RE: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX drop

[subash.a.kasiviswanathan]

> -----Original Message-----
> From: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> Sent: Sunday, November 1, 2026 4:24 PM
> To: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@xxxxxxxxxxxxxxxx>; Sean Tranchetti
> <sean.tranchetti@xxxxxxxxxxxxxxxx>
> Cc: netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Jérémy Jean
> <Jeremy.Jean@xxxxxxxxxxxxxxxxx>; stable@xxxxxxxxxxxxxxx
> Subject: [PATCH net v2] net: qualcomm: rmnet: avoid stale VND access on TX
> drop
> 
> A struct rmnet_port stores a pointer to the most recently created RMNET VND
> in port->rmnet_dev, but userspace can delete that VND while the port still has
> another attached VND. When RMNET later sends a buffered TX skb, a failure in
> __skb_linearize() makes rmnet_send_skb() update the drop counter through
> that stale pointer, which causes a UAF.
> 
> The stale pointer can also be used by rmnet_unregister_bridge() when a real
> device leaves bridge mode. In that case it is passed to
> netdev_upper_dev_unlink(), which dereferences the freed VND and leaves the
> actual bridge adjacency behind.
> 
> Account TX drops on the lower device and use the current bridge master
> instead of port->rmnet_dev when unlinking. Remove the now useless
> port->rmnet_dev.
> 
> Fixes: d939b6d30bea ("net: rmnet: fix bridge mode bugs")
> Fixes: 64b5d1f8f2d1 ("net: qualcomm: rmnet: add tx packets aggregation")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> ---
> 
> Changes in v2:
>  - Strengthen the UAF fix following review by Sashiko on the v1
> (https://netdev-
> ai.bots.linux.dev/sashiko/#/patchset/20261031221052.1642262-1-
> Jeremy.Jean%40oss.cyber.gouv.fr)
> 
> v1: https://lore.kernel.org/all/20261031221052.1642262-1-
> Jeremy.Jean@xxxxxxxxxxxxxxxxx/
> 
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c   | 4 +---
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h   | 1 -
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 5 +----
>  3 files changed, 2 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> index 61b04c6c0390..fb586514b41d 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> @@ -96,7 +96,6 @@ static void rmnet_unregister_bridge(struct rmnet_port
> *port)
>  	if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
>  		return;
> 
> -	rmnet_dev = port->rmnet_dev;
>  	if (!port->nr_rmnet_devs) {
>  		/* bridge device */
>  		real_dev = port->bridge_ep;
> @@ -113,6 +112,7 @@ static void rmnet_unregister_bridge(struct
> rmnet_port *port)
>  		port->rmnet_mode = RMNET_EPMODE_VND;
>  	}
> 
> +	rmnet_dev = netdev_master_upper_dev_get(bridge_dev);
>  	netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
>  	rmnet_unregister_real_device(bridge_dev);
>  }
> @@ -163,7 +163,6 @@ static int rmnet_newlink(struct net_device *dev,
>  		goto err2;
> 
>  	port->rmnet_mode = mode;
> -	port->rmnet_dev = dev;
> 
>  	hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
> 
> @@ -487,7 +486,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
>  	slave_port = rmnet_get_port_rtnl(slave_dev);
>  	slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
>  	slave_port->bridge_ep = real_dev;
> -	slave_port->rmnet_dev = rmnet_dev;
> 
>  	port->rmnet_mode = RMNET_EPMODE_BRIDGE;
>  	port->bridge_ep = slave_dev;
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> index 5adda0323dda..26c1d8bccc14 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
> @@ -37,7 +37,6 @@ struct rmnet_port {
>  	u8 rmnet_mode;
>  	struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
>  	struct net_device *bridge_ep;
> -	struct net_device *rmnet_dev;
> 
>  	/* Egress aggregation information */
>  	struct rmnet_egress_agg_params egress_agg_params; diff --git
> a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> index 39d6d084e73f..bd68d60b50d3 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> @@ -543,10 +543,7 @@ static void rmnet_send_skb(struct rmnet_port
> *port, struct sk_buff *skb)  {
>  	if (skb_needs_linearize(skb, port->dev->features)) {
>  		if (unlikely(__skb_linearize(skb))) {
> -			struct rmnet_priv *priv;
> -
> -			priv = netdev_priv(port->rmnet_dev);
> -			this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
> +			dev_core_stats_tx_dropped_inc(port->dev);
>  			dev_kfree_skb_any(skb);
>  			return;
>  		}
> --
> 2.47.3

Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@xxxxxxxxxxxxxxxx>