From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=185.136.64.227 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793100843; b=Q8YZAoK5X/oSubBiWIJW9JcZXHvLvOs/n49JdD5YfmB8IZUwaxIicrcOqVAotFaaR25W CKii2au2IVaVw7LEWFsGbPVfV4sOXenzLerOkWjDpXS4+FZUQ7nP/yBGMO25fxWVQIqMS pPukdssFSxbKgfQ3aoK5zfNc+4dzaglUGzHp5GmXkU4r0SpdyVqfV/tmFV7Sr+Huj3EK4 UXKtZLgjIxty/rcOAK8+St9eEr7WwAFjkflOA6x6abv5GRWp3o2V7Lxv8ECx5Ew9I+sAw XnKrH+pUGv+pBy4dtN8VNkzbRbPHdF4p5cZoxFrvfkgGXnzyTAYG6MupU8vyKKjZmxw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793100843; h=DMARC-Filter:Received:DKIM-Signature:From:To:Cc:Subject:Date: Message-ID:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:X-Flowmailer-Platform:Feedback-ID; bh=vaMoJmfJf3ICrCzTXXV7OkiGmOs7c+I5K1e2fNuayAU=; b=NB6y37jvHCNU0ceIbT12AzpJj3/FoGiek+3L33CG672k+xahoH38T6cRCqjqVxFPw9Ib mURc3BvKAl9zHpWoXyiLYKIU53F4kv34YPjHTPlu6TtJ8oaPwQpfc+Q3oSbwOQD7g9ZJU 2yz2tP9XaAg6qM1bLc5bEjzoOW1I8vm5h0Fw+sVjagzsRmeb9314LxOdXmLvXPB2mmJpV b83EUDeVgIlYRYixTCbOd1K+YknqFCcDnS54u5cdXFpV/g8iK7RbGAIIc5flTYLJYKHLq 3IeIoBwvHAMHJjfvzT4mHF+mU9xHxwnhaCLgCyJPvZrIJaDp6Hq8GgeBzn6t+GM7QZQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.a=rsa-sha256 header.s=fm2 header.b=llg7bW1D; arc=none smtp.remote-ip=185.136.64.227 Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 546FD606B5AB for ; Tue, 27 Oct 2026 11:34:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 546FD606B5AB Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.a=rsa-sha256 header.s=fm2 header.b=llg7bW1D Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20261027113353da13b20dec00020705 for ; Tue, 27 Oct 2026 12:33:53 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=vaMoJmfJf3ICrCzTXXV7OkiGmOs7c+I5K1e2fNuayAU=; b=llg7bW1D3+otd+NTPGiUTiwD0iDJpKQvPFnxTTZy7ZgbTxaK7+7Q7SniiMNPf15CKnpTsD qX6qRDsc+9xbG2PiMrkz72Q/2HZPTUv3KSOb3BjcADk7kK9IL806TR0LO2X0P17bEiCzqnS6 Cawas+nAIdGnGmSSNsCH6fvftA/GsXuQZLZc2wz+l/rXemCawYlcVIHNCJ6HEHueeYkluPpS 7hG/cqDWwNdmm4yfs3MnO/PTRCJ7bGWJFXTt8QC7DFCz21hlP91KDT55sCv38FzZIDTaIoff cyoAKojzJs24lcL5UVwRnmxHZu3jEpJZMAWFB3+nkl75uKyUSq/x26OQ==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v6 2/5] leds: trigger: netdev: Access net_dev under trigger_data->lock in the worker Date: Tue, 27 Oct 2026 12:33:42 +0100 Message-ID: <20261027113349.383147-3-alexander.sverdlin@siemens.com> In-Reply-To: <20261027113349.383147-1-alexander.sverdlin@siemens.com> References: <20261027113349.383147-1-alexander.sverdlin@siemens.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer From: Alexander Sverdlin netdev_trig_work() dereferences trigger_data->net_dev without the lock, while set_device_name() and netdev_trig_notify() dev_put() and replace it under trigger_data->lock. On NETDEV_UNREGISTER the worker can run dev_get_stats() on a netdev being freed (UAF). Take trigger_data->lock in the worker. cancel_delayed_work_sync() must then never run under that lock. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/20260914142116.6DAC51F000FF@smtp.kernel.org/ Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger") Signed-off-by: Alexander Sverdlin --- Changelog: v3: - explicit mutex_lock()/mutex_unlock() instead of guard() drivers/leds/trigger/ledtrig-netdev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c index cfaf130157b3d..e72e850e0070f 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -676,9 +676,12 @@ static void netdev_trig_work(struct work_struct *work) unsigned long interval; int invert; + mutex_lock(&trigger_data->lock); + /* If we dont have a device, insure we are off */ if (!trigger_data->net_dev) { led_set_brightness(trigger_data->led_cdev, LED_OFF); + mutex_unlock(&trigger_data->lock); return; } @@ -686,8 +689,10 @@ static void netdev_trig_work(struct work_struct *work) if (!test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) && !test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode) && !test_bit(TRIGGER_NETDEV_TX_ERR, &trigger_data->mode) && - !test_bit(TRIGGER_NETDEV_RX_ERR, &trigger_data->mode)) + !test_bit(TRIGGER_NETDEV_RX_ERR, &trigger_data->mode)) { + mutex_unlock(&trigger_data->lock); return; + } dev_stats = dev_get_stats(trigger_data->net_dev, &temp); new_activity = @@ -728,6 +733,8 @@ static void netdev_trig_work(struct work_struct *work) schedule_delayed_work(&trigger_data->work, (atomic_read(&trigger_data->interval)*2)); + + mutex_unlock(&trigger_data->lock); } static int netdev_trig_activate(struct led_classdev *led_cdev) -- 2.56.0