lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240314112650.GE1038@breakpoint.cc>
Date: Thu, 14 Mar 2024 12:26:50 +0100
From: Florian Westphal <fw@...len.de>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Florian Westphal <fw@...len.de>, xingwei lee <xrivendell7@...il.com>,
	pabeni@...hat.com, davem@...emloft.net, kuba@...nel.org,
	linux-hams@...r.kernel.org, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, ralf@...ux-mips.org,
	syzkaller-bugs@...glegroups.com, samsun1006219@...il.com
Subject: Re: KASAN: slab-use-after-free Read in ip_finish_output

Eric Dumazet <edumazet@...gle.com> wrote:
> Thanks for taking a look Florian.
> 
> Perhaps not messing with truesize at all would help ?
>
> Something based on this POC :
> 
>                 spin_lock(&qp->q.lock);
> +               if (!qp->q.sk) {
> +                       struct sock *sk = skb->sk;
> 
> +                       if (sk && refcount_inc_not_zero(&sk->sk_refcnt))
> +                               qp->q.sk = sk;

Unfortunetely I did not get this to work.

sk_refcnt is 0.  sk is kept alive by sock_wfree destructor.

I don't know how to recover from this, refcnt cannot be "repaired"
anymore.

I could artificially inflate sk_wmem counter by 1, to prevent release,
but that needs yet another sock_wfree-like destructor.

I'm already not sure how this existing scheme works, there are
multiple places that check for skb->destructor == sock_wfree,
yet we have is_skb_wmem helper that checks __sock_wfree and tcp_wfree.

Removing defrag from output seems like best option, but it will
surely break some scenarios.

Or, I could just fail reasm if sk refcount is already 0, that would
likely work too?

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