lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 20 Nov 2022 17:37:49 +0900 (JST) From: Shigeru Yoshida <syoshida@...hat.com> To: edumazet@...gle.com Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com Subject: Re: [PATCH] net: tun: Fix use-after-free in tun_detach() Hi Eric, On Sat, 19 Nov 2022 10:31:38 -0800, Eric Dumazet wrote: > On Fri, Nov 18, 2022 at 11:56 PM Shigeru Yoshida <syoshida@...hat.com> wrote: >> >> syzbot reported use-after-free in tun_detach() [1]. This causes call >> trace like below: >> >> ================================================================== >> BUG: KASAN: use-after-free in notifier_call_chain+0x1da/0x1e0 >> ... >> Call Trace: > > Please include a symbolic stack trace, I think syzbot has them. Thank you so much for your comment. I got it. >> <TASK> >> dump_stack_lvl+0x100/0x178 >> print_report+0x167/0x470 >> ? __virt_addr_valid+0x5e/0x2d0 >> ? __phys_addr+0xc6/0x140 >> ? notifier_call_chain+0x1da/0x1e0 >> ? notifier_call_chain+0x1da/0x1e0 >> kasan_report+0xbf/0x1e0 >> ? notifier_call_chain+0x1da/0x1e0 >> notifier_call_chain+0x1da/0x1e0 >> call_netdevice_notifiers_info+0x83/0x130 >> netdev_run_todo+0xc33/0x11b0 >> ? generic_xdp_install+0x490/0x490 >> ? __tun_detach+0x1500/0x1500 >> tun_chr_close+0xe2/0x190 >> __fput+0x26a/0xa40 >> task_work_run+0x14d/0x240 >> ? task_work_cancel+0x30/0x30 >> do_exit+0xb31/0x2a40 >> ? reacquire_held_locks+0x4a0/0x4a0 >> ? do_raw_spin_lock+0x12e/0x2b0 >> ? mm_update_next_owner+0x7c0/0x7c0 >> ? rwlock_bug.part.0+0x90/0x90 >> ? lockdep_hardirqs_on_prepare+0x17f/0x410 >> do_group_exit+0xd4/0x2a0 >> __x64_sys_exit_group+0x3e/0x50 >> do_syscall_64+0x38/0xb0 >> entry_SYSCALL_64_after_hwframe+0x63/0xcd >> >> The cause of the issue is that sock_put() from __tun_detach() drops >> last reference count for struct net, and then notifier_call_chain() >> from netdev_state_change() accesses that struct net. >> >> This patch fixes the issue by calling sock_put() from tun_detach() >> after all necessary accesses for the struct net has done. >> >> Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1] >> Signed-off-by: Shigeru Yoshida <syoshida@...hat.com> > > Please add a Fixes: tag, once you identified which commit added this bug. I got it too. I'll send v2 patch. Thanks, Shigeru >> --- >> drivers/net/tun.c | 6 +++++- >> 1 file changed, 5 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/net/tun.c b/drivers/net/tun.c >> index 7a3ab3427369..ce9fcf4c8ef4 100644 >> --- a/drivers/net/tun.c >> +++ b/drivers/net/tun.c >> @@ -686,7 +686,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean) >> if (tun) >> xdp_rxq_info_unreg(&tfile->xdp_rxq); >> ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free); >> - sock_put(&tfile->sk); >> } >> } >> >> @@ -702,6 +701,11 @@ static void tun_detach(struct tun_file *tfile, bool clean) >> if (dev) >> netdev_state_change(dev); >> rtnl_unlock(); >> + >> + if (clean) { >> + synchronize_rcu(); >> + sock_put(&tfile->sk); >> + } >> } >> >> static void tun_detach_all(struct net_device *dev) >> -- >> 2.38.1 >> >
Powered by blists - more mailing lists