Eric Dumazet 23c53269f2 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() ... Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slip_receive_buf() when racing against tty hangup. tty_ldisc_hangup() calls ld->ops->hangup() while holding only a read lock on tty->ldisc_sem (via tty_ldisc_ref()). Because slip_hangup() simply called slip_close(), it ran concurrently with reader functions such as slip_receive_buf(). slip_close() unregisters and frees the net device and its private struct slip, causing concurrent reader threads in slip_receive_buf() to dereference freed memory. Line discipline close() is already guaranteed to be called under the write lock of tty->ldisc_sem during hangup processing (in tty_ldisc_reinit() or tty_ldisc_kill()). Remove slip_hangup() so teardown is serialized cleanly by slip_close(). Fixes: 5342b77c41 ("slip: Clean up create and destroy") Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr> Closes: https://lore.kernel.org/netdev/20260825150655.1450271-1-jjy600901@snu.ac.kr/ Cc: Qingfang Deng <qingfang.deng@linux.dev> Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260826105238.3323436-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-08-27 12:38:27 -07:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile
slhc.c	slip: bound decode() reads against the compressed packet length	2026-04-21 10:18:18 +02:00
slip.c	slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()	2026-08-27 12:38:27 -07:00
slip.h	slip: fix macro redefine warning	2021-11-23 11:38:13 +00:00