netdev - Re: [PATCH net] ipv6: don't let tb6_root node share routes with other node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180119221712.GA16926@splinter>
Date:   Sat, 20 Jan 2018 00:17:12 +0200
From:   Ido Schimmel <idosch@...sch.org>
To:     Wei Wang <weiwan@...gle.com>
Cc:     Martin KaFai Lau <kafai@...com>,
        David Miller <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: [PATCH net] ipv6: don't let tb6_root node share routes with
 other node

On Fri, Jan 19, 2018 at 01:46:02PM -0800, Wei Wang wrote:
> On Fri, Jan 19, 2018 at 1:36 PM, Wei Wang <weiwan@...gle.com> wrote:
> >
> >
> > On Fri, Jan 19, 2018 at 1:13 PM, Ido Schimmel <idosch@...sch.org> wrote:
> >> Hi Wei, Martin,
> >>
> >> On Thu, Jan 18, 2018 at 03:31:29PM -0800, Wei Wang wrote:
> >>> On Thu, Jan 18, 2018 at 2:47 PM, Martin KaFai Lau <kafai@...com> wrote:
> >>> > On Thu, Jan 18, 2018 at 10:40:03AM -0800, Wei Wang wrote:
> >>> >> From: Wei Wang <weiwan@...gle.com>
> >>> >>
> >>> >> After commit 4512c43eac7e, if we add a route to the subtree of
> >>> >> tb6_root
> >>> >> which does not have any route attached to it yet, the current code
> >>> >> will
> >>> >> let tb6_root and the node in the subtree share the same route.
> >>> >> This could cause problem cause tb6_root has RTN_INFO flag marked and
> >>> >> the
> >>> > You meant the RTN_RTINFO check in fib6_purge_rt()?
> >>> >
> >>> Yes. Exactly.
> >>
> >> The check in fib6_purge_rt() is indeed problematic as tb6_root will not
> >> release its reference on the deleted route. I can easily reproduce that
> >> on my system. However, I don't understand how come we end up with a
> >> use-after-free given tb6_root takes a reference on the route?
> >>
> 
> (Resending with plain txt format)
> 
> Hi Ido,
> 
> I think the use-after-free does not really happen on the route that is being
> falsely shared, but on the route which that route's rt6i_next is pointing to.
> Nothing could prevent rt->rt6i_next from being released.

Yep, I considered it, then confused myself and disqualified the
possibility, but you're right. FWIW, here's the reproducer:

ip -6 route add default from 2001:db8::/64 dev dummy0 metric 1
ip -6 route append default from 2001:db8::/64 dev dummy0 metric 2
ip -6 route del default from 2001:db8::/64 dev dummy0 metric 1
ip -6 route del default from 2001:db8::/64 dev dummy0 metric 2
ip -6 route show

Thanks!