lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 09 Mar 2020 11:01:17 -0700
From:   Andre Guedes <andre.guedes@...ux.intel.com>
To:     Vinicius Costa Gomes <vinicius.gomes@...el.com>,
        netdev@...r.kernel.org
Cc:     Vinicius Costa Gomes <vinicius.gomes@...el.com>, jhs@...atatu.com,
        xiyou.wangcong@...il.com, jiri@...nulli.us, davem@...emloft.net,
        aaron.f.brown@...el.com, sasha.neftin@...el.com,
        Michael Schmidt <michael.schmidt@....uni-siegen.de>
Subject: Re: [PATCH net v1] taprio: Fix sending packets without dequeueing them

Quoting Vinicius Costa Gomes (2020-03-09 10:39:53)
> There was a bug that was causing packets to be sent to the driver
> without first calling dequeue() on the "child" qdisc. And the KASAN
> report below shows that sending a packet without calling dequeue()
> leads to bad results.
> 
> The problem is that when checking the last qdisc "child" we do not set
> the returned skb to NULL, which can cause it to be sent to the driver,
> and so after the skb is sent, it may be freed, and in some situations a
> reference to it may still be in the child qdisc, because it was never
> dequeued.
> 
> The crash log looks like this:
> 
> [   19.937538] ==================================================================
> [   19.938300] BUG: KASAN: use-after-free in taprio_dequeue_soft+0x620/0x780
> [   19.938968] Read of size 4 at addr ffff8881128628cc by task swapper/1/0
> [   19.939612]
> [   19.939772] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc3+ #97
> [   19.940397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qe4
> [   19.941523] Call Trace:
> [   19.941774]  <IRQ>
> [   19.941985]  dump_stack+0x97/0xe0
> [   19.942323]  print_address_description.constprop.0+0x3b/0x60
> [   19.942884]  ? taprio_dequeue_soft+0x620/0x780
> [   19.943325]  ? taprio_dequeue_soft+0x620/0x780
> [   19.943767]  __kasan_report.cold+0x1a/0x32
> [   19.944173]  ? taprio_dequeue_soft+0x620/0x780
> [   19.944612]  kasan_report+0xe/0x20
> [   19.944954]  taprio_dequeue_soft+0x620/0x780
> [   19.945380]  __qdisc_run+0x164/0x18d0
> [   19.945749]  net_tx_action+0x2c4/0x730
> [   19.946124]  __do_softirq+0x268/0x7bc
> [   19.946491]  irq_exit+0x17d/0x1b0
> [   19.946824]  smp_apic_timer_interrupt+0xeb/0x380
> [   19.947280]  apic_timer_interrupt+0xf/0x20
> [   19.947687]  </IRQ>
> [   19.947912] RIP: 0010:default_idle+0x2d/0x2d0
> [   19.948345] Code: 00 00 41 56 41 55 65 44 8b 2d 3f 8d 7c 7c 41 54 55 53 0f 1f 44 00 00 e8 b1 b2 c5 fd e9 07 00 3
> [   19.950166] RSP: 0018:ffff88811a3efda0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
> [   19.950909] RAX: 0000000080000000 RBX: ffff88811a3a9600 RCX: ffffffff8385327e
> [   19.951608] RDX: 1ffff110234752c0 RSI: 0000000000000000 RDI: ffffffff8385262f
> [   19.952309] RBP: ffffed10234752c0 R08: 0000000000000001 R09: ffffed10234752c1
> [   19.953009] R10: ffffed10234752c0 R11: ffff88811a3a9607 R12: 0000000000000001
> [   19.953709] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
> [   19.954408]  ? default_idle_call+0x2e/0x70
> [   19.954816]  ? default_idle+0x1f/0x2d0
> [   19.955192]  default_idle_call+0x5e/0x70
> [   19.955584]  do_idle+0x3d4/0x500
> [   19.955909]  ? arch_cpu_idle_exit+0x40/0x40
> [   19.956325]  ? _raw_spin_unlock_irqrestore+0x23/0x30
> [   19.956829]  ? trace_hardirqs_on+0x30/0x160
> [   19.957242]  cpu_startup_entry+0x19/0x20
> [   19.957633]  start_secondary+0x2a6/0x380
> [   19.958026]  ? set_cpu_sibling_map+0x18b0/0x18b0
> [   19.958486]  secondary_startup_64+0xa4/0xb0
> [   19.958921]
> [   19.959078] Allocated by task 33:
> [   19.959412]  save_stack+0x1b/0x80
> [   19.959747]  __kasan_kmalloc.constprop.0+0xc2/0xd0
> [   19.960222]  kmem_cache_alloc+0xe4/0x230
> [   19.960617]  __alloc_skb+0x91/0x510
> [   19.960967]  ndisc_alloc_skb+0x133/0x330
> [   19.961358]  ndisc_send_ns+0x134/0x810
> [   19.961735]  addrconf_dad_work+0xad5/0xf80
