Re: [PATCH rdma-rc] IB/core: fix a UAF for netdev in netdevice_event process

[Jason Gunthorpe]

On Mon, Oct 25, 2021 at 11:42:58AM +0800, Ziyang Xuan wrote:
> When a vlan netdev enter netdevice_event process although it is not a
> roce netdev, it will be passed to netdevice_event_work_handler() to
> process. In order to hold the netdev of netdevice_event after
> netdevice_event() return, call dev_hold() to hold the netdev in
> netdevice_queue_work(). But that did not consider the real_dev of a vlan
> netdev, the real_dev can be freed within netdevice_event_work_handler()
> be scheduled. It would trigger the UAF problem for the real_dev like
> following:

I think this is a netdev bug. Under rtnl vlan_dev_real_dev() should
return NULL if the vlan device has passed unregister_vlan_dev()

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 55275ef9a31a7c..1106da84e72559 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -126,6 +126,7 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
        /* Get rid of the vlan's reference to real_dev */
        dev_put(real_dev);
+       vlan->real_dev = NULL;
 }
 
 int vlan_check_real_dev(struct net_device *real_dev,

I'm assuming there is more too it than this, but it is a starting
point.

Jason