From: Kalle Valo <kvalo@kernel.org>
To: "zhangxiaoxu \(A\)" <zhangxiaoxu5@huawei.com>
Cc: <Ajay.Kathat@microchip.com>, <linux-wireless@vger.kernel.org>,
<netdev@vger.kernel.org>, <davem@davemloft.net>,
<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
<Claudiu.Beznea@microchip.com>
Subject: Re: [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list
Date: Mon, 28 Nov 2022 16:05:03 +0200 [thread overview]
Message-ID: <87fse35g4w.fsf@kernel.org> (raw)
In-Reply-To: <736584e7-571d-13f9-eb3e-34ce49e71e6c@huawei.com> (zhangxiaoxu's message of "Mon, 28 Nov 2022 22:01:38 +0800")
"zhangxiaoxu (A)" <zhangxiaoxu5@huawei.com> writes:
> On 2022/11/28 19:14, Kalle Valo wrote:
>> "zhangxiaoxu (A)" <zhangxiaoxu5@huawei.com> writes:
>>
>>> On 2022/11/26 0:17, Ajay.Kathat@microchip.com wrote:
>>>>
>>>> On 24/11/22 20:43, Zhang Xiaoxu wrote:
>>>>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>>>>>
>>>>> There is a UAF read when remove the wilc1000_spi module:
>>>>>
>>>>> BUG: KASAN: use-after-free in wilc_netdev_cleanup.cold+0xc4/0xe0 [wilc1000]
>>>>> Read of size 8 at addr ffff888116846900 by task rmmod/386
>>>>>
>>>>> CPU: 2 PID: 386 Comm: rmmod Tainted: G N 6.1.0-rc6+ #8
>>>>> Call Trace:
>>>>> dump_stack_lvl+0x68/0x85
>>>>> print_report+0x16c/0x4a3
>>>>> kasan_report+0x95/0x190
>>>>> wilc_netdev_cleanup.cold+0xc4/0xe0
>>>>> wilc_bus_remove+0x52/0x60
>>>>> spi_remove+0x46/0x60
>>>>> device_remove+0x73/0xc0
>>>>> device_release_driver_internal+0x12d/0x210
>>>>> driver_detach+0x84/0x100
>>>>> bus_remove_driver+0x90/0x120
>>>>> driver_unregister+0x4f/0x80
>>>>> __x64_sys_delete_module+0x2fc/0x440
>>>>> do_syscall_64+0x38/0x90
>>>>> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>>>>
>>>>> Since set 'needs_free_netdev=true' when initialize the net device, the
>>>>> net device will be freed when unregister, then use the freed 'vif' to
>>>>> find the next will UAF read.
>>>>
>>>>
>>>> Did you test this behaviour on the real device. I am seeing a kernel
>>>> crash when the module is unloaded after the connection with an AP.
>>>
>>> Thanks Ajay, I have no real device, what kind of crash about your
>>> scenario?
>>
>> If you don't have a real device to test on, please state that clearly in
>> the commit log. For example, "Compile tested only" or something like
>> that.
>
> Thanks Kalle,
>
> I found this problem with a bpf mock device, and test this patch use
> the same way.
That's very good info, please always include that information to the
commit log as well. That way there's a better understanding how this
patch is found.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
prev parent reply other threads:[~2022-11-28 14:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-24 15:13 [PATCH wireless] wifi: wilc1000: Fix UAF in wilc_netdev_cleanup() when iterator the RCU list Zhang Xiaoxu
[not found] ` <a6d8f548-bcf4-4a02-df25-3a06aa8f2b42@microchip.com>
2022-11-25 16:42 ` Kalle Valo
2022-11-26 8:14 ` zhangxiaoxu (A)
2022-11-28 11:14 ` Kalle Valo
2022-11-28 14:01 ` zhangxiaoxu (A)
2022-11-28 14:05 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fse35g4w.fsf@kernel.org \
--to=kvalo@kernel.org \
--cc=Ajay.Kathat@microchip.com \
--cc=Claudiu.Beznea@microchip.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=zhangxiaoxu5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).