netdev - Re: [PATCH v3] net: nfc: Fix use-after-free in local

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 8 Jan 2023 16:45:17 +0100
From:   Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To:     Jisoo Jang <jisoo.jang@...sei.ac.kr>, pabeni@...hat.com,
        netdev@...r.kernel.org
Cc:     edumazet@...gle.com, kuba@...nel.org, dokyungs@...sei.ac.kr,
        linuxlovemin@...sei.ac.kr
Subject: Re: [PATCH v3] net: nfc: Fix use-after-free in local_cleanup()

On 06/01/2023 07:32, Jisoo Jang wrote:
> Fix a use-after-free that occurs in kfree_skb() called from
> local_cleanup(). When detaching an nfc device, local_cleanup()
> called from nfc_llcp_unregister_device() frees local->rx_pending
> and cancels local->rx_work. So the socket allocated before
> unregister is not set null by nfc_llcp_rx_work().

How nfc_llcp_rx_work() is related to this case? It would if there was a
race condition to which your fix does nothing (so does not close any
race). If there is no race condition, drop the sentence, it is confusing.

If there is a race condition, this is not sufficient fix.

> local_cleanup() called from local_release() frees local->rx_pending
> again, which leads to the bug.
> 
> Set local->rx_pending to NULL in local_cleanup()
> 
> Found by a modified version of syzkaller.
> 
> BUG: KASAN: use-after-free in kfree_skb
> Call Trace:
>  kfree_skb
>  local_cleanup
>  nfc_llcp_local_put
>  llcp_sock_destruct
>  __sk_destruct
>  sk_destruct
>  __sk_free
>  sk_free
>  llcp_sock_release
>  __sock_release
>  sock_close
>  __fput
>  task_work_run
>  exit_to_user_mode_prepare
>  syscall_exit_to_user_mode
>  do_syscall_64
>  entry_SYSCALL_64_after_hwframe

decode_stacktrace.sh could be useful here.

Best regards,
Krzysztof