netdev - Re: [PATCH net] wireguard: fix use-after-free in root_remove_peer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Feb 2020 10:20:32 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     "Jason A. Donenfeld" <Jason@...c4.com>,
        Eric Dumazet <edumazet@...gle.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        syzbot <syzkaller@...glegroups.com>,
        WireGuard mailing list <wireguard@...ts.zx2c4.com>
Subject: Re: [PATCH net] wireguard: fix use-after-free in
 root_remove_peer_lists



On 2/3/20 10:17 AM, Eric Dumazet wrote:
> 
> 
> On 2/3/20 9:29 AM, Jason A. Donenfeld wrote:
>> Hi Eric,
>>
>> On Mon, Feb 3, 2020 at 6:19 PM Eric Dumazet <edumazet@...gle.com> wrote:
>>> diff --git a/drivers/net/wireguard/allowedips.c b/drivers/net/wireguard/allowedips.c
>>> index 121d9ea0f13584f801ab895753e936c0a12f0028..3725e9cd85f4f2797afd59f42af454acc107aa9a 100644
>>> --- a/drivers/net/wireguard/allowedips.c
>>> +++ b/drivers/net/wireguard/allowedips.c
>>> @@ -263,6 +263,7 @@ static int add(struct allowedips_node __rcu **trie, u8 bits, const u8 *key,
>>>         } else {
>>>                 node = kzalloc(sizeof(*node), GFP_KERNEL);
>>>                 if (unlikely(!node)) {
>>> +                       list_del(&newnode->peer_list);
>>>                         kfree(newnode);
>>>                         return -ENOMEM;
>>>                 }
>>> --
>>> 2.25.0.341.g760bfbb309-goog
>>
>> Thanks, nice catch. I remember switching that code over to using the
>> peer_list somewhat recently and embarrassed I missed this. Glad to see
>> WireGuard is hooked up to syzkaller.
>>
> 
> I will let you work on a lockdep issue that syzbot found :)
> 

BTW wireguard@...ts.zx2c4.com  seems to be a moderated list...

You might document this.

diff --git a/MAINTAINERS b/MAINTAINERS
index 0ae68fb8d38f167ae4a4b8ab49e27946393641e5..890d1f3e698e4c2475eadcd4a462768391328dd7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -18040,7 +18040,7 @@ M:      Jason A. Donenfeld <Jason@...c4.com>
 S:     Maintained
 F:     drivers/net/wireguard/
 F:     tools/testing/selftests/wireguard/
-L:     wireguard@...ts.zx2c4.com
+L:     wireguard@...ts.zx2c4.com (moderated for non-subscribers)
 L:     netdev@...r.kernel.org
 
 WISTRON LAPTOP BUTTON DRIVER