kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/hsr
History
Michael Bommarito 8be6685cdd net: hsr: defer node table free until after RCU readers 
[ Upstream commit aaec7096f9 ]

HSR node-list and node-status generic-netlink operations run under
rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and
hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table
with plain list_del() and frees each node immediately.

That lets a generic-netlink reader hold a struct hsr_node pointer across
hsr_dellink(). In a KASAN build, widening the reader window after
hsr_get_next_node() obtains the node reproduces a slab-use-after-free
when the reader copies node->macaddress_A; the freeing stack is
hsr_del_nodes() from hsr_dellink().

Use list_del_rcu() and defer the free through the existing
hsr_free_node_rcu() callback. This matches the lifetime rule used by the
HSR prune paths, which already delete nodes with list_del_rcu() and
call_rcu().

Fixes: b9a1e62740 ("hsr: implement dellink to clean up resources")
Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260513233838.3064715-2-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ replaced `list_del`+`call_rcu(hsr_free_node_rcu)` with `list_del_rcu`+`kfree_rcu(node, rcu_head)` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:46 +02:00
..
hsr_debugfs.c /net/hsr: fix misspellings using codespell tool 2021-03-18 19:13:41 -07:00
hsr_device.c net: hsr: fix VLAN add unwind on slave errors 2026-04-18 10:33:31 +02:00
hsr_device.h net: hsr: add offloading support 2021-02-11 13:24:44 -08:00
hsr_forward.c net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
hsr_forward.h net: hsr: fix mac_len checks 2021-05-24 14:10:28 -07:00
hsr_framereg.c net: hsr: defer node table free until after RCU readers 2026-06-19 13:33:46 +02:00
hsr_framereg.h hsr: Synchronize sequence number updates. 2022-12-31 13:14:15 +01:00
hsr_main.c hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr 2025-10-02 13:39:04 +02:00
hsr_main.h hsr: use rtnl lock when iterating over ports 2025-10-02 13:39:04 +02:00
hsr_netlink.c genetlink: move to smaller ops wherever possible 2020-10-02 19:11:11 -07:00
hsr_netlink.h hsr: enhance netlink socket interface to support PRP 2020-07-27 12:20:40 -07:00
hsr_slave.c net: hsr: hsr_slave: Fix the promiscuous mode in offload mode 2025-10-02 13:39:05 +02:00
hsr_slave.h net: prp: add packet handling support 2020-07-27 12:20:40 -07:00
Kconfig hsr: enhance netlink socket interface to support PRP 2020-07-27 12:20:40 -07:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00