[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <83913196-1240-45b4-9d7b-6f5dffc528c6@oracle.com>
Date: Tue, 10 Sep 2024 11:16:59 -0700
From: Shoaib Rao <rao.shoaib@...cle.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
pabeni@...hat.com,
syzbot+8811381d455e3e9ec788@...kaller.appspotmail.com,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in
unix_stream_read_actor (2)
On 9/10/2024 10:57 AM, Kuniyuki Iwashima wrote:
> From: Shoaib Rao <rao.shoaib@...cle.com>
> Date: Tue, 10 Sep 2024 09:55:03 -0700
>> On 9/9/2024 5:48 PM, Kuniyuki Iwashima wrote:
>>> From: Shoaib Rao <rao.shoaib@...cle.com>
>>> Date: Mon, 9 Sep 2024 17:29:04 -0700
>>>> I have some more time investigating the issue. The sequence of packet
>>>> arrival and consumption definitely points to an issue with OOB handling
>>>> and I will be submitting a patch for that.
>>>
>>> It seems a bit late.
>>> My patches were applied few minutes before this mail was sent.
>>> https://urldefense.com/v3/__https://lore.kernel.org/netdev/172592764315.3964840.16480083161244716649.git-patchwork-notify@kernel.org/__;!!ACWV5N9M2RV99hQ!M806VrqNEGFgGXEoWG85msKAdFPXup7RzHy9Kt4q_HOfpPWsjNHn75KyFK3a3jWvOb9EEQuFGOjpqgk$
>>>
>>
>> That is a subpar fix. I am not sure why the maintainers accepted the fix
>> when it was clear that I was still looking into the issue.
>
> Just because it's not a subpar fix and you were slow and wrong,
> clining to triggering the KASAN splat without thinking much.
>
>
>> Plus the
>> claim that it fixes the panic is absolutely wrong.
>
> The _root_ cause of the splat is mishandling of OOB in manage_oob()
> which causes UAF later in another recvmsg().
>
> Honestly your patch is rather a subpar fix to me, few points:
>
> 1. The change conflicts with net-next as we have already removed
> the additional unnecessary refcnt for OOB skb that has caused
> so many issue reported by syzkaller
>
> 2. Removing OOB skb in queue_oob() relies on the unneeded refcnt
> but it's not mentioned; if merge was done wrongly, another UAF
> will be introduced in recvmsg()
>
> 3. Even the removing logic is completely unnecessary if manage_oob()
> is changed
>
> 4. The scan_again: label is misplaced; two consecutive empty OOB skbs
> never exist at the head of recvq
>
> 5. ioctl() is not fixed
>
> 6. No test added
>
> 7. Fixes: tag is bogus
>
> 8. Subject lacks target tree and af_unix prefix
If you want to nit pick, nit pick away, Just because the patch email
lacks proper formatting does not make the patch technically inferior. My
fix is a proper fix not a hack. The change in queue_oob is sufficient to
fix all issues including SIOCATMARK. The fix in manage_oob is just for
correctness. In your fix I specifically did not like the change made to
fix SIOCATMARK.
What is most worrying is claim to fixing a panic when it can not even
happen with the bug. Please note I am not pushing that my patch be
accepted, I have done what I am suppose to do, it is upto the
maintainers to decide what is best for the code.
Shoaib
Powered by blists - more mailing lists