github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-13 15:40:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Browse Source 
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.

tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().

slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.

Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).

Remove slip_hangup() so teardown is serialized cleanly by slip_close().

Fixes: 5342b77c41 ("slip: Clean up create and destroy")
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Closes: https://lore.kernel.org/netdev/20260825150655.1450271-1-jjy600901@snu.ac.kr/
Cc: Qingfang Deng <qingfang.deng@linux.dev>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260826105238.3323436-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2026-08-26 10:52:38 +00:00 committed by Jakub Kicinski
parent 50e5c6605c
commit 23c53269f2
1 changed files with 0 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/slip/slip.c
View File

@ -886,8 +886,6 @@ static int slip_open(struct tty_struct *tty)
* Close down a SLIP channel. * Close down a SLIP channel.
* This means flushing out any pending queues, and then returning. This * This means flushing out any pending queues, and then returning. This
* call is serialized against other ldisc functions. * call is serialized against other ldisc functions.
*
* We also use this method fo a hangup event
*/ */
static void slip_close(struct tty_struct *tty) static void slip_close(struct tty_struct *tty)
@ -915,11 +913,6 @@ static void slip_close(struct tty_struct *tty)
unregister_netdev(sl->dev); unregister_netdev(sl->dev);
/* sl_uninit() has dropped the slip_devs[] entry by now */ /* sl_uninit() has dropped the slip_devs[] entry by now */
} }
static void slip_hangup(struct tty_struct *tty)
{
slip_close(tty);
}
/************************************************************************ /************************************************************************
* STANDARD SLIP ENCAPSULATION * * STANDARD SLIP ENCAPSULATION *
************************************************************************/ ************************************************************************/
@ -1280,7 +1273,6 @@ static struct tty_ldisc_ops sl_ldisc = {
.name = "slip", .name = "slip",
.open = slip_open, .open = slip_open,
.close = slip_close, .close = slip_close,
.hangup = slip_hangup,
.ioctl = slip_ioctl, .ioctl = slip_ioctl,
.receive_buf = slip_receive_buf, .receive_buf = slip_receive_buf,
.write_wakeup = slip_write_wakeup, .write_wakeup = slip_write_wakeup,