• Lin Ma's avatar
    hamradio: remove needs_free_netdev to avoid UAF · 81b1d548
    Lin Ma authored
    The former patch "defer 6pack kfree after unregister_netdev" reorders
    the kfree of two buffer after the unregister_netdev to prevent the race
    condition. It also adds free_netdev() function in sixpack_close(), which
    is a direct copy from the similar code in mkiss_close().
    
    However, in sixpack driver, the flag needs_free_netdev is set to true in
    sp_setup(), hence the unregister_netdev() will free the netdev
    automatically. Therefore, as the sp is netdev_priv, use-after-free
    occurs.
    
    This patch removes the needs_free_netdev = true and just let the
    free_netdev to finish this deallocation task.
    
    Fixes: 0b911192 ("hamradio: defer 6pack kfree after unregister_netdev")
    Signed-off-by: default avatarLin Ma <linma@zju.edu.cn>
    Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cnSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    81b1d548
6pack.c 23.2 KB