mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-05 03:00:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/net/ax25
History
Murad Masimov bca0902e61 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 
If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE
socket option, a refcount leak will occur in ax25_release().

Commit 9fd75b66b8 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
added decrement of device refcounts in ax25_release(). In order for that
to work correctly the refcounts must already be incremented when the
device is bound to the socket. An AX25 device can be bound to a socket
by either calling ax25_bind() or setting SO_BINDTODEVICE socket option.
In both cases the refcounts should be incremented, but in fact it is done
only in ax25_bind().

This bug leads to the following issue reported by Syzkaller:

================================================================
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Modules linked in:
CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Call Trace:
 <TASK>
 __refcount_dec include/linux/refcount.h:336 [inline]
 refcount_dec include/linux/refcount.h:351 [inline]
 ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236
 netdev_tracker_free include/linux/netdevice.h:4156 [inline]
 netdev_put include/linux/netdevice.h:4173 [inline]
 netdev_put include/linux/netdevice.h:4169 [inline]
 ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069
 __sock_release+0xb0/0x270 net/socket.c:640
 sock_close+0x1c/0x30 net/socket.c:1408
 ...
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 ...
 </TASK>
================================================================

Fix the implementation of ax25_setsockopt() by adding increment of
refcounts for the new device bound, and decrement of refcounts for
the old unbound device.

Fixes: 9fd75b66b8 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
Reported-by: syzbot+33841dc6aa3e1d86b78a@syzkaller.appspotmail.com
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Link: https://patch.msgid.link/20250203091203.1744-1-m.masimov@mt-integration.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-02-06 17:02:40 -08:00
..
af_ax25.c ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 2025-02-06 17:02:40 -08:00
ax25_addr.c
ax25_dev.c ax25: rcu protect dev->ax25_ptr 2025-01-06 15:57:01 -08:00
ax25_ds_in.c
ax25_ds_subr.c
ax25_ds_timer.c ax25: Remove superfuous "return" from ax25_ds_set_timer 2024-05-08 12:23:10 +01:00
ax25_iface.c
ax25_in.c
ax25_ip.c ax25: rcu protect dev->ax25_ptr 2025-01-06 15:57:01 -08:00
ax25_out.c ax25: rcu protect dev->ax25_ptr 2025-01-06 15:57:01 -08:00
ax25_route.c ax25: rcu protect dev->ax25_ptr 2025-01-06 15:57:01 -08:00
ax25_std_in.c
ax25_std_subr.c
ax25_std_timer.c
ax25_subr.c
ax25_timer.c net: avoid overflow when rose /proc displays timer information. 2022-08-05 19:00:02 -07:00
ax25_uid.c
Kconfig net: handle HAS_IOPORT dependencies 2024-04-08 11:56:56 +01:00
Makefile
sysctl_net_ax25.c ax.25: x.25: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:43 +01:00