netdev - Re: [PATCH RFC ipsec] xfrm: fix panic in xfrm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yn1J20HaaXeOjhLk@unreal>
Date:   Thu, 12 May 2022 20:54:35 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Antony Antony <antony.antony@...unet.com>
Cc:     Steffen Klassert <steffen.klassert@...unet.com>,
        netdev@...r.kernel.org, Tobias Brunner <tobias@...ongswan.org>
Subject: Re: [PATCH RFC ipsec] xfrm: fix panic in xfrm_delete from userspace
 on ARM 32

On Thu, May 12, 2022 at 09:44:57AM +0200, Antony Antony wrote:
> A kernel panic was reported on ARM 32 architecture.
> In spite of initialization, x = kmem_cache_zalloc(xfrm_state_cache, GFP_ATOMIC),
> x->mapping_maxage appears to be nozero and cause kernel panic in
> xfrm_state_delete().
> 
> https://github.com/strongswan/strongswan/issues/992
> 
> (__xfrm_state_delete) from [<c091ad58>] (xfrm_state_delete+0x24/0x44)
> (xfrm_state_delete) from [<bf4c31e4>] (xfrm_del_sa+0x94/0xe4 [xfrm_user])
> (xfrm_del_sa [xfrm_user]) from [<bf4c2180>] (xfrm_user_rcv_msg+0xe0/0x1d0 [xfrm_user])
> (xfrm_user_rcv_msg [xfrm_user]) from [<c0878da4>] (netlink_rcv_skb+0xd8/0x148)
> (netlink_rcv_skb) from [<bf4c1724>] (xfrm_netlink_rcv+0x2c/0x48 [xfrm_user])
> (xfrm_netlink_rcv [xfrm_user]) from [<c0878408>] (netlink_unicast+0x208/0x31c)
> (netlink_unicast) from [<c0878710>] (netlink_sendmsg+0x1f4/0x468)
> (netlink_sendmsg) from [<c07e1408>] (__sys_sendto+0xd4/0x13c)
> 
> Even if x->mapping_maxage is non zero I can't explain the cause of panic.
> However, roth-m reports setting  x->mapping_maxage = 0 fix the panic!
> 
> I am still not sure of the cause. So I proposing the fix as an RFC.

We all know that it can't be a fix. It is hard to judge by this
calltrace, but it looks like something in x->km is not set. It is
probably ".all" field.

Thanks

> Anyone has experience with nondeterministic kmem_cache_zalloc() on 32 bit ARM hardware?
> Note other initializations in xfrm_state_alloc() x->replay_maxage = 0. I
> wonder why those were added when there is kmem_cache_zalloc call above.
> 
> The bug report mentioned OpenWRT tool chain and OpenWRT kernel.
> 
> Fixes: 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space")
> Reported-by: https://github.com/roth-m
> Suggested-by: Tobias Brunner <tobias@...ongswan.org>
> Signed-off-by: Antony Antony <antony.antony@...unet.com>
> ---
>  net/xfrm/xfrm_state.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index b749935152ba..1724a9bd232e 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -654,6 +654,9 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
>  		x->lft.hard_packet_limit = XFRM_INF;
>  		x->replay_maxage = 0;
>  		x->replay_maxdiff = 0;
> +		x->mapping_maxage = 0;
> +		x->new_mapping = 0;
> +		x->new_mapping_sport = 0;
>  		spin_lock_init(&x->lock);
>  	}
>  	return x;
> --
> 2.30.2
>