net/xen-netback: prevent UAF in xenvif_flush_hash()

During the list_for_each_entry_rcu iteration call of xenvif_flush_hash,
kfree_rcu does not exist inside the rcu read critical section, so if
kfree_rcu is called when the rcu grace period ends during the iteration,
UAF occurs when accessing head->next after the entry becomes free.

Therefore, to solve this, you need to change it to list_for_each_entry_safe.

Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index ff96f22648efdeaa3bbac353f1b84c3883a01948..45ddce35f6d2c67d6b1fbed12b7520a9f46f9cab 100644 (file)
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,
 
 static void xenvif_flush_hash(struct xenvif *vif)
 {
-       struct xenvif_hash_cache_entry *entry;
+       struct xenvif_hash_cache_entry *entry, *n;
        unsigned long flags;
 
        if (xenvif_hash_cache_size == 0)
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)
 
        spin_lock_irqsave(&vif->hash.cache.lock, flags);
 
-       list_for_each_entry_rcu(entry, &vif->hash.cache.list, link,
-                               lockdep_is_held(&vif->hash.cache.lock)) {
+       list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {
                list_del_rcu(&entry->link);
                vif->hash.cache.count--;
                kfree_rcu(entry, rcu);