linux-kernel - Re: [PATCH v2] tun: avoid double free in tun_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211213181131.771581d9@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Mon, 13 Dec 2021 18:11:31 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     George Kennedy <george.kennedy@...cle.com>
Cc:     stephen@...workplumber.org, davem@...emloft.net,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] tun: avoid double free in tun_free_netdev

On Mon, 13 Dec 2021 12:04:11 -0500 George Kennedy wrote:
> Avoid double free in tun_free_netdev() by checking if
> dev->reg_state is NETREG_UNREGISTERING in the tun_set_iff()
> error paths. If dev->reg_state is NETREG_UNREGISTERING that means
> the destructor will be called later.
> 
> BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

> 
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: George Kennedy <george.kennedy@...cle.com>
> ---
> Jakub, decided to go the less code churn route and just
> check for dev->reg_state is NETREG_UNREGISTERING.

I don't think this is correct. E.g. if NETDEV_POST_INIT notifier 
fails the destructor will already have been called and reg_state 
will be NETREG_UNINITIALIZED which is != NETREG_UNREGISTERING.

What I had in mind is replacing if (!dev->tstats) goto .. with 
if (reg_state == NETREG_UNREGISTERING) goto ..

But as proven partial destruction on failure of register_netdevice() is
extra tricky, I believe moving the code into ndo_init would be less
error-prone even if higher LoC delta. Unless there's some trickery in
the code move as well, I haven't investigated.