netdev - Re: [PATCH net] net: devlink: fix UAF in devlink_compat_running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Dec 2022 09:39:25 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Ido Schimmel <idosch@...sch.org>,
        Yang Yingliang <yangyingliang@...wei.com>,
        Leon Romanovsky <leon@...nel.org>, netdev@...r.kernel.org,
        jiri@...dia.com, davem@...emloft.net, edumazet@...gle.com,
        pabeni@...hat.com
Subject: Re: [PATCH net] net: devlink: fix UAF in
 devlink_compat_running_version()

Wed, Nov 30, 2022 at 06:20:42PM CET, kuba@...nel.org wrote:
>On Wed, 30 Nov 2022 18:00:05 +0100 Jiri Pirko wrote:
>> Wed, Nov 30, 2022 at 05:46:59PM CET, kuba@...nel.org wrote:
>> >On Wed, 30 Nov 2022 12:42:39 +0100 Jiri Pirko wrote:  
>> >> **)
>> >> I see. With the change I suggest, meaning doing
>> >> devlink_port_register/unregister() and netdev_register/unregister only
>> >> for registered devlink instance, you don't need this at all. When you
>> >> hit this compat callback, the netdevice is there and therefore devlink
>> >> instance is registered for sure.  
>> >
>> >If you move devlink registration up it has to be under the instance
>> >lock, otherwise we're back to reload problems. That implies unregister
>> >should be under the lock too. But then we can't wait for refs in
>> >unregister. Perhaps I don't understand the suggestion.  
>> 
>> I unlock for register and for the rest of the init I lock again.
>
>The moment you register that instance callbacks can start coming.
>Leon move the register call last for a good reason - all drivers
>we looked at had bugs in handling init.
>
>We can come up with fixes in the drivers, flags, devlink_set_features()
>and all that sort of garbage until the day we die but let's not.
>The driver facing API should be simple - hold the lock around entire
>init.
>
>> >> What is "half-initialized"? Take devlink reload flow for instance. There
>> >> are multiple things removed/readded, like devlink_port and related
>> >> netdevice. No problem there.  
>> >
>> >Yes, but reload is under the instance lock, so nothing can mess with 
>> >a device in a transitional state.  
>> 
>> Sure, that is what I want to do too. To be under instance lock.
>
>I'm confused, you just said "I unlock for register".

Ah, right. I got your point now, you don't want the user to see
half-init devlink objects. In reload, the secondhalf-uninit&seconfhalf-init
happens atomically under instance lock, so the user sees the whole picture
still.

But is it a problem? For ports, I don't think so. For the other objects
being removed-readded during reload, why do you think it is a problem?


>
>> >> As mentioned above (**), I don't think this is needed.  
>> >
>> >But it is, please just let me do it and make the bugs stop 😭  
>> 
>> Why exactly is it needed? I don't see it, pardon my ignorance :)
>> 
>> Let me send the RFC of the change tomorrow, you'll see what I mean.
>
>The way I see it Leon had a stab at it, you did too, now it's my turn..

Up to you.