linux-kernel - Re: [PATCH net] can: raw: fix raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4d91f7bd-eef2-0b1a-f44f-d2006c465422@hartkopp.net>
Date:   Wed, 21 Jul 2021 11:45:13 +0200
From:   Oliver Hartkopp <socketcan@...tkopp.net>
To:     "Ziyang Xuan (William)" <william.xuanziyang@...wei.com>,
        Greg KH <gregkh@...uxfoundation.org>
Cc:     davem@...emloft.net, kuba@...nel.org, mkl@...gutronix.de,
        netdev@...r.kernel.org, linux-can@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH net] can: raw: fix raw_rcv panic for sock UAF



On 21.07.21 11:29, Ziyang Xuan (William) wrote:
> On 7/21/2021 2:35 PM, Oliver Hartkopp wrote:
>>
>>
>> On 21.07.21 06:53, Greg KH wrote:
>>> On Wed, Jul 21, 2021 at 09:09:37AM +0800, Ziyang Xuan wrote:
>>>> We get a bug during ltp can_filter test as following.
>>>>
>>>> ===========================================
>>>> [60919.264984] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
>>>> [60919.265223] PGD 8000003dda726067 P4D 8000003dda726067 PUD 3dda727067 PMD 0
>>>> [60919.265443] Oops: 0000 [#1] SMP PTI
>>>> [60919.265550] CPU: 30 PID: 3638365 Comm: can_filter Kdump: loaded Tainted: G        W         4.19.90+ #1
>>
>> This kernel version 4.19.90 is definitely outdated.
>>
>> Can you please check your issue with the latest uptream kernel as this problem should have been fixed with this patch:
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8d0caedb759683041d9db82069937525999ada53
>> ("can: bcm/raw/isotp: use per module netdevice notifier")
>>
>> Thanks!
> 
> I have tested it under the latest 5.14-rc2 kernel version which includes commit 8d0caedb7596 before I submit the patch.
> Although I failed to get the vmcore-dmesg file after updating the kernel version to 5.14-rc2 to display here.
> But we can get the conclusion according to the following debug messages and my problem analysis.
> 
> ==========================================
> [ 1048.953574] unlist_netdevice name[vcan0]
> [ 1048.953661] raw_notify 283: enter, waiting
> [ 1050.950967] raw_setsockopt 552: ro->bound[1] ro->ifindex[8] sk[ffff9420c5699800]
> [ 1053.956002] can: receive list entry not found for dev any, id 000, mask 000
> [ 1053.961989] can: receive list entry not found for dev vcan0, id 123, mask 7FF
> 
> raw_setsockopt() executes after unlist_netdevice() and before raw_notify().
> The problem always exists.
> 

You are right!

In the meantime I sent a new reply to your original patch here:

https://lore.kernel.org/linux-can/11822417-5931-b2d8-ae77-ec4a84b8b895@hartkopp.net/

Thanks!