netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Kalle Valo <kvalo@kernel.org>
To: <Ajay.Kathat@microchip.com>
Cc: <zhangxiaoxu5@huawei.com>, <linux-wireless@vger.kernel.org>,
	<netdev@vger.kernel.org>, <davem@davemloft.net>,
	<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
	<Claudiu.Beznea@microchip.com>
Subject: Re: [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list
Date: Fri, 25 Nov 2022 18:42:05 +0200	[thread overview]
Message-ID: <877czj6l5u.fsf@kernel.org> (raw)
In-Reply-To: <a6d8f548-bcf4-4a02-df25-3a06aa8f2b42@microchip.com> (Ajay Kathat's message of "Fri, 25 Nov 2022 16:17:16 +0000")

<Ajay.Kathat@microchip.com> writes:

> On 24/11/22 20:43, Zhang Xiaoxu wrote:
>
>  EXTERNAL EMAIL: Do not click links or open attachments unless you know the
>  content is safe
>
> There is a UAF read when remove the wilc1000_spi module:
>
>  BUG: KASAN: use-after-free in wilc_netdev_cleanup.cold+0xc4/0xe0 [wilc1000]
>  Read of size 8 at addr ffff888116846900 by task rmmod/386
>
>  CPU: 2 PID: 386 Comm: rmmod Tainted: G                 N 6.1.0-rc6+ #8
>  Call Trace:
>   dump_stack_lvl+0x68/0x85
>   print_report+0x16c/0x4a3
>   kasan_report+0x95/0x190
>   wilc_netdev_cleanup.cold+0xc4/0xe0
>   wilc_bus_remove+0x52/0x60
>   spi_remove+0x46/0x60
>   device_remove+0x73/0xc0
>   device_release_driver_internal+0x12d/0x210
>   driver_detach+0x84/0x100
>   bus_remove_driver+0x90/0x120
>   driver_unregister+0x4f/0x80
>   __x64_sys_delete_module+0x2fc/0x440
>   do_syscall_64+0x38/0x90
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Since set 'needs_free_netdev=true' when initialize the net device, the
> net device will be freed when unregister, then use the freed 'vif' to
> find the next will UAF read.
>
> Did you test this behaviour on the real device. I am seeing a kernel
> crash when the module is unloaded after the connection with an AP. As
> I see, "vif_list" is used to maintain the interface list, so even when
> one interface is removed, another element is fetched from the
> "vif_list", not using the freed "vif"

Ajay, please don't use HTML as our lists drop those.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

  parent reply	other threads:[~2022-11-25 16:42 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-24 15:13 [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list Zhang Xiaoxu
     [not found] ` <a6d8f548-bcf4-4a02-df25-3a06aa8f2b42@microchip.com>
2022-11-25 16:42   ` Kalle Valo [this message]
2022-11-26  8:14   ` zhangxiaoxu (A)
2022-11-28 11:14     ` Kalle Valo
2022-11-28 14:01       ` zhangxiaoxu (A)
2022-11-28 14:05         ` Kalle Valo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=877czj6l5u.fsf@kernel.org \
    --to=kvalo@kernel.org \
    --cc=Ajay.Kathat@microchip.com \
    --cc=Claudiu.Beznea@microchip.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=zhangxiaoxu5@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).