netdev - Re: [PATCH net 1/2] iavf: Fix use-after-free in free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 19 Apr 2023 09:00:22 +0800
From:   Ding Hui <dinghui@...gfor.com.cn>
To:     Tony Nguyen <anthony.l.nguyen@...el.com>, davem@...emloft.net,
        edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
        intel-wired-lan@...ts.osuosl.org
Cc:     jesse.brandeburg@...el.com, keescook@...omium.org,
        grzegorzx.szczurek@...el.com, mateusz.palczewski@...el.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org,
        Donglin Peng <pengdonglin@...gfor.com.cn>,
        Huang Cun <huangcun@...gfor.com.cn>
Subject: Re: [PATCH net 1/2] iavf: Fix use-after-free in free_netdev

On 2023/4/19 0:50, Tony Nguyen wrote:
> On 4/8/2023 7:00 AM, Ding Hui wrote:
>> We do netif_napi_add() for all allocated q_vectors[], but potentially
>> do netif_napi_del() for part of them, then kfree q_vectors and lefted
>> invalid pointers at dev->napi_list.
>>
>> If num_active_queues is changed to less than allocated q_vectors[] by
>> by unexpected, when iavf_remove, we might see UAF in free_netdev like 
>> this:
>>
>> [ 4093.900222] 
>> ==================================================================
>> [ 4093.900230] BUG: KASAN: use-after-free in free_netdev+0x308/0x390
>> [ 4093.900232] Read of size 8 at addr ffff88b4dc145640 by task 
>> test-iavf-1.sh/6699
> 
> ...
> 
>> Fix it by letting netif_napi_del() match to netif_napi_add().
>>
> 
> Should this have a Fixes:?
> 

Yes, I searched the git log, and found that the mismatched usage was
introduced since the beginning of i40evf_main.c, so I'll add

Fixes: 5eae00c57f5e ("i40evf: main driver core")

in v2.

-- 
Thanks,
- Ding Hui