netdev - Re: [Patch net] igmp: acquire pmc lock for ip_mc_clear

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 13 Jun 2017 13:00:37 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, andreyknvl@...gle.com, edumazet@...gle.com,
        lucien.xin@...il.com
Subject: Re: [Patch net] igmp: acquire pmc lock for ip_mc_clear_src()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Mon, 12 Jun 2017 09:52:26 -0700

> Andrey reported a use-after-free in add_grec():
> 
>         for (psf = *psf_list; psf; psf = psf_next) {
> 		...
>                 psf_next = psf->sf_next;
> 
> where the struct ip_sf_list's were already freed by:
> 
>  kfree+0xe8/0x2b0 mm/slub.c:3882
>  ip_mc_clear_src+0x69/0x1c0 net/ipv4/igmp.c:2078
>  ip_mc_dec_group+0x19a/0x470 net/ipv4/igmp.c:1618
>  ip_mc_drop_socket+0x145/0x230 net/ipv4/igmp.c:2609
>  inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:411
>  sock_release+0x8d/0x1e0 net/socket.c:597
>  sock_close+0x16/0x20 net/socket.c:1072
> 
> This happens because we don't hold pmc->lock in ip_mc_clear_src()
> and a parallel mr_ifc_timer timer could jump in and access them.
> 
> The RCU lock is there but it is merely for pmc itself, this
> spinlock could actually ensure we don't access them in parallel.
> 
> Thanks to Eric and Long for discussion on this bug.
> 
> Reported-by: Andrey Konovalov <andreyknvl@...gle.com>
> Cc: Eric Dumazet <edumazet@...gle.com>
> Cc: Xin Long <lucien.xin@...il.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied and queued up for -stable, thanks.