github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ipconfig: fix use-after-free of device list after ic_close_devs()

Browse Source 
ic_close_devs() kfree()s every ic_device node but leaves the static
ic_first_dev and ic_dev pointers dangling behind.  When a DHCP
negotiation gets an OFFER but never the matching ACK, ic_bootp_recv()
accepts the OFFER and records ic_dev = <list node>, the round times
out and ic_close_devs() frees the whole list — node included.  The
next failed retry round runs ic_close_devs() once more, evaluating

    selected_dev = ic_dev ? ic_dev->dev : NULL;

against the freed ic_device — an 8-byte use-after-free read.

KASAN confirms:

  BUG: KASAN: slab-use-after-free in ic_close_devs+0x214/0x220
  Read of size 8
    ic_close_devs    <- ip_auto_config
  Allocated by: ip_auto_config (ic_open_devs)
  Freed by:      ic_close_devs <- ip_auto_config

NULL both pointers after the free loop so retry rounds take the
clean empty-list path.

Cc: stable+noautosel@kernel.org # LLM report + LLM fix, not seen in real life
Fixes: 46acf7bdbc ("Revert "net: ipv4: handle DSA enabled master network devices"")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261010085003.3261587-1-bsdhenrymartin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Henry Martin 2026-10-10 16:49:58 +08:00 committed by Jakub Kicinski
parent 001e9181ad
commit befe96ed37
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/ipv4/ipconfig.c
View File

@ -346,6 +346,9 @@ static void __init ic_close_devs(void)
kfree(d);
}
rtnl_unlock();
ic_first_dev = NULL;
ic_dev = NULL;
}
/*