From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C3D520B21F for ; Thu, 23 Jan 2025 09:56:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737626212; cv=none; b=CqBVF2loR7UpUrpJ//ZSKeTyRsznzNlBmz/BLhCDOjrPepe8nWLUeWcNYfuM10Cq5Ej0WrVIGWTGb+fiX33h1GGYG4Lj5jDeLN023xwhSSpbL514bGqcoW94yGXmAwCWODIZG8k0sGR1oprDurxpfdme/lXhpVNdnI9LSJJC314= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737626212; c=relaxed/simple; bh=ERAIMIKIu9APFSuO9Cn/T3m12u7EZAmVoz09ki9CqGg=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=s21z17+zMJO0lFzIF0mGYlLikhQWq7ZUxu58Y7JmFxaxnUjqfld6AmEdkTdtwgQE9d2uZynPT4oIuHTlmYs0m08s1EZ3Yv+lEMyEnjsxPBcVgsCtUoAW9Z2AOYHrRuA3qD3GtrVxmgb458UBDdYOntjB0hrin/oLIHubngqJ+ro= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=JWz5MDh/; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="JWz5MDh/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1737626209; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YN5ISUI76bMnss/OXDHrGsjku/c5kM4P7iAQCZfcmpU=; b=JWz5MDh/m0EdxjAsMzPmh3rYjZAHHlM1ngkh3uEakhSuYEnRNZbYB8qw+ccWLSiHUPAET2 0SdiTBZx+Daw6+ffZIV+IFAM/+zWQ25TLrfS9cGcEO76GIcftIkmDnNIrgk+2ciwCEuwfn bwu/MaA/mZ8MGNy2v8iMtwVbotYZZ8I= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-20-TyuL2C-sPNK5WBS91y7h7w-1; Thu, 23 Jan 2025 04:56:48 -0500 X-MC-Unique: TyuL2C-sPNK5WBS91y7h7w-1 X-Mimecast-MFC-AGG-ID: TyuL2C-sPNK5WBS91y7h7w Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-436328fcfeeso5871595e9.1 for ; Thu, 23 Jan 2025 01:56:48 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737626207; x=1738231007; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=YN5ISUI76bMnss/OXDHrGsjku/c5kM4P7iAQCZfcmpU=; b=hnXoVR+kghG2W8i0ih7GnZqIere36jhNZS/MkUM7CMrlf1bf8reZ2djzdJm+4st9gK N70oSlpmIuJJT9kBdmCcdJx6Vb59AqIGEHJYI1D/FX006iocnCj4dRjw84pAd9bq91WY vBu13BZicOpTK7WinwP0Wix8lsbVzyEZpAN80/0FFBtyBMEHuddErh3fn7PjSPUo/5W6 NOaXM+PR6WV4h6Y6egyHt7Xi7DAZ3EDTN/PPinUm0pIPbpfkx6BBJYg0zmBbf4rhxC4r GXYwiLJubSkCsJif3Kk6O6EObWX/BoOGk7iegAdhE0G407+Ve/AxO+IT8APxbeS5dP/W TA6A== X-Forwarded-Encrypted: i=1; AJvYcCXXannVYa8OAYRzSqbgnYm+xfSrDaxIVBwEpQXW88qVwgbyDFwdxVz13EBwotbwOof1IyK34CXgYNXNczk=@vger.kernel.org X-Gm-Message-State: AOJu0YyBxBYeChdy4tPU3uVP0P0w7oU/6qKequEwIL+/JwFrNCMdeHH2 skNMjVYU1ISbeBQA/UuNrm7bRD5WNFEikiBY7QQUFpC2DX7fNu5IdXKig2aOfo1VdImKakmZqr8 H+i6/1pX5FZnlFDSppP16/LHPEzpak9NXLvTtyrgT/J1nNE9yDKG8VVQN/NevrQ== X-Gm-Gg: ASbGncuVZAF3FmUsYikDPlPdmxUId0IeiaYIZetT72dGRqFJpNXXbY3LPNVppmG1l5s p6B1S3ZgcK0c6dFHu4ekZoZy2mdv45qb/AXA+rMa7igl0y7o5z3/2g6gSAmo2Y1f4Volot/V0Kw uuQcaNniO/4ML2SRdTSqyFSTgE4+DmPQdOw6DUL+qTBgd6MrF5rFpKO2DK0ou5GLszTJEhopHsM pDSU01SZEdwGA5Bj35lfqW30etLjNhkPslznuEpJ52ndq6SFB/KSMSUb5LPSM+k+Y7X/jGwlGWG SZzpEg8kTDc3ifkBXuGB9k0l X-Received: by 2002:a05:600c:34c9:b0:436:f975:29d with SMTP id 5b1f17b1804b1-438913bffd9mr231650255e9.6.1737626206990; Thu, 23 Jan 2025 01:56:46 -0800 (PST) X-Google-Smtp-Source: AGHT+IEJHnewSJlPxFP9qi7fJLgC8bjjyroK4Qc6r15kcanAlYURNuOkB1/AfBOP9ckT3pjhn9NCug== X-Received: by 2002:a05:600c:34c9:b0:436:f975:29d with SMTP id 5b1f17b1804b1-438913bffd9mr231649985e9.6.1737626206652; Thu, 23 Jan 2025 01:56:46 -0800 (PST) Received: from [192.168.88.253] (146-241-27-215.dyn.eolo.it. [146.241.27.215]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-438b31c7c6asm55250225e9.35.2025.01.23.01.56.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 23 Jan 2025 01:56:46 -0800 (PST) Message-ID: <84c82380-4210-4efe-a269-6a40c3e39e61@redhat.com> Date: Thu, 23 Jan 2025 10:56:45 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] net: davicom: fix UAF in dm9000_drv_remove To: Chenyuan Yang , =?UTF-8?Q?Uwe_Kleine-K=C3=B6nig?= Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, paul@crapouillou.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, zijie98@gmail.com References: <20250120222557.833100-1-chenyuan0y@gmail.com> Content-Language: en-US From: Paolo Abeni In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 1/21/25 9:04 PM, Chenyuan Yang wrote: > On Mon, Jan 20, 2025 at 11:33 PM Uwe Kleine-König > wrote: >> On Mon, Jan 20, 2025 at 04:25:57PM -0600, Chenyuan Yang wrote: >>> dm is netdev private data and it cannot be >>> used after free_netdev() call. Using adpt after free_netdev() >> >> What is adpt? > > This should be "dm". > >>> can cause UAF bug. Fix it by moving free_netdev() at the end of the >>> function. >> >> "can cause"? Doesn't that trigger reliable? >> >> How did you find that issue? Did this actually trigger for you, or is it >> a static checker that found it? Please mention that in the commit log. > > This is detected by our static checker. Thus, we don't have a > test-case to trigger it stably. > Basically, it has the buggy pattern as the commit mentioned below. > >>> This is similar to the issue fixed in commit >>> ad297cd2db8953e2202970e9504cab247b6c7cb4 ("net: qcom/emac: fix UAF in emac_remove"). >> >> Please shorten the commit id, typically to 12 chars as you did in the >> Fixes line below. > > Sure! Should I send a Patch v2 for this commit? Please do! while at it, please also include the target tree ('net') in the subj prefix. Thanks, Paolo