kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Norbert Szetei 4e47f1ac18 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF 
[ Upstream commit ec4215683e ]

pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:

 l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
   -> ppp_input(&po->chan)

It runs under rcu_read_lock() holding only an l2tp_session reference and
takes NO reference on the internal PPP channel (struct channel,
chan->ppp) that ppp_input() dereferences.

The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel
are RCU-safe.  But the internal struct channel is a separate allocation
that ppp_release_channel() frees with a plain kfree():

 close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
   -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)

For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit
(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips
both ppp_disconnect_channel()'s synchronize_net() and
ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace
period.  rcu_read_lock() in pppol2tp_recv() does not protect against a
plain kfree(), so an in-flight ppp_input() on one CPU can dereference
the channel just freed by close() on another CPU.

The bug is reachable by an unprivileged user.

Defer the channel free to an RCU callback via call_rcu() so the grace
period fences any in-flight ppp_input(). The disconnect and unbridge
teardown paths already fence with synchronize_net()/synchronize_rcu();
call_rcu() does the same here without stalling the close() path.

Fixes: ee40fb2e1e ("l2tp: protect sock pointer of struct pppol2tp_session with RCU")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Qingfang Deng <qingfang.deng@linux.dev>
Link: https://patch.msgid.link/E793FCF2-58DE-4387-A983-C7B4BC3158BD@doyensec.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-19 17:13:53 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup 2026-07-24 15:51:56 +02:00
amba amba: tegra-ahb: Fix device leak on SMMU enable 2026-01-19 13:09:54 +01:00
android binder: fix UAF in binder_free_transaction() 2026-07-24 15:51:19 +02:00
ata ata: pata_pxa: Fix DMA channel leak on probe error 2026-07-24 15:51:54 +02:00
atm atm: fore200e: fix use-after-free in tasklets during device removal 2026-03-04 07:20:36 -05:00
auxdisplay auxdisplay: arm-charlcd: fix release_mem_region() size 2026-03-04 07:19:20 -05:00
base firmware_loader: Fix recursive lock in device_cache_fw_images() 2026-07-24 15:51:33 +02:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block drbd: reject data replies with an out-of-range payload size 2026-07-24 15:51:54 +02:00
bluetooth Bluetooth: btrtl: validate firmware patch bounds 2026-07-24 15:51:55 +02:00
bus bus: sunxi-rsb: Always check register address validity 2026-07-24 15:51:30 +02:00
cdrom cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() 2026-06-01 17:35:41 +02:00
char tpm: Make the TPM character devices non-seekable 2026-07-24 15:51:51 +02:00
clk clk: qcom: a53: Corrected frequency multiplier for 1152MHz 2026-07-24 15:51:37 +02:00
clocksource clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF 2026-03-04 07:20:00 -05:00
comedi comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() 2026-06-19 13:33:29 +02:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: interrupt-cnt: Drop IRQF_NO_THREAD flag 2026-01-19 13:10:18 +01:00
cpufreq cpufreq: conservative: Simplify frequency limit handling 2026-07-24 15:51:30 +02:00
cpuidle cpuidle: powerpc: avoid double clear when breaking snooze 2026-06-01 17:35:22 +02:00
crypto crypto: qat - validate RSA CRT component lengths 2026-07-24 15:52:01 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: account for partial discontiguous resource upon removal 2026-07-24 15:51:31 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:24:17 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: sh: rz-dmac: Move interrupt request after everything is set up 2026-08-19 17:13:52 +02:00
dma-buf udmabuf: fix DMA direction mismatch in release_udmabuf() 2026-07-24 15:51:25 +02:00
edac EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info 2026-07-24 15:51:31 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: ptn5150: handle pending IRQ events during system resume 2026-06-01 17:35:22 +02:00
firewire firewire: nosy: Fix dma_free_coherent() size 2026-01-19 13:09:57 +01:00
firmware firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context 2026-08-19 17:13:53 +02:00
fpga fpga: region: fix use-after-free in child_regions_with_firmware() 2026-07-04 13:39:40 +02:00
fsi use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: pca953x: Make platform teardown callback return void 2026-07-24 15:52:01 +02:00
gpu drm/i2c/sil164: Drop no-op remove function 2026-07-24 15:52:01 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: appleir: fix UAF on pending key_up_timer in remove() 2026-07-24 15:52:00 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-05-02 07:44:06 +02:00
hv Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs 2026-07-04 13:39:40 +02:00
hwmon hwmon: (asus_atk0110) Check package count before accessing element 2026-07-24 15:51:54 +02:00
hwspinlock hwspinlock: qcom: avoid uninitialized struct members 2026-07-24 15:51:34 +02:00
hwtracing coresight: etb10: restore atomic_t for shared reading state 2026-07-24 15:51:58 +02:00
i2c i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() 2026-07-24 15:51:50 +02:00
i3c i3c: master: Prevent reuse of dynamic address on device add failure 2026-07-24 15:51:39 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-28 16:24:16 +02:00
iio iio: imu: inv_icm42600: fix timestamp clock period by using lower value 2026-07-24 15:52:02 +02:00
infiniband RDMA/irdma: Prevent overflows in memory contiguity checks 2026-08-19 17:13:52 +02:00
input Input: ims-pcu - fix logic error in packet reset 2026-08-19 17:13:52 +02:00
interconnect interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node 2025-08-28 16:24:03 +02:00
