diff options
| author | Eric Dumazet <edumazet@google.com> | 2025-06-18 14:08:44 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 11:04:22 +0100 |
| commit | f2d1443b18806640abdb530e88009af7be2588e7 (patch) | |
| tree | ee2a9174ccfce845afc78570406fbf3bf1f59b1f | |
| parent | a7a713dfb5f9477345450f27c7c0741864511192 (diff) | |
| download | linux-f2d1443b18806640abdb530e88009af7be2588e7.tar.gz linux-f2d1443b18806640abdb530e88009af7be2588e7.tar.bz2 linux-f2d1443b18806640abdb530e88009af7be2588e7.zip | |
net: atm: fix /proc/net/atm/lec handling
[ Upstream commit d03b79f459c7935cff830d98373474f440bd03ae ]
/proc/net/atm/lec must ensure safety against dev_lec[] changes.
It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/atm/lec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/atm/lec.c b/net/atm/lec.c index 3f67b84c8f1c..73078306504c 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -911,7 +911,6 @@ static void *lec_itf_walk(struct lec_state *state, loff_t *l) v = (dev && netdev_priv(dev)) ? lec_priv_walk(state, l, netdev_priv(dev)) : NULL; if (!v && dev) { - dev_put(dev); /* Partial state reset for the next time we get called */ dev = NULL; } @@ -935,6 +934,7 @@ static void *lec_seq_start(struct seq_file *seq, loff_t *pos) { struct lec_state *state = seq->private; + mutex_lock(&lec_mutex); state->itf = 0; state->dev = NULL; state->locked = NULL; @@ -952,8 +952,9 @@ static void lec_seq_stop(struct seq_file *seq, void *v) if (state->dev) { spin_unlock_irqrestore(&state->locked->lec_arp_lock, state->flags); - dev_put(state->dev); + state->dev = NULL; } + mutex_unlock(&lec_mutex); } static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos) |