mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 17:47:41 +02:00
1720db928e
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Fixes:
|
||
|---|---|---|
| .. | ||
| 6lowpan_i.h | ||
| core.c | ||
| debugfs.c | ||
| iphc.c | ||
| Kconfig | ||
| Makefile | ||
| ndisc.c | ||
| nhc_dest.c | ||
| nhc_fragment.c | ||
| nhc_ghc_ext_dest.c | ||
| nhc_ghc_ext_frag.c | ||
| nhc_ghc_ext_hop.c | ||
| nhc_ghc_ext_route.c | ||
| nhc_ghc_icmpv6.c | ||
| nhc_ghc_udp.c | ||
| nhc_hop.c | ||
| nhc_ipv6.c | ||
| nhc_mobility.c | ||
| nhc_routing.c | ||
| nhc_udp.c | ||
| nhc.c | ||
| nhc.h | ||