linux-kernel - Re: net/ipv4: use-after-free in ipv4_datagram_support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Apr 2017 13:47:26 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     Willem de Bruijn <willemdebruijn.kernel@...il.com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        James Morris <jmorris@...ei.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Patrick McHardy <kaber@...sh.net>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg

On Wed, 2017-04-12 at 13:07 -0700, Cong Wang wrote:
> On Wed, Apr 12, 2017 at 8:39 AM, Willem de Bruijn
> <willemdebruijn.kernel@...il.com> wrote:
> > ===================
> >> BUG: KASAN: use-after-free in ipv4_datagram_support_cmsg
> >> net/ipv4/ip_sockglue.c:500 [inline] at addr ffff880059be0128
> >
> > Thanks for the report. This is accessing skb->dev from within recvmsg() at line
> >
> >         info->ipi_ifindex = skb->dev->ifindex;
> >
> > Introduced in 829ae9d61165 ("net-timestamp: allow reading recv cmsg on
> > errqueue with origin tstamp"). At this time the device may indeed have
> > gone away. I'm having a look at a way to read this in the receive BH
> > and store the ifindex.
> 
> Why not use skb_iif?
> 
> diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
> index ebd953b..a2aef45 100644
> --- a/net/ipv4/ip_sockglue.c
> +++ b/net/ipv4/ip_sockglue.c
> @@ -497,7 +497,7 @@ static bool ipv4_datagram_support_cmsg(const
> struct sock *sk,
> 
>         info = PKTINFO_SKB_CB(skb);
>         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
> -       info->ipi_ifindex = skb->dev->ifindex;
> +       info->ipi_ifindex = skb->skb_iif;
>         return true;
>  }

This seems to differ from the code in ipv4_pktinfo_prepare()

We probably want to unify things a bit.

                /* skb->cb is overloaded: prior to this point it is IP{6}CB
                 * which has interface index (iif) as the first member of the
                 * underlying inet{6}_skb_parm struct. This code then overlays
                 * PKTINFO_SKB_CB and in_pktinfo also has iif as the first
                 * element so the iif is picked up from the prior IPCB. If iif
                 * is the loopback interface, then return the sending interface
                 * (e.g., process binds socket to eth0 for Tx which is
                 * redirected to loopback in the rtable/dst).
                 */
                if (pktinfo->ipi_ifindex == LOOPBACK_IFINDEX)
                        pktinfo->ipi_ifindex = inet_iif(skb);