[PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[Jérémy Jean]

A struct rmnet_port stores a pointer to the most recently created
RMNET VND in port->rmnet_dev, but userspace can delete that VND while
the port still has another attached VND. When RMNET later sends a
buffered TX skb, a failure in __skb_linearize() makes rmnet_send_skb()
update the drop counter through that stale pointer, which causes a UAF.

The stale pointer can also be used by rmnet_unregister_bridge() when a
real device leaves bridge mode. In that case it is passed to
netdev_upper_dev_unlink(), which dereferences the freed VND and leaves
the actual bridge adjacency behind.

Account TX drops on the lower device and use the current bridge master
instead of port->rmnet_dev when unlinking. Remove the now useless
port->rmnet_dev.

Fixes: d939b6d30bea ("net: rmnet: fix bridge mode bugs")
Fixes: 64b5d1f8f2d1 ("net: qualcomm: rmnet: add tx packets aggregation")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---

Changes in v2:
 - Strengthen the UAF fix following review by Sashiko on the v1 (https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261031221052.1642262-1-Jeremy.Jean%40oss.cyber.gouv.fr)

v1: https://lore.kernel.org/all/20261031221052.1642262-1-Jeremy.Jean@oss.cyber.gouv.fr/

 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c   | 4 +---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h   | 1 -
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 5 +----
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 61b04c6c0390..fb586514b41d 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -96,7 +96,6 @@ static void rmnet_unregister_bridge(struct rmnet_port *port)
 	if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
 		return;
 
-	rmnet_dev = port->rmnet_dev;
 	if (!port->nr_rmnet_devs) {
 		/* bridge device */
 		real_dev = port->bridge_ep;
@@ -113,6 +112,7 @@ static void rmnet_unregister_bridge(struct rmnet_port *port)
 		port->rmnet_mode = RMNET_EPMODE_VND;
 	}
 
+	rmnet_dev = netdev_master_upper_dev_get(bridge_dev);
 	netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
 	rmnet_unregister_real_device(bridge_dev);
 }
@@ -163,7 +163,6 @@ static int rmnet_newlink(struct net_device *dev,
 		goto err2;
 
 	port->rmnet_mode = mode;
-	port->rmnet_dev = dev;
 
 	hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
 
@@ -487,7 +486,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	slave_port = rmnet_get_port_rtnl(slave_dev);
 	slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
 	slave_port->bridge_ep = real_dev;
-	slave_port->rmnet_dev = rmnet_dev;
 
 	port->rmnet_mode = RMNET_EPMODE_BRIDGE;
 	port->bridge_ep = slave_dev;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 5adda0323dda..26c1d8bccc14 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -37,7 +37,6 @@ struct rmnet_port {
 	u8 rmnet_mode;
 	struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
 	struct net_device *bridge_ep;
-	struct net_device *rmnet_dev;
 
 	/* Egress aggregation information */
 	struct rmnet_egress_agg_params egress_agg_params;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 39d6d084e73f..bd68d60b50d3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -543,10 +543,7 @@ static void rmnet_send_skb(struct rmnet_port *port, struct sk_buff *skb)
 {
 	if (skb_needs_linearize(skb, port->dev->features)) {
 		if (unlikely(__skb_linearize(skb))) {
-			struct rmnet_priv *priv;
-
-			priv = netdev_priv(port->rmnet_dev);
-			this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
+			dev_core_stats_tx_dropped_inc(port->dev);
 			dev_kfree_skb_any(skb);
 			return;
 		}
-- 
2.47.3

Re: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

RE: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[subash.a.kasiviswanathan]