> [   19.962144]  process_one_work+0x78e/0x13a0
> [   19.962551]  worker_thread+0x8f/0xfa0
> [   19.962919]  kthread+0x2ba/0x3b0
> [   19.963242]  ret_from_fork+0x3a/0x50
> [   19.963596]
> [   19.963753] Freed by task 33:
> [   19.964055]  save_stack+0x1b/0x80
> [   19.964386]  __kasan_slab_free+0x12f/0x180
> [   19.964830]  kmem_cache_free+0x80/0x290
> [   19.965231]  ip6_mc_input+0x38a/0x4d0
> [   19.965617]  ipv6_rcv+0x1a4/0x1d0
> [   19.965948]  __netif_receive_skb_one_core+0xf2/0x180
> [   19.966437]  netif_receive_skb+0x8c/0x3c0
> [   19.966846]  br_handle_frame_finish+0x779/0x1310
> [   19.967302]  br_handle_frame+0x42a/0x830
> [   19.967694]  __netif_receive_skb_core+0xf0e/0x2a90
> [   19.968167]  __netif_receive_skb_one_core+0x96/0x180
> [   19.968658]  process_backlog+0x198/0x650
> [   19.969047]  net_rx_action+0x2fa/0xaa0
> [   19.969420]  __do_softirq+0x268/0x7bc
> [   19.969785]
> [   19.969940] The buggy address belongs to the object at ffff888112862840
> [   19.969940]  which belongs to the cache skbuff_head_cache of size 224
> [   19.971202] The buggy address is located 140 bytes inside of
> [   19.971202]  224-byte region [ffff888112862840, ffff888112862920)
> [   19.972344] The buggy address belongs to the page:
> [   19.972820] page:ffffea00044a1800 refcount:1 mapcount:0 mapping:ffff88811a2bd1c0 index:0xffff8881128625c0 compo0
> [   19.973930] flags: 0x8000000000010200(slab|head)
> [   19.974388] raw: 8000000000010200 ffff88811a2ed650 ffff88811a2ed650 ffff88811a2bd1c0
> [   19.975151] raw: ffff8881128625c0 0000000000190013 00000001ffffffff 0000000000000000
> [   19.975915] page dumped because: kasan: bad access detected
> [   19.976461] page_owner tracks the page as allocated
> [   19.976946] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NO)
> [   19.978332]  prep_new_page+0x24b/0x330
> [   19.978707]  get_page_from_freelist+0x2057/0x2c90
> [   19.979170]  __alloc_pages_nodemask+0x218/0x590
> [   19.979619]  new_slab+0x9d/0x300
> [   19.979948]  ___slab_alloc.constprop.0+0x2f9/0x6f0
> [   19.980421]  __slab_alloc.constprop.0+0x30/0x60
> [   19.980870]  kmem_cache_alloc+0x201/0x230
> [   19.981269]  __alloc_skb+0x91/0x510
> [   19.981620]  alloc_skb_with_frags+0x78/0x4a0
> [   19.982043]  sock_alloc_send_pskb+0x5eb/0x750
> [   19.982476]  unix_stream_sendmsg+0x399/0x7f0
> [   19.982904]  sock_sendmsg+0xe2/0x110
> [   19.983262]  ____sys_sendmsg+0x4de/0x6d0
> [   19.983660]  ___sys_sendmsg+0xe4/0x160
> [   19.984032]  __sys_sendmsg+0xab/0x130
> [   19.984396]  do_syscall_64+0xe7/0xae0
> [   19.984761] page last free stack trace:
> [   19.985142]  __free_pages_ok+0x432/0xbc0
> [   19.985533]  qlist_free_all+0x56/0xc0
> [   19.985907]  quarantine_reduce+0x149/0x170
> [   19.986315]  __kasan_kmalloc.constprop.0+0x9e/0xd0
> [   19.986791]  kmem_cache_alloc+0xe4/0x230
> [   19.987182]  prepare_creds+0x24/0x440
> [   19.987548]  do_faccessat+0x80/0x590
> [   19.987906]  do_syscall_64+0xe7/0xae0
> [   19.988276]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> [   19.988775]
> [   19.988930] Memory state around the buggy address:
> [   19.989402]  ffff888112862780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [   19.990111]  ffff888112862800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> [   19.990822] >ffff888112862880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [   19.991529]                                               ^
> [   19.992081]  ffff888112862900: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
> [   19.992796]  ffff888112862980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> 
> Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
> Reported-by: Michael Schmidt <michael.schmidt@....uni-siegen.de>
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@...el.com>

Acked-by: Andre Guedes <andre.guedes@...el.com>

Powered by blists - more mailing lists