iommu iommu/amd: Fix a stale comment about which legacy mode is user visible 2026-07-24 15:51:28 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/crossbar: Use correct index in crossbar_domain_free() 2026-07-24 15:51:50 +02:00
isdn use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
leds leds: lm3601x: Improve error reporting for problems during .remove() 2026-07-24 15:52:01 +02:00
macintosh macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 2026-01-19 13:09:28 +01:00
mailbox mailbox: mailbox-test: make data_ready a per-instance variable 2026-06-01 17:35:41 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:44:31 +02:00
md dm-verity: increase sprintf buffer size 2026-07-24 15:51:52 +02:00
media media: qcom: venus: relax encoder frame/blur step size on v6 2026-07-24 15:51:31 +02:00
memory memory: tegra30-emc: Fix dll_change check 2026-06-01 17:35:33 +02:00
memstick memstick: ms_block: reject a card that reports too many blocks 2026-07-24 15:51:55 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: tps6586x: Fix OF node refcount 2026-07-24 15:51:48 +02:00
misc misc: fastrpc: Fix NULL pointer dereference in rpmsg callback 2026-07-04 13:39:40 +02:00
mmc mmc: vub300: defer reset until cmd_mutex is unlocked 2026-07-24 15:51:55 +02:00
most most: usb: fix double free on late probe failure 2025-12-07 06:09:35 +09:00
mtd mtd: nand: mtk-ecc: stop on ECC idle timeouts 2026-08-19 17:13:52 +02:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF 2026-08-19 17:13:53 +02:00
nfc nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems 2026-06-19 13:33:22 +02:00
ntb NTB: epf: Make db_valid_mask cover only real doorbell bits 2026-07-24 15:51:40 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm nvdimm/btt: Free arena sub-allocations on discover_arenas() error path 2026-07-24 15:51:48 +02:00
nvme nvmet-tcp: Fix potential UAF when ddgst mismatch 2026-08-19 17:13:51 +02:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of device property: Make modifications of fwnode "flags" thread safe 2026-06-01 17:35:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: Fix IRQ leak in LASI driver 2026-06-01 17:35:21 +02:00
parport parport: Fix race between port and client registration 2026-06-19 13:33:26 +02:00
pci PCI: Skip Resizable BAR restore on read error 2026-07-24 15:51:58 +02:00
pcmcia PCMCIA: Fix garbled log messages for KERN_CONT 2026-06-01 17:35:37 +02:00
perf perf: arm_spe: Prevent overflow in PERF_IDX2OFF() 2025-10-19 16:21:29 +02:00
phy phy: phy-can-transceiver: Check driver match and driver data against NULL 2026-07-24 15:51:37 +02:00
pinctrl pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 2026-07-24 15:51:33 +02:00
platform platform/x86: xo15-ebook: Fix wakeup source and GPE handling 2026-07-24 15:51:37 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: charger-manager: fix refcount leak in is_full_charged() 2026-07-24 15:51:49 +02:00
powercap powercap: fix sscanf() error return value handling 2026-01-19 13:10:19 +01:00
pps pps: fix warning in pps_register_cdev when register device fail 2025-10-19 16:21:33 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. 2026-02-06 16:41:51 +01:00
pwm pwm: imx27: Fix variable truncation in .apply() 2026-07-24 15:51:30 +02:00
rapidio rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() 2026-07-24 15:51:31 +02:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() 2026-07-24 15:52:02 +02:00
remoteproc remoteproc: mediatek: Unprepare SCP clock during system suspend 2026-04-18 10:33:11 +02:00
reset reset: sunxi: fix memory region leak on ioremap failure 2026-07-24 15:51:55 +02:00
rpmsg rpmsg: core: fix race in driver_override_show() and use core helper 2026-03-04 07:20:25 -05:00
rtc rtc: cmos: unregister HPET IRQ handler on probe failure 2026-07-24 15:51:41 +02:00
s390 s390/monwriter: Reject buffer reuse with different data length 2026-07-24 15:51:54 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: elx: efct: Fix I/O leak on unsupported additional CDB 2026-07-24 15:51:52 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd 2026-07-24 15:51:16 +02:00
soc soc: fsl: qe: panic on ioremap() failure in qe_reset() 2026-07-24 15:51:47 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-28 16:24:10 +02:00
spi spi: uniphier: Fix completion initialization order before devm_request_irq() 2026-07-24 15:51:51 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 2026-07-24 15:51:58 +02:00
target scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 2026-07-24 15:51:52 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: prevent use-after-free when the client exits before the supplicant 2026-06-19 13:33:32 +02:00
thermal thermal: intel: Fix dangling resources on thermal_throttle_online() failure 2026-07-24 15:51:39 +02:00
thunderbolt thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() 2026-06-19 13:33:48 +02:00
tty serial: 8250_mid: Disable DMA for selected platforms 2026-07-24 15:52:00 +02:00
uio uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe 2026-01-19 13:09:23 +01:00
usb usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile 2026-07-24 15:52:01 +02:00
vdpa vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter 2026-07-24 15:51:46 +02:00
vfio vfio/pci: Release the VGA arbiter client on register_device() failure 2026-07-24 15:51:57 +02:00
vhost vhost/vdpa: validate virtqueue index in mmap and fault paths 2026-07-24 15:51:34 +02:00
video fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 2026-07-24 15:51:47 +02:00
virt minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
virtio virtio-mmio: fix device release warning on module unload 2026-07-24 15:51:20 +02:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: therm: Fix off-by-one buffer overflow in alarms_store 2026-02-06 16:42:02 +01:00
watchdog watchdog: unregister PM notifier on watchdog unregister 2026-07-24 15:51:33 +02:00
xen scsi: xen: scsiback: Free unsubmitted command instead of double-putting it 2026-07-24 15:51:52 +02:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00