netdev - Re: [PATCH net v1] net/sched: taprio: Fix crash when adding child qdisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221004213617.7qodtbsr37wkyavj@skbuf>
Date:   Tue, 4 Oct 2022 21:36:18 +0000
From:   Vladimir Oltean <vladimir.oltean@....com>
To:     Vinicius Costa Gomes <vinicius.gomes@...el.com>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "yannick.vignon@....com" <yannick.vignon@....com>,
        "jhs@...atatu.com" <jhs@...atatu.com>,
        "xiyou.wangcong@...il.com" <xiyou.wangcong@...il.com>,
        "kuba@...nel.org" <kuba@...nel.org>,
        Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@...el.com>
Subject: Re: [PATCH net v1] net/sched: taprio: Fix crash when adding child
 qdisc

On Mon, Oct 03, 2022 at 10:25:03AM -0700, Vinicius Costa Gomes wrote:
> Something like this:
> 
> [   73.174189] refcount_t: underflow; use-after-free.
> [   73.174197] WARNING: CPU: 10 PID: 878 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0
> [   73.174204] Modules linked in: sch_taprio(E) snd_hda_codec_hdmi(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) ledtrig_audio(E) snd_hda_intel(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) snd_pcm(E) igc(E) snd_timer(E) intel_pch_thermal(E) joydev(E) usbhid(E) efivarfs(E)
> [   73.174226] CPU: 10 PID: 878 Comm: tc Tainted: G            E      6.0.0-rc7+ #13
> [   73.174229] Hardware name: Gigabyte Technology Co., Ltd. Z390 AORUS ULTRA/Z390 AORUS ULTRA-CF, BIOS F7 03/14/2019
> [   73.174232] RIP: 0010:refcount_warn_saturate+0xd8/0xe0
> [   73.174246] Code: ff 48 c7 c7 58 4d 61 a4 c6 05 39 59 ac 01 01 e8 36 92 71 00 0f 0b c3 48 c7 c7 00 4d 61 a4 c6 05 25 59 ac 01 01 e8 20 92 71 00 <0f> 0b c3 0f 1f 44 00 00 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13
> [   73.174250] RSP: 0018:ffffa24c8336b9b8 EFLAGS: 00010296
> [   73.174254] RAX: 0000000000000026 RBX: 0000000000000001 RCX: 0000000000000027
> [   73.174257] RDX: ffff9ebfae49c868 RSI: 0000000000000001 RDI: ffff9ebfae49c860
> [   73.174260] RBP: ffff9ebc0a4eb000 R08: 0000000000000000 R09: ffffffffa4e72f40
> [   73.174262] R10: ffffa24c8336b870 R11: ffffffffa4ee2f88 R12: ffff9ebc10bfc000
> [   73.174265] R13: 0000000000000000 R14: ffff9ebc0a4eb000 R15: 0000000000000000
> [   73.174268] FS:  00007f4b546f5c40(0000) GS:ffff9ebfae480000(0000) knlGS:0000000000000000
> [   73.174271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   73.174273] CR2: 00005587d1ad02c1 CR3: 0000000128460005 CR4: 00000000003706e0
> [   73.174276] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   73.174278] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   73.174281] Call Trace:
> [   73.174284]  <TASK>
> [   73.174287]  taprio_destroy+0xa4/0x110 [sch_taprio]
> [   73.174295]  qdisc_destroy+0x48/0x180
> [   73.174300]  qdisc_graft+0x573/0x6b0
> [   73.174308]  tc_get_qdisc+0x157/0x3d0
> [   73.174323]  rtnetlink_rcv_msg+0x155/0x520
> [   73.174328]  ? netlink_deliver_tap+0x78/0x3f0
> [   73.174334]  ? rtnl_getlink+0x3d0/0x3d0
> [   73.174339]  netlink_rcv_skb+0x4e/0xf0
> [   73.174348]  netlink_unicast+0x15e/0x230
> [   73.174354]  netlink_sendmsg+0x234/0x490
> [   73.174363]  sock_sendmsg+0x30/0x40
> [   73.174368]  ____sys_sendmsg+0x214/0x230
> [   73.174373]  ? import_iovec+0x17/0x20
> [   73.174377]  ? copy_msghdr_from_user+0x5d/0x80
> [   73.174384]  ___sys_sendmsg+0x86/0xd0
> [   73.174400]  ? lock_is_held_type+0x9b/0x100
> [   73.174405]  ? find_held_lock+0x2b/0x80
> [   73.174413]  __sys_sendmsg+0x47/0x80
> [   73.174423]  do_syscall_64+0x34/0x80
> [   73.174428]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [   73.174432] RIP: 0033:0x7f4b54817ab7
> [   73.174435] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb ba 0f 1f 00 f3 0f 1e fa 80 3d 2d 9b 0d 00 00 74 13 b8 2e 00 00 00 c5 fc 77 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
> [   73.174438] RSP: 002b:00007fff996ecf18 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [   73.174442] RAX: ffffffffffffffda RBX: 00005587d1af6f60 RCX: 00007f4b54817ab7
> [   73.174444] RDX: 0000000000000000 RSI: 00007fff996ecf68 RDI: 0000000000000003
> [   73.174447] RBP: 00000000633b1a29 R08: 0000000000000001 R09: 00007fff996ecc98
> [   73.174450] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
> [   73.174452] R13: 00007fff996ed060 R14: 0000000000000001 R15: 00005587d1ad219a
> [   73.174464]  </TASK>
> [   73.174466] irq event stamp: 7453
> [   73.174468] hardirqs last  enabled at (7461): [<ffffffffa30fa962>] __up_console_sem+0x52/0x60
> [   73.174473] hardirqs last disabled at (7468): [<ffffffffa30fa947>] __up_console_sem+0x37/0x60
> [   73.174476] softirqs last  enabled at (7094): [<ffffffffa3079d3f>] __irq_exit_rcu+0xbf/0xf0
> [   73.174481] softirqs last disabled at (7089): [<ffffffffa3079d3f>] __irq_exit_rcu+0xbf/0xf0
> [   73.174484] ---[ end trace 0000000000000000 ]---

I studied the problem a bit and unfortunately your fix is not correct.
It is not sufficient to call qdisc_refcount_inc() on the child qdiscs
grafted in taprio_graft(), there are still other sources of use-after-free.

I will send a revert of my patch soon, and explain there in more detail
what the problem is. Sorry for the trouble and thanks for reporting the
problem and proposing a solution.