> -----Original Message-----
> From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> Sent: Sunday, November 1, 2026 4:24 PM
> To: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@oss.qualcomm.com>; Sean Tranchetti
> <sean.tranchetti@oss.qualcomm.com>
> Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Jérémy Jean
> <Jeremy.Jean@oss.cyber.gouv.fr>; stable@vger.kernel.org
> Subject: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX
> drop
> 
> A struct rmnet_port stores a pointer to the most recently created RMNET VND
> in port->rmnet_dev, but userspace can delete that VND while the port still has
> another attached VND. When RMNET later sends a buffered TX skb, a failure in
> __skb_linearize() makes rmnet_send_skb() update the drop counter through
> that stale pointer, which causes a UAF.
> 
> The stale pointer can also be used by rmnet_unregister_bridge() when a real
> device leaves bridge mode. In that case it is passed to
> netdev_upper_dev_unlink(), which dereferences the freed VND and leaves the
> actual bridge adjacency behind.
> 
> Account TX drops on the lower device and use the current bridge master
> instead of port->rmnet_dev when unlinking. Remove the now useless
> port->rmnet_dev.
> 
> Fixes: d939b6d30bea ("net: rmnet: fix bridge mode bugs")
> Fixes: 64b5d1f8f2d1 ("net: qualcomm: rmnet: add tx packets aggregation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
> 
> Changes in v2:
>  - Strengthen the UAF fix following review by Sashiko on the v1
> (https://netdev-
> ai.bots.linux.dev/sashiko/#/patchset/20261031221052.1642262-1-
> Jeremy.Jean%40oss.cyber.gouv.fr)
> 
> v1: https://lore.kernel.org/all/20261031221052.1642262-1-
> Jeremy.Jean@oss.cyber.gouv.fr/
> 
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c   | 4 +---
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h   | 1 -
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 5 +----
>  3 files changed, 2 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> index 61b04c6c0390..fb586514b41d 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> @@ -96,7 +96,6 @@ static void rmnet_unregister_bridge(struct rmnet_port
> *port)
>  	if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
>  		return;
> 
> -	rmnet_dev = port->rmnet_dev;
>  	if (!port->nr_rmnet_devs) {
>  		/* bridge device */
>  		real_dev = port->bridge_ep;
> @@ -113,6 +112,7 @@ static void rmnet_unregister_bridge(struct
> rmnet_port *port)
>  		port->rmnet_mode = RMNET_EPMODE_VND;
>  	}
> 
> +	rmnet_dev = netdev_master_upper_dev_get(bridge_dev);
>  	netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
>  	rmnet_unregister_real_device(bridge_dev);
>  }
> @@ -163,7 +163,6 @@ static int rmnet_newlink(struct net_device *dev,
>  		goto err2;
> 
>  	port->rmnet_mode = mode;
> -	port->rmnet_dev = dev;
> 
>  	hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
> 
> @@ -487,7 +486,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
>  	slave_port = rmnet_get_port_rtnl(slave_dev);
>  	slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
>  	slave_port->bridge_ep = real_dev;
> -	slave_port->rmnet_dev = rmnet_dev;
> 
>  	port->rmnet_mode = RMNET_EPMODE_BRIDGE;
>  	port->bridge_ep = slave_dev;
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> index 5adda0323dda..26c1d8bccc14 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> @@ -37,7 +37,6 @@ struct rmnet_port {
>  	u8 rmnet_mode;
>  	struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
>  	struct net_device *bridge_ep;
> -	struct net_device *rmnet_dev;
> 
>  	/* Egress aggregation information */
>  	struct rmnet_egress_agg_params egress_agg_params; diff --git
> a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> index 39d6d084e73f..bd68d60b50d3 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> @@ -543,10 +543,7 @@ static void rmnet_send_skb(struct rmnet_port
> *port, struct sk_buff *skb)  {
>  	if (skb_needs_linearize(skb, port->dev->features)) {
>  		if (unlikely(__skb_linearize(skb))) {
> -			struct rmnet_priv *priv;
> -
> -			priv = netdev_priv(port->rmnet_dev);
> -			this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
> +			dev_core_stats_tx_dropped_inc(port->dev);
>  			dev_kfree_skb_any(skb);
>  			return;
>  		}
> --
> 2.47.3

Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>

Re: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[Simon Horman]

On Sun, Nov 01, 2026 at 11:29:13PM +0000, netdev-bot+sinfo@kernel.org wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
> 
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
> 
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Hi Jérémy,

I would appreciate it if you could take a moment to respond to
the questions posed by the bot above.