From: Kalle Valo <kvalo@kernel.org>
To: "zhangxiaoxu \(A\)" <zhangxiaoxu5@huawei.com>
Cc: <Ajay.Kathat@microchip.com>, <linux-wireless@vger.kernel.org>,
<netdev@vger.kernel.org>, <davem@davemloft.net>,
<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
<Claudiu.Beznea@microchip.com>
Subject: Re: [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list
Date: Mon, 28 Nov 2022 13:14:19 +0200 [thread overview]
Message-ID: <871qpn72lw.fsf@kernel.org> (raw)
In-Reply-To: <88650c25-5358-1f03-dc96-fb7fc550fb18@huawei.com> (zhangxiaoxu's message of "Sat, 26 Nov 2022 16:14:43 +0800")
"zhangxiaoxu (A)" <zhangxiaoxu5@huawei.com> writes:
> On 2022/11/26 0:17, Ajay.Kathat@microchip.com wrote:
>>
>> On 24/11/22 20:43, Zhang Xiaoxu wrote:
>>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>>>
>>> There is a UAF read when remove the wilc1000_spi module:
>>>
>>> BUG: KASAN: use-after-free in wilc_netdev_cleanup.cold+0xc4/0xe0 [wilc1000]
>>> Read of size 8 at addr ffff888116846900 by task rmmod/386
>>>
>>> CPU: 2 PID: 386 Comm: rmmod Tainted: G N 6.1.0-rc6+ #8
>>> Call Trace:
>>> dump_stack_lvl+0x68/0x85
>>> print_report+0x16c/0x4a3
>>> kasan_report+0x95/0x190
>>> wilc_netdev_cleanup.cold+0xc4/0xe0
>>> wilc_bus_remove+0x52/0x60
>>> spi_remove+0x46/0x60
>>> device_remove+0x73/0xc0
>>> device_release_driver_internal+0x12d/0x210
>>> driver_detach+0x84/0x100
>>> bus_remove_driver+0x90/0x120
>>> driver_unregister+0x4f/0x80
>>> __x64_sys_delete_module+0x2fc/0x440
>>> do_syscall_64+0x38/0x90
>>> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>>
>>> Since set 'needs_free_netdev=true' when initialize the net device, the
>>> net device will be freed when unregister, then use the freed 'vif' to
>>> find the next will UAF read.
>>
>>
>> Did you test this behaviour on the real device. I am seeing a kernel
>> crash when the module is unloaded after the connection with an AP.
>
> Thanks Ajay, I have no real device, what kind of crash about your
> scenario?
If you don't have a real device to test on, please state that clearly in
the commit log. For example, "Compile tested only" or something like
that.
We get way too much untested patches where there's no indication that
they have had no testing. I'm really concerned about this trend, I'm
even considering should I just start dropping these kind of untested
cleanup patches?
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2022-11-28 11:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-24 15:13 [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list Zhang Xiaoxu
[not found] ` <a6d8f548-bcf4-4a02-df25-3a06aa8f2b42@microchip.com>
2022-11-25 16:42 ` Kalle Valo
2022-11-26 8:14 ` zhangxiaoxu (A)
2022-11-28 11:14 ` Kalle Valo [this message]
2022-11-28 14:01 ` zhangxiaoxu (A)
2022-11-28 14:05 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871qpn72lw.fsf@kernel.org \
--to=kvalo@kernel.org \
--cc=Ajay.Kathat@microchip.com \
--cc=Claudiu.Beznea@microchip.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=zhangxiaoxu5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).