mirror of
https://github.com/torvalds/linux.git
synced 2026-09-21 04:10:02 +02:00
fde39b8a52
ipheth_sndbulk_callback() re-arms the carrier-check work on any
non-zero URB status:
else
schedule_delayed_work(&dev->carrier_work, 0);
Nothing ties that to the interface being up, so the work can be armed
again after ipheth_close() has already drained it, and stay armed
until the netdev whose private area embeds it is freed.
On unplug with a TX URB in flight, ipheth_disconnect() drains the work
through unregister_netdev() -> ipheth_close() ->
cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().
usb_kill_urb() completes the in-flight TX URB with -ENOENT, so
ipheth_sndbulk_callback() runs after the drain and re-arms
carrier_work.
The same completion also re-arms the work if the interface is only
brought down while a TX URB is in flight, and
ipheth_carrier_check_work() then keeps re-queueing itself once a
second. unregister_netdev() does not call ipheth_close() for an
already-down interface, so nothing drains it on the later unplug
either.
In both cases free_netdev() frees the netdev while carrier_work is
still pending, and ipheth_carrier_check_work() dereferences freed
memory.
Tie the work to the interface state instead of chasing the completion:
disable it in ipheth_close() and enable it in ipheth_open(), so a
schedule_delayed_work() from the URB completion is a no-op whenever
the interface is not up. disable_delayed_work_sync() also waits for a
running instance, so it fully replaces the cancel_delayed_work_sync()
it takes the place of. The work starts out disabled in ipheth_probe()
so the enable/disable counts balance from the first open.
Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and
raw-gadget standing in for the device, driving the second path above (the
interface is already down, so unregister_netdev() does not call
ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in
__run_timers(), freed by ipheth_disconnect() and re-armed from
ipheth_sndbulk_callback() via queue_delayed_work_on(). The
same trigger on a kernel differing only by this patch reports 0 of 15,
and the carrier check still functions across open/close cycles.
The reproducer needs an attached USB device that stops draining bulk OUT,
plus a link down and unplug, driven as root. It is not a privilege
boundary crossing and no exploit primitive was developed.
Found by 0sec (https://0sec.ai).
Fixes:
|
||
|---|---|---|
| .. | ||
| aqc111.c | ||
| aqc111.h | ||
| asix_common.c | ||
| asix_devices.c | ||
| asix.h | ||
| ax88172a.c | ||
| ax88179_178a.c | ||
| catc.c | ||
| cdc_eem.c | ||
| cdc_ether.c | ||
| cdc_mbim.c | ||
| cdc_ncm.c | ||
| cdc_subset.c | ||
| cdc-phonet.c | ||
| ch9200.c | ||
| cx82310_eth.c | ||
| dm9601.c | ||
| gl620a.c | ||
| hso.c | ||
| huawei_cdc_ncm.c | ||
| int51x1.c | ||
| ipheth.c | ||
| kalmia.c | ||
| kaweth.c | ||
| Kconfig | ||
| lan78xx.c | ||
| lan78xx.h | ||
| lg-vl600.c | ||
| Makefile | ||
| mcs7830.c | ||
| net1080.c | ||
| pegasus.c | ||
| pegasus.h | ||
| plusb.c | ||
| qmi_wwan.c | ||
| r8152.c | ||
| r8153_ecm.c | ||
| rndis_host.c | ||
| rtl8150.c | ||
| sierra_net.c | ||
| smsc75xx.c | ||
| smsc75xx.h | ||
| smsc95xx.c | ||
| smsc95xx.h | ||
| sr9700.c | ||
| sr9700.h | ||
| sr9800.c | ||
| sr9800.h | ||
| usbnet.c | ||
| zaurus.c | ||