| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <e9fc2db49f6e43d7aca84610f7c0ceef@huawei.com> Date: Sat, 5 Aug 2023 09:40:25 +0000 From: "liubo (D)" <liubo335@...wei.com> To: "borisp@...dia.com" <borisp@...dia.com>, "john.fastabend@...il.com" <john.fastabend@...il.com>, "kuba@...nel.org" <kuba@...nel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org> CC: liaichun <liaichun@...wei.com>, "Yanan (Euler)" <yanan@...wei.com> Subject: [BUG REPORT] UAF in tls tls_encrypt_done During the fuzzing test On linux5.10 Kasan, UAF(tls_sw_context_tx) occurs in the tls_encrypt_done function.: Where tls_sw_context_tx destroyed: sock_close tls_sk_proto_close __sock_release . tls_sk_proto_close if (ctx->tx_conf == TLS_SW) tls_sw_free_ctx_tx(ctx); kfree(ctx) where UAF happens: Kthread . padata_serial_worker tls_encrypt_done spin_unlock_bh(&ctx->encrypt_compl_lock); if (!ready) return; ******(now ctx(tls_sw_context_tx) has been released)***** if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) If ctx->tx_conf == TLS_SW will release ctx directly. Is it because tls_encrypt_done cannot be executed asynchronously if tls is in TLS_SW mode? Or is this bug caused by other reasons? The detailed calltrace information is as follows: BUG: KASAN: use-after-free in instrument_atomic_read_write usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in test_and_set_bit usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/asm-generic/bitops/instrumented-atomic.h:70 [inline] BUG: KASAN: use-after-free in tls_encrypt_done+0x3af/0x570 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:493 Write of size 8 at addr ffff88810b762520 by task kworker/2:0/27 CPU: 2 PID: 27 Comm: kworker/2:0 Tainted: G OE 5.10.0-136.12.0.86.h1063.eulerosv2r12.x86_64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: pencrypt_serial padata_serial_worker Call Trace: __dump_stack usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/lib/dump_stack.c:77 [inline] dump_stack+0xbe/0xfd usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/lib/dump_stack.c:118 print_address_description.constprop.0+0x19/0x170 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:382 __kasan_report.cold+0x6c/0x84 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:542 kasan_report+0x3a/0x50 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:559 check_memory_region_inline usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:187 [inline] check_memory_region+0xfd/0x1f0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:193 instrument_atomic_read_write usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/instrumented.h:101 [inline] test_and_set_bit usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/asm-generic/bitops/instrumented-atomic.h:70 [inline] tls_encrypt_done+0x3af/0x570 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:493 padata_serial_worker+0x25d/0x4c0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/padata.c:383 process_one_work+0x6b6/0xf10 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/workqueue.c:2354 worker_thread+0xdd/0xd80 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/workqueue.c:2500 kthread+0x30a/0x410 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/kthread.c:313 ret_from_fork+0x22/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/arch/x86/entry/entry_64.S:299 Allocated by task 2355: kasan_save_stack+0x1b/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:48 kasan_set_track usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:56 [inline] set_alloc_info usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:498 [inline] __kasan_kmalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:530 [inline] __kasan_kmalloc.constprop.0+0xf0/0x130 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:501 kmalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/slab.h:563 [inline] kzalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/slab.h:675 [inline] tls_set_sw_offload+0xfc9/0x1330 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:2354 do_tls_setsockopt_conf+0x9d0/0xcd0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:552 do_tls_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:602 [inline] tls_setsockopt+0x151/0x1a0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:622 __sys_setsockopt+0x230/0x470 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2133 __do_sys_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2144 [inline] __se_sys_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2141 [inline] __x64_sys_setsockopt+0xbf/0x160 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2141 do_syscall_64+0x33/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Freed by task 2328: kasan_save_stack+0x1b/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:361 __kasan_slab_free.part.0+0x13f/0x1b0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:482 slab_free_hook usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:1569 [inline] slab_free_freelist_hook usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:1608 [inline] slab_free usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:3179 [inline] kfree+0xcb/0x6c0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:4176 tls_sk_proto_close+0x428/0x550 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:324 inet_release+0x138/0x290 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/ipv4/af_inet.c:441 inet6_release+0x51/0x80 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/ipv6/af_inet6.c:486 __sock_release+0xd7/0x290 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:603 sock_close+0x1a/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:1273 __fput+0x34f/0x910 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/fs/file_table.c:290 task_work_run+0xea/0x190 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/task_work.c:161 tracehook_notify_resume usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xf1/0x100 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:172 exit_to_user_mode_prepare+0x7e/0x90 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:206 syscall_exit_to_user_mode+0x12/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:281 entry_SYSCALL_64_after_hwframe+0x61/0xc6
Powered by blists - more mailing lists