linux-kernel - [PATCH] workqueue: Prevent delayed work UAF kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri,  7 Jun 2024 10:46:11 -0600
From: Tim Van Patten <timvp@...omium.org>
To: LKML <linux-kernel@...r.kernel.org>
Cc: druth@...omium.org,
	Tim Van Patten <timvp@...gle.com>,
	Lai Jiangshan <jiangshanlai@...il.com>,
	Tejun Heo <tj@...nel.org>
Subject: [PATCH] workqueue: Prevent delayed work UAF kernel panic

From: Tim Van Patten <timvp@...gle.com>

A kernel panic can be triggered by delayed work being queued to a
workqueue that has been destroyed (wq->cpu_pwq nullified).

Commit 33e3f0a3358b ("workqueue: Add a new flag to spot the potential
UAF error")added the flag __WQ_DESTROYING to help avoid this. However,
this solution still allows work to be queued if it's from the same
workqueue, even if the workqueue has been fully destroyed, which is
possible with queue_delayed_work().

1. queue_delayed_work()
2. destroy_workqueue()
3. [delayed work timer expires]: delayed_work_timer_fn()

To prevent kernel panics, check if the pwq and pwq->pool pointers are
valid before derefencing them, and discard the work if they're not.

Discarding all work once __WQ_DESTROYING has been set (including from
the same workqueue) causes breakage, so we must check the pointers
directly.

Signed-off-by: Tim Van Patten <timvp@...gle.com>
---

 kernel/workqueue.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 003474c9a77d0..6bcd5605dbc8b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2291,6 +2291,18 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 	}

 	pwq = rcu_dereference(*per_cpu_ptr(wq->cpu_pwq, cpu));
+
+	/*
+	 * Discard work queued to a destroyed wq.
+	 * This must be checked while the rcu_read_lock() is
+	 * held, so destroy_workqueue() cannot nullify wq->cpu_pwq while it's
+	 * being accessed here.
+	 */
+	if (WARN_ON_ONCE(!pwq || !pwq->pool)) {
+		pr_warn("workqueue %s: discarding work for destroyed wq\n", wq->name);
+		goto out_rcu_read_unlock;
+	}
+
 	pool = pwq->pool;

 	/*
@@ -2365,6 +2377,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,

 out:
 	raw_spin_unlock(&pool->lock);
+out_rcu_read_unlock:
 	rcu_read_unlock();
 }

-- 
2.45.2.505.gda0bf45e8d-goog