0
> ? __pfx_ethnl_set_features+0x10/0x10
> ? kvm_sched_clock_read+0x11/0x20
> ? local_clock_noinstr+0xf/0xf0
> ? local_clock+0x10/0x30
> ? kasan_save_track+0x25/0x60
> ? __kasan_kmalloc+0x7f/0x90
> ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0
> genl_family_rcv_msg_doit+0x1e7/0x2c0
> ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
> ? __pfx_cred_has_capability.isra.0+0x10/0x10
> ? stack_trace_save+0x8e/0xc0
> genl_rcv_msg+0x411/0x660
> ? __pfx_genl_rcv_msg+0x10/0x10
> ? __pfx_ethnl_set_features+0x10/0x10
> netlink_rcv_skb+0x121/0x380
> ? __pfx_genl_rcv_msg+0x10/0x10
> ? __pfx_netlink_rcv_skb+0x10/0x10
> ? __pfx_down_read+0x10/0x10
> genl_rcv+0x23/0x30
> netlink_unicast+0x60f/0x830
> ? __pfx_netlink_unicast+0x10/0x10
> ? __pfx___alloc_skb+0x10/0x10
> netlink_sendmsg+0x6ea/0xbc0
> ? __pfx_netlink_sendmsg+0x10/0x10
> ? __futex_queue+0x10b/0x1f0
> ____sys_sendmsg+0x7a2/0x950
> ? copy_msghdr_from_user+0x26b/0x430
> ? __pfx_____sys_sendmsg+0x10/0x10
> ? __pfx_copy_msghdr_from_user+0x10/0x10
> ___sys_sendmsg+0xf8/0x180
> ? __pfx____sys_sendmsg+0x10/0x10
> ? __pfx_futex_wait+0x10/0x10
> ? fdget+0x2e4/0x4a0
> __sys_sendmsg+0x11f/0x1c0
> ? __pfx___sys_sendmsg+0x10/0x10
> do_syscall_64+0xe2/0x570
> ? exc_page_fault+0x66/0xb0
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> This fix may be combined with another one in the ethtool subsystem:
> https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
>
> Fixes: d43c65b05b848e0b ("ethtool: runtime-resume netdev parent in ethnl_ops_begin")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alexander Popov <alex.popov@linux.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
2026-03-24 22:46 [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Alexander Popov
2026-03-25 8:35 ` Greg KH
2026-03-25 9:23 ` Breno Leitao
@ 2026-03-25 12:34 ` Andrew Lunn
2026-03-25 13:47 ` Greg KH
2026-03-25 17:24 ` Alexander Popov
2 siblings, 2 replies; 6+ messages in thread
From: Andrew Lunn @ 2026-03-25 12:34 UTC (permalink / raw)
To: Alexander Popov
Cc: Jakub Kicinski, David Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Maxime Chevallier, Michal Kubecek, Gal Pressman,
Kory Maincent, Oleksij Rempel, Ido Schimmel, Heiner Kallweit,
Greg KH, Johannes Berg, James Guan, Kees Cook, Paul Moses,
linux-wireless, netdev, linux-kernel, security, notify
On Wed, Mar 25, 2026 at 01:46:02AM +0300, Alexander Popov wrote:
> Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
> the virt_wifi net devices. However, unregistering a virt_wifi device in
> netdev_run_todo() can happen together with the device referenced by
> SET_NETDEV_DEV().
>
> It can result in use-after-free during the ethtool operations performed
> on a virt_wifi device that is currently being unregistered. Such a net
> device can have the `dev.parent` field pointing to the freed memory,
> but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
>
> Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
Did you have a look at all user of SET_NETDEV_DEV() to see if there
are other examples of the same bug?
What i found was:
https://elixir.bootlin.com/linux/v6.19.9/source/drivers/net/ethernet/mellanox/mlx4/en_netdev.c#L3180
Does this have the same problem?
Andrew
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
2026-03-25 12:34 ` Andrew Lunn
@ 2026-03-25 13:47 ` Greg KH
2026-03-25 17:24 ` Alexander Popov
1 sibling, 0 replies; 6+ messages in thread
From: Greg KH @ 2026-03-25 13:47 UTC (permalink / raw)
To: Andrew Lunn
Cc: Alexander Popov, Jakub Kicinski, David Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Maxime Chevallier, Michal Kubecek,
Gal Pressman, Kory Maincent, Oleksij Rempel, Ido Schimmel,
Heiner Kallweit, Johannes Berg, James Guan, Kees Cook, Paul Moses,
linux-wireless, netdev, linux-kernel, security, notify
On Wed, Mar 25, 2026 at 01:34:43PM +0100, Andrew Lunn wrote:
> On Wed, Mar 25, 2026 at 01:46:02AM +0300, Alexander Popov wrote:
> > Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
> > the virt_wifi net devices. However, unregistering a virt_wifi device in
> > netdev_run_todo() can happen together with the device referenced by
> > SET_NETDEV_DEV().
> >
> > It can result in use-after-free during the ethtool operations performed
> > on a virt_wifi device that is currently being unregistered. Such a net
> > device can have the `dev.parent` field pointing to the freed memory,
> > but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
> >
> > Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
>
> Did you have a look at all user of SET_NETDEV_DEV() to see if there
> are other examples of the same bug?
>
> What i found was:
>
> https://elixir.bootlin.com/linux/v6.19.9/source/drivers/net/ethernet/mellanox/mlx4/en_netdev.c#L3180
>
> Does this have the same problem?
That's not pointing to the "parent" device, but rather the actual device
under operation from what I can tell. Or am I mistaking what "pdev"
means here? Isn't that the pci device the driver is bound to?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
2026-03-25 12:34 ` Andrew Lunn
2026-03-25 13:47 ` Greg KH
@ 2026-03-25 17:24 ` Alexander Popov
1 sibling, 0 replies; 6+ messages in thread
From: Alexander Popov @ 2026-03-25 17:24 UTC (permalink / raw)
To: Andrew Lunn
Cc: Jakub Kicinski, David Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Maxime Chevallier, Michal Kubecek, Gal Pressman,
Kory Maincent, Oleksij Rempel, Ido Schimmel, Heiner Kallweit,
Greg KH, Johannes Berg, James Guan, Kees Cook, Paul Moses,
linux-wireless, netdev, linux-kernel, security, notify
On 3/25/26 15:34, Andrew Lunn wrote:
> On Wed, Mar 25, 2026 at 01:46:02AM +0300, Alexander Popov wrote:
>> Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
>> the virt_wifi net devices. However, unregistering a virt_wifi device in
>> netdev_run_todo() can happen together with the device referenced by
>> SET_NETDEV_DEV().
>>
>> It can result in use-after-free during the ethtool operations performed
>> on a virt_wifi device that is currently being unregistered. Such a net
>> device can have the `dev.parent` field pointing to the freed memory,
>> but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
>>
>> Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
>
> Did you have a look at all user of SET_NETDEV_DEV() to see if there
> are other examples of the same bug?
>
> What i found was:
>
> https://elixir.bootlin.com/linux/v6.19.9/source/drivers/net/ethernet/mellanox/mlx4/en_netdev.c#L3180
>
> Does this have the same problem?
Andrew, I can't say about this particular net device. Looks like it refers to a
specific ethernet adapter.
How can we distinguish security-relevant bugs similar to this use-after-free:
an unprivileged user must be able to create a given net device via user namespaces.
As I mentioned, applying this fix in ethtool could help against them:
https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
Best regards,
Alexander
^ permalink raw reply [flat|nested] 6+ messages in thread