From nobody Mon Sep 28 14:47:48 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21D4B391E78 for ; Thu, 20 Aug 2026 19:52:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787255568; cv=none; b=h9s8co4L2oye/qZ95oZsS+Ep+3pHjUuhJzXqlnf4pTILJEF8AEOPNiuV8qewuaByGmjlrxCtdR1HQ3fnAJjBZfWzzNXWMJC4ExXcCFYEfNg2ep9Kwt9As5aUagp2thR+R1v8n695sGJfWHkVqiWjfk6cLWnwte23QahyRBHyYJo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787255568; c=relaxed/simple; bh=btXZ31id62L7xkXxIIacKYO/K7DamlhGxXWECxAQDls=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LJlRI0Z/mLMqfym3MaoRdqA3rjz6fFUQHsC3IUnPcPCvePyQZGvZ1znbXBCfCTJmUUIF9Zc0tAiz7BIo2pSiJiYHPtOOUWe/PPQ3Nh7rzn8YDJkNO0hYP1TD53mNxVbYUdHie01dbrm6xSzt3MhPiLIUxPw+OeNu06ITb2YMjy4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=VV4OX5Px; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="VV4OX5Px" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2ceab75934dso3810645ad.2 for ; Thu, 20 Aug 2026 12:52:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1787255566; x=1787860366; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pBLOV4ZGgtSNqaZUnfdLgTjbJOpqmbdghaWweHuuFKw=; b=VV4OX5PxgTy6TkxEVnxs/B3GmWI73pKbr8oh+6LVXm2dJglAr1YJKjNpqkpmRF2D5e sDdIOg0zlYlF9LVwiRqhsG5GnSbOwVqqgLRLSbZYI7Zu0yGX2Z6OjEg4zixCq9bq3MvY 5k4RwuwSwGjumGyXT8WLmTZqHJ1Zn8+ssQH9UN+P5YBx0v2KKUZlbOnMacgTQ5lta0tm T9rqFKKrfQy/r260XnDMZpvknYUpTbB94KPRmtCaJBQ5NNUsO4DMAhKUHenwyFOEUh3w j6YQADSnlioamV4zywypKLVxsxgG9t5Ws4zDIv0PqW+SZErgIiyeGBgTgzJ9/NmP7te7 pZ7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787255566; x=1787860366; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pBLOV4ZGgtSNqaZUnfdLgTjbJOpqmbdghaWweHuuFKw=; b=OnJtIE2l+JfQsFQEmFKZyu31xzb1hzwsxitg6ebTpx2AMuAuQjrgjvsJVMnRaI3ZGn csMIVL+IIksPsc0uE1UX1m85zqHgD5fCRUi+g+1ibvsD9YhRPrxNjpg180DFjGNi7e5p gXgBg9ORd/B84QfzKeTTpgYLPILYjRg8xpFjbhzs6ST/8g+MhSfONkn5/IEPyIgZllmO VktiJRmq+BFEhoZ0+KDfoTn7Wye4QhG97saTFNBpYjJlv2kQB99fcfXJsFLJts85fQoo RL+TiMvDyUk6qPZetriMRp0R44fepczaaHhbFIbx05ovi5mZDb6PI9zLhyEBrZ0i3RvH WoMw== X-Forwarded-Encrypted: i=1; AHgh+RpuXTkRGlvbPcfaymFppBDgMBZVZt/OEb2eVdeWnK8dP+oRVszRM8CXOIxkv2AeSDZTD5x/l0vd3/HXVME=@vger.kernel.org X-Gm-Message-State: AFuF++l+ZkCa8/cKOe7SvkVzsuCVsDkRgNPIMndzgLOY/vWMJtkLA7jR C4fZwjiT0kgNHb2vYvD6mip2VaEVUZDw+Kbl5BgxNOzfUBsUoQ6+RQZFg9veL8k6Ew== X-Gm-Gg: AR+sD13RjA8CRJlyQqRcKh7qse2MVLK59/RbyEEiOM1Uq0YtwR82ixg8WIgWnWMj0fp FhDXPk/dyFtGiCJV98Td+4tscXoPgRwt+TcoTFWbZ9jqh5xWj0VCuLbLdOmkxHXnIzRvEn3kZVJ cPr09E+U9h2I7s66IxK1A4VIcK5ZCjXYmzFOrDI3jg2nK08OMABxYCiZ6JrCLcVHw/OvZEtEpPE BzUSP0+reCLP4OM8p78D7KOx3AhqYhhDSggGuBUn2KoKluyhpbV3vFmF2rh9WZvKn/h+rfQKJVn 59Jud4+AcaThFeNpXaldxMG+bVepkMY1IpNIvXZergiVC9bKjBThWThxM/KBIB9PHrVdJmRzf1B ziPdIYLSNjzKwn5e06lKx2HC11B7hCCwaiZFXiBK0kCKwqFkdc+uVOJDLPOuonRdsaWkz0E8lry s4ufUkhdjpVnHW18RSZgnVgEPI7oQILJiTunRerx5y3j8u9QtQ249hTQ4HrcbE6XmXI7yhuoOsN kDtixfqJLtlhp9UXVpYaxX1+Pqgiwv0ttSbpsDrs4vvew== X-Received: by 2002:a17:902:ccc8:b0:2ca:e19c:986 with SMTP id d9443c01a7336-2d64ada2425mr24353565ad.1.1787255566356; Thu, 20 Aug 2026 12:52:46 -0700 (PDT) Received: from xps.tailc0aff1.ts.net (149-169-99-5.nat.asu.edu. [149.169.99.5]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327bf10b584sm32311599eec.16.2026.08.20.12.52.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 12:52:45 -0700 (PDT) From: Xiang Mei To: Subash Abhinov Kasiviswanathan , Sean Tranchetti , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, co+4638111fe2a12980@bugs.sh, Xiang Mei Subject: [PATCH net v2] net: qualcomm: rmnet: restore skb->dev on deaggregated frames Date: Thu, 20 Aug 2026 12:52:40 -0700 Message-ID: <20260820195240.1631458-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev =3D ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:1= 58) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command= .c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:1= 25) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Fixes: 378e25357ac7 ("net: qualcomm: rmnet: Remove unnecessary device assig= nment") Reported-by: co+4638111fe2a12980@bugs.sh Closes: https://lore.kernel.org/netdev/ijg79FFMfIvKJbivdJEKvTO90Q9dTvyBkJck= @bugs.sh/T/#u Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei Reviewed-by: Subash Abhinov Kasiviswanathan --- v2: assign in rmnet_map_deaggregate() instead of rmnet_map_command(), thank @Eric Dumazet. drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers= /net/ethernet/qualcomm/rmnet/rmnet_map_data.c index 305ae15ae8f3..e6f48dc9fe64 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c @@ -394,6 +394,7 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *s= kb, if (!skbn) return NULL; =20 + skbn->dev =3D skb->dev; skb_reserve(skbn, RMNET_MAP_DEAGGR_HEADROOM); skb_put(skbn, packet_len); memcpy(skbn->data, skb->data, packet_len); --=20 2.43.0