From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0677301471 for ; Thu, 4 Dec 2025 06:24:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764829472; cv=none; b=laoGFAc0vzJ5Wp7Mqfa6VZ5N/AJrjvxRATfr2RNFgN0ZKz/i0/hmCCuOnawYm3lFYU7+6Z0oBgtZW7NCXiRNOMFvDiFvEcUuJscAW62cyNdpvhxQJ+c8CehsoWYzRi08zysA4uhgE8eiK5u9TZsf5LgJMPrd1N488dFYXa9rlWs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764829472; c=relaxed/simple; bh=rGBLF8xwLKCOiVEtSg2zPEOPq5T39ES9h1TujRpxN3M=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=mubq6lOQyd2lpLhRVBsMCsKATd9TA8QusACIUgdu+X0NQ5BLmjrbFW7Mdw+HQNlY39Tvme/ImoE3wRVAOZESHgkjzBN9B4dV9dhWJrIHoGgW8wnLECSPlebyLzFtGyB17haZ4f3AzEegWHTlXymD7W++OUCZrHC75E+K9cQcwAc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mq1/35V8; arc=none smtp.client-ip=209.85.215.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mq1/35V8" Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-ba599137cf8so266246a12.0 for ; Wed, 03 Dec 2025 22:24:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764829470; x=1765434270; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=lf4adP25J21BobodMbUDwTjByfXhO/jZrNevIrKqLHg=; b=mq1/35V8pwQP8dbJFAq5vycHQF/u/r5yOx9QvvfEEg3gwcXGgObtXdI+CEUtknSBZV R2yzp5/+czp1Ia71uZ//xtYGfBo51q7mylMD6AAFpMEu6yYOqza21laL842MhAcoC/d4 RTH4KS5tAOPvzgtauQgAsQuwDaJOnujPf1HeruCMFutBwm2Vfz2wJSFxGmQDvVikLHMY 5Oa2d3BNded4l6kVixo1Zl1nHAH8rrdtOcF5UZEanUDreb38IEdcnTlPzjj5JK5joJil +Q6bFCWBzejBIhTWcoEthqNE7CiZbQRhbKaZhz38Xo1kOT8zQ1XgMmheQV/3icjxSHL2 sSbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764829470; x=1765434270; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=lf4adP25J21BobodMbUDwTjByfXhO/jZrNevIrKqLHg=; b=TrFF36jVDZi5ZSMToO0r9iGCR3wRJ1iui7THoDR//W+wkdpxMaVIuQ8WOPbAsfOWRV 17FpsLYRqOVKqPEXy76oBI2xCPKaHvIm5Kwiv/X3A5kzKLQZn7Ajtt0QjHiIHkPO3QLK kTkma7R0iGANLlKZAVvkqGiUu8FNC8/d+dT5YGS0NJWOqVhAu4LsOxz0lgst0odChxmB 7SBwV5oU0wuNM7nUI5RkAFRSP+3CrKWe7ofoQtVieKJx2XFb8f5YXDu1vD8n8oprVkxM 4/JxmE6KUFm/kFgemOCvxfsr+fP52U2jHwArpwC2E3f3UKz9D7wbNcXnhExw4ZWFSM11 ikkw== X-Forwarded-Encrypted: i=1; AJvYcCVOxseL1GyDfQtNG9XsNLwxXmppiDaVkI6c/FFQU76bhyoslNZNq5EokVmg6qOSfTCFNpmVmIcgbaIYi7I=@vger.kernel.org X-Gm-Message-State: AOJu0YyteFy5RoGhxJnUG6kZgz89MwSl764BowYJbK88GbCAgtTzTiuT kri7u76XredGKgKM2KJpfHg4zKNaya68giEjpAofnrOvlHaugLG/w5Qt X-Gm-Gg: ASbGnctjgBr3cnsRB2iJO4Fh/0WGxjZMbsPvsvMsGdmullA0Ua3cdxcykcmCwjNDgeP STgw/M+JsumdF9Bm3rIP5qqjdfWINyYG822juJ4gE1XAQ8sL27re2Uqy36bYDyn5/nZcIXDSvQ0 WGNjmUvKo6M1pceG3QltQVUDPWOfmrAtqc31SCBjgfHpo0/OEhxviWumaS/AP7Z1KEzDXWRYBU4 74oTjF99UJ2lh5+bjOilPNUCl6hFA4U4mQuOEDvclYqdGwIkUAkRJdu+jH7rygEoMZcm6gpLnIr 6J+C3wAimLE3lZsurjT9ZL8XgVfgbhjLf3bDvZcEiAU2Nn3+TcNjiEAnt8hbNvfqyRqRwKOXhoy GFbLOKTOqVga1wVb7+1x1Dreu8nu8S8v04Gv6qmwIJU/ekBNojpzH1k1/kiIu8OudFrVwSZZhw7 qKOe58qrzkQxp9djTThniije9fcJ7G/iSNW+xgZBXW X-Google-Smtp-Source: AGHT+IGBvaGoSQkbX0Lb2blhJ1LWK3OjM1EcejMl2JusU2e5IY4nYHQbAfzWPiHGhz1tIYeMAr3JaA== X-Received: by 2002:a17:90b:2c86:b0:32e:23c9:6f41 with SMTP id 98e67ed59e1d1-34943872580mr1905706a91.5.1764829470036; Wed, 03 Dec 2025 22:24:30 -0800 (PST) Received: from localhost.localdomain ([121.190.139.95]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3494ea63e87sm804640a91.12.2025.12.03.22.24.27 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 03 Dec 2025 22:24:29 -0800 (PST) From: Minseong Kim To: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Minseong Kim Subject: [PATCH net v3 0/1] atm: mpoa: Fix UAF on qos_head list in procfs Date: Thu, 4 Dec 2025 15:24:20 +0900 Message-Id: <20251204062421.96986-1-ii4gsp@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Changes since v2: - Replace atm_mpoa_search_qos() with atm_mpoa_get_qos() to avoid returning an unprotected pointer. - Add atm_mpoa_delete_qos_by_ip() so search+unlink+free is atomic under qos_mutex, preventing double-free/UAF. - Update all callers accordingly. Minseong Kim (1): atm: mpoa: Fix UAF on qos_head list in procfs net/atm/mpc.c | 184 ++++++++++++++++++++++++++++++++---------- net/atm/mpc.h | 3 +- net/atm/mpoa_caches.c | 17 ++-- net/atm/mpoa_proc.c | 2 +- 4 files changed, 149 insertions(+), 57 deletions(-) -- 2.39.5 (Apple Git-154)