diff options
| author | Charalampos Mitrodimas <charmitro@posteo.net> | 2025-05-27 16:35:44 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 11:04:07 +0100 |
| commit | 445d59025d76d0638b03110f8791d5b89ed5162d (patch) | |
| tree | e274da58261ba5807c540ad55a686fc76e5b928d /net | |
| parent | 641bbd221e5e5a5f459b58748de8e30e52d623c6 (diff) | |
| download | linux-445d59025d76d0638b03110f8791d5b89ed5162d.tar.gz linux-445d59025d76d0638b03110f8791d5b89ed5162d.tar.bz2 linux-445d59025d76d0638b03110f8791d5b89ed5162d.zip | |
net: tipc: fix refcount warning in tipc_aead_encrypt
[ Upstream commit f29ccaa07cf3d35990f4d25028cc55470d29372b ]
syzbot reported a refcount warning [1] caused by calling get_net() on
a network namespace that is being destroyed (refcount=0). This happens
when a TIPC discovery timer fires during network namespace cleanup.
The recently added get_net() call in commit e279024617134 ("net/tipc:
fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to
hold a reference to the network namespace. However, if the namespace
is already being destroyed, its refcount might be zero, leading to the
use-after-free warning.
Replace get_net() with maybe_get_net(), which safely checks if the
refcount is non-zero before incrementing it. If the namespace is being
destroyed, return -ENODEV early, after releasing the bearer reference.
[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
Fixes: e27902461713 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done")
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/tipc/crypto.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index 159d891b81c5..3b26c5a6aaae 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -822,7 +822,11 @@ static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, } /* Get net to avoid freed tipc_crypto when delete namespace */ - get_net(aead->crypto->net); + if (!maybe_get_net(aead->crypto->net)) { + tipc_bearer_put(b); + rc = -ENODEV; + goto exit; + } /* Now, do encrypt */ rc = crypto_aead_encrypt(req); |