Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp310944pxf; Thu, 11 Mar 2021 04:36:57 -0800 (PST) X-Google-Smtp-Source: ABdhPJyDBC6rTEqXW8r89FW1GFqRtTQBjHH+MY3j4fBSoUmYgx2Z0xBk4P1EUKxyET1PzvLxyKJe X-Received: by 2002:a17:906:bcfc:: with SMTP id op28mr2850762ejb.238.1615466216849; Thu, 11 Mar 2021 04:36:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1615466216; cv=none; d=google.com; s=arc-20160816; b=En6ES8u5WklBsTT4CHDD95n18QTZUDP/cyjWY6oj/3H19WmHnT1H3b1Fjr2n5KAq82 bKWNMmM/FgDaKi1zxLYSqhEaL72tkNOwZvbWZIm1LqkOGh8J/lnfaQ7a5fJAvjHlFeNz vlrFD8GO9qwv79k9UgSKjH742C4KWrHtS5EOy53WNvQWIG3A9MoaXbBARV83vCyOwzqm MWWopX08M+x+gpvTQqSHehczXOjXKGiqrchMisePQDVw+VQXYKZSp8YjmrAkPb7kIris ElnuRbGtbkO6eBRim8ktvdf3sQdOfCa1OVN3Uyl7mToB7k4I/ppels3CWFjvD4ayNtF7 oS5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:mime-version :content-transfer-encoding:subject:cc:to:from:date:dkim-signature; bh=QANkvusL7zoQr46+cTiCp3AoGeSFNcnHf3DucxApU/E=; b=rIdPAF7Xjh+oX1lqbp+7X+7XeCq6svB1/bqCSr/lF4cSWymaoVLgtko+WaxEe/zYj8 VnkZbrhp+y9luLk8RJWEz1P8jFL32Yq3JZibvhhhBUBMadfDIhAvoqd6MnWYXIR+Sczl IAvUgXNZ+XJKxVtEpWYcU9XVLonEB33EcQK9xtp8lLDfBKrAVv748VPxSOm2xbsErtGh GrCD3JYy9Cv/Xtlv4dy4Sl/kMZnoJb+rr7ly3WuggQ8CbMwwsRLqXTy2aclO4edGCiE2 8fpuLxNaZlx4pOoX0yRSWQuHt+dIFjDjUoB3IzVHk34j0/XBTCQ1pJDLkrKxXoxn/t9B HpgA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@mail.ustc.edu.cn header.s=dkim header.b=Uf6DLvNn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mail.ustc.edu.cn Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e1si1672181edl.520.2021.03.11.04.36.34; Thu, 11 Mar 2021 04:36:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@mail.ustc.edu.cn header.s=dkim header.b=Uf6DLvNn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mail.ustc.edu.cn Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233308AbhCKMf1 (ORCPT + 99 others); Thu, 11 Mar 2021 07:35:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233163AbhCKMew (ORCPT ); Thu, 11 Mar 2021 07:34:52 -0500 Received: from ustc.edu.cn (email6.ustc.edu.cn [IPv6:2001:da8:d800::8]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 53606C061574; Thu, 11 Mar 2021 04:34:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.ustc.edu.cn; s=dkim; h=Received:Date:From:To:Cc:Subject: Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID; bh=ryfXHe18DN1UjZnxckhWgKsLfHZNN7X4RUYg2FqUcMo=; b=Uf6DLvNnY63HV LvMaIuLY6sE+wc+X9lW5C4SPDAy+V3Xd9m8xwAqQrgpYG6cN90XQVsRIihmS3PpM guwvCZNmp+Vp/WWi/1cEtcHP9qSqe1/MWdZVkeqfZ4CcnZxVKAQI5QK9AK1soyhf ER1p2tvr9b2J6OLePgZifs8UaZq2FQ= Received: by ajax-webmail-newmailweb.ustc.edu.cn (Coremail) ; Thu, 11 Mar 2021 20:34:44 +0800 (GMT+08:00) X-Originating-IP: [202.79.170.108] Date: Thu, 11 Mar 2021 20:34:44 +0800 (GMT+08:00) X-CM-HeaderCharset: UTF-8 From: lyl2019@mail.ustc.edu.cn To: paulus@samba.org, davem@davemloft.net Cc: linux-ppp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BUG] net/ppp: A use after free in ppp_unregister_channe X-Priority: 3 X-Mailer: Coremail Webmail Server Version XT3.0.8 dev build 20190610(cb3344cf) Copyright (c) 2002-2021 www.mailtech.cn ustc-xl X-SendMailWithSms: false Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=UTF-8 MIME-Version: 1.0 Message-ID: <6057386d.ca12.1782148389e.Coremail.lyl2019@mail.ustc.edu.cn> X-Coremail-Locale: zh_CN X-CM-TRANSID: LkAmygCHiBhkDkpgRUoMAA--.0W X-CM-SenderInfo: ho1ojiyrz6zt1loo32lwfovvfxof0/1tbiAQsRBlQhn5AN0QACs5 X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3iIAIbVAYjsxI4VW7Jw CS07vEb4IE77IF4wCS07vE1I0E4x80FVAKz4kxMIAIbVAFxVCaYxvI4VCIwcAKzIAtYxBI daVFxhVjvjDU= Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org File: drivers/net/ppp/ppp_generic.c In ppp_unregister_channel, pch could be freed in ppp_unbridge_channels() but after that pch is still in use. Inside the function ppp_unbridge_channels, if "pchbb == pch" is true and then pch will be freed. I checked the commit history and found that this problem is introduced from 4cf476ced45d7 ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls"). I have no idea about how to generate a suitable patch, sorry.