[PATCH net v1] net/ncsi: fix use-after-free of ncsi_package in ncsi_remove_package()

[Binbin Deng]

ncsi_remove_package() unlinks the package from ndp->packages with
list_del_rcu() and immediately kfree()s it, after having released all
of its channels the same way.  As with the channels, the generic
netlink package info walkers iterate ndp->packages with
list_for_each_entry_rcu() and dereference the package in the loop body
(nla_put_u8(NCSI_PKG_ATTR_ID, np->id), np->multi_channel,
np->channels, ...), so an immediate kfree() turns a mid-walk reader
into a use-after-free the moment a teardown overlaps it.

  writer: rmmod ftgmac100
            -> ftgmac100_remove() -> ncsi_unregister_dev()
            -> ncsi_remove_package() -> kfree(np)
  reader: sendmsg(NETLINK_GENERIC, NCSI_CMD_PKG_INFO)
            -> ncsi_pkg_info_nl() -> ncsi_write_package_info()

Free the package with kfree_rcu() so that it survives the grace period
the readers rely on.

Tested on an arm multi_v7 kernel (KASAN + SLUB + PREEMPT) running as a
QEMU ast2600-evb guest with a host-side NC-SI responder; the PoC
hammers NCSI_CMD_PKG_INFO while cycling insmod/rmmod ftgmac100:

  BUG: KASAN: slab-use-after-free in ncsi_write_package_info+0xe3c/0xf84
  Read of size 1 at addr c69e2580 by task poc_dump/69
   ncsi_write_package_info from ncsi_pkg_info_nl+0x320/0x63c
   netlink_unicast from netlink_sendmsg+0x62c/0xb98
  Freed by task 65:
   which belongs to the cache kmalloc-64 of size 64
  The buggy address is located 0 bytes inside of

struct ncsi_package is 60 bytes and lands in kmalloc-64; a size-1 read
at offset 0 of that cache can only be np->id in this walker (the
u16 vids[] array reads show up as "Read of size 2"), pinning the report
to the kfree() fixed here.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.

Fixes: 2d283bdd079c ("net/ncsi: Resource management")
Signed-off-by: Binbin Deng <18983559317@xxxxxxx>
---
 net/ncsi/internal.h    | 1 +
 net/ncsi/ncsi-manage.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
index adee6dcabdc3..082862581ea6 100644
--- a/net/ncsi/internal.h
+++ b/net/ncsi/internal.h
@@ -253,6 +253,7 @@ struct ncsi_package {
 	bool                 multi_channel; /* Enable multiple channels  */
 	u32                  channel_whitelist; /* Channels to configure */
 	struct ncsi_channel  *preferred_channel; /* Primary channel      */
+	struct rcu_head      rcu;
 };
 
 struct ncsi_request {
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 54d0df0a9efe..76b2cb9efe4f 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -326,7 +326,7 @@ void ncsi_remove_package(struct ncsi_package *np)
 	ndp->package_num--;
 	spin_unlock_irqrestore(&ndp->lock, flags);
 
-	kfree(np);
+	kfree_rcu(np, rcu);
 }
 
 void ncsi_find_package_and_channel(struct ncsi_dev_priv *ndp,
-- 
2.43.0