[PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop
From: Jérémy Jean
Date: Sun Nov 01 2026 - 18:25:49 EST
A struct rmnet_port stores a pointer to the most recently created
RMNET VND in port->rmnet_dev, but userspace can delete that VND while
the port still has another attached VND. When RMNET later sends a
buffered TX skb, a failure in __skb_linearize() makes rmnet_send_skb()
update the drop counter through that stale pointer, which causes a UAF.
The stale pointer can also be used by rmnet_unregister_bridge() when a
real device leaves bridge mode. In that case it is passed to
netdev_upper_dev_unlink(), which dereferences the freed VND and leaves
the actual bridge adjacency behind.
Account TX drops on the lower device and use the current bridge master
instead of port->rmnet_dev when unlinking. Remove the now useless
port->rmnet_dev.
Fixes: d939b6d30bea ("net: rmnet: fix bridge mode bugs")
Fixes: 64b5d1f8f2d1 ("net: qualcomm: rmnet: add tx packets aggregation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
Changes in v2:
- Strengthen the UAF fix following review by Sashiko on the v1 (https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261031221052.1642262-1-Jeremy.Jean%40oss.cyber.gouv.fr)
v1: https://lore.kernel.org/all/20261031221052.1642262-1-Jeremy.Jean@xxxxxxxxxxxxxxxxx/
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 4 +---
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 -
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 5 +----
3 files changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 61b04c6c0390..fb586514b41d 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -96,7 +96,6 @@ static void rmnet_unregister_bridge(struct rmnet_port *port)
if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
return;
- rmnet_dev = port->rmnet_dev;
if (!port->nr_rmnet_devs) {
/* bridge device */
real_dev = port->bridge_ep;
@@ -113,6 +112,7 @@ static void rmnet_unregister_bridge(struct rmnet_port *port)
port->rmnet_mode = RMNET_EPMODE_VND;
}
+ rmnet_dev = netdev_master_upper_dev_get(bridge_dev);
netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
rmnet_unregister_real_device(bridge_dev);
}
@@ -163,7 +163,6 @@ static int rmnet_newlink(struct net_device *dev,
goto err2;
port->rmnet_mode = mode;
- port->rmnet_dev = dev;
hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
@@ -487,7 +486,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
slave_port = rmnet_get_port_rtnl(slave_dev);
slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
slave_port->bridge_ep = real_dev;
- slave_port->rmnet_dev = rmnet_dev;
port->rmnet_mode = RMNET_EPMODE_BRIDGE;
port->bridge_ep = slave_dev;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 5adda0323dda..26c1d8bccc14 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -37,7 +37,6 @@ struct rmnet_port {
u8 rmnet_mode;
struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
struct net_device *bridge_ep;
- struct net_device *rmnet_dev;
/* Egress aggregation information */
struct rmnet_egress_agg_params egress_agg_params;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 39d6d084e73f..bd68d60b50d3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -543,10 +543,7 @@ static void rmnet_send_skb(struct rmnet_port *port, struct sk_buff *skb)
{
if (skb_needs_linearize(skb, port->dev->features)) {
if (unlikely(__skb_linearize(skb))) {
- struct rmnet_priv *priv;
-
- priv = netdev_priv(port->rmnet_dev);
- this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
+ dev_core_stats_tx_dropped_inc(port->dev);
dev_kfree_skb_any(skb);
return;
}
--
2.47.3