netdev - Re: use-after-free in sixpack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151217234739.651e7c5b@lxorguk.ukuu.org.uk>
Date:	Thu, 17 Dec 2015 23:47:39 +0000
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	David Miller <davem@...emloft.net>
Cc:	dvyukov@...gle.com, ajk@...nets.uni-bremen.de,
	linux-hams@...r.kernel.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org,
	jslaby@...e.com, syzkaller@...glegroups.com, kcc@...gle.com,
	glider@...gle.com, sasha.levin@...cle.com, edumazet@...gle.com
Subject: Re: use-after-free in sixpack_close

On Thu, 17 Dec 2015 16:05:32 -0500 (EST)
David Miller <davem@...emloft.net> wrote:

> From: One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
> Date: Thu, 17 Dec 2015 11:41:04 +0000
> 
> >> This report is then followed by a dozen of other use-after-free reports.
> >> 
> >> On commit edb42dc7bc0da0125ceacab810a553ce1f0cac8d (Dec 15).
> >> 
> >> Thank you
> > 
> > sixpack_close does unregister_netdev(sp->dev), which frees sp as sp is
> > actually allocated via alloc_netdev()
> > 
> > Then deletes two timers within sp
> > 
> > Then frees two buffers indexed off sp
> 
> This should fix it, the only thing I'm unsure of is if we should perhaps
> also use del_timer_sync() here.  Anyone?

I think you need to yes as the timers use the data you wil be freeing in
the unregister.

Also you are at the point the tty is closing so the net device may be
active. Don't you need to netif_stop_queue() or defer the buffer
kfrees until after the network device is unregistered so you don't pee
into free memory if you have a transmit occurring ?

Alan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html