Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: atm: fix /proc/net/atm/lec handling

/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Eric Dumazet and committed by
Jakub Kicinski
d03b79f4 d13a3824

+3 -2
+3 -2
net/atm/lec.c
··· 909 909 v = (dev && netdev_priv(dev)) ? 910 910 lec_priv_walk(state, l, netdev_priv(dev)) : NULL; 911 911 if (!v && dev) { 912 - dev_put(dev); 913 912 /* Partial state reset for the next time we get called */ 914 913 dev = NULL; 915 914 } ··· 932 933 { 933 934 struct lec_state *state = seq->private; 934 935 936 + mutex_lock(&lec_mutex); 935 937 state->itf = 0; 936 938 state->dev = NULL; 937 939 state->locked = NULL; ··· 950 950 if (state->dev) { 951 951 spin_unlock_irqrestore(&state->locked->lec_arp_lock, 952 952 state->flags); 953 - dev_put(state->dev); 953 + state->dev = NULL; 954 954 } 955 + mutex_unlock(&lec_mutex); 955 956 } 956 957 957 958 static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos)