xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ax25: fix reference count leaks of ax25_dev

Browse Source 
commit 87563a043cef044fed5db7967a75741cc16ad2b1 upstream.

The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev
to avoid UAF bugs") introduces refcount into ax25_dev, but there
are reference leak paths in ax25_ctl_ioctl(), ax25_fwd_ioctl(),
ax25_rt_add(), ax25_rt_del() and ax25_rt_opt().

This patch uses ax25_dev_put() and adjusts the position of
ax25_addr_ax25dev() to fix reference cout leaks of ax25_dev.

Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220203150811.42256-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[OP: backport to 5.10: adjust context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Duoming Zhou
2022-04-15 20:49:27 +03:00
committed by Greg Kroah-Hartman
parent 5ea00fc606
commit 5ddae8d064
4 changed files with 41 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/ax25.h
View File

@@ -291,10 +291,12 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25)
}
}
#define ax25_dev_hold(__ax25_dev) \
refcount_inc(&((__ax25_dev)->refcount))
static inline void ax25_dev_hold(ax25_dev *ax25_dev)
{
refcount_inc(&ax25_dev->refcount);
}
static __inline__ void ax25_dev_put(ax25_dev *ax25_dev)
static inline void ax25_dev_put(ax25_dev *ax25_dev)
{
if (refcount_dec_and_test(&ax25_dev->refcount)) {
kfree(ax25_dev);