netdev - Re: [PATCH] tcp: Fix Use-After-Free in tcp_ao_connect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJwJo6aYsC9yDWLpuyPDuEObVk3sxeRgOmoJgRgwwn-7OBKH3w@mail.gmail.com>
Date: Mon, 22 Apr 2024 18:17:25 +0100
From: Dmitry Safonov <0x7f454c46@...il.com>
To: Hyunwoo Kim <v4bel@...ori.io>
Cc: edumazet@...gle.com, imv4bel@...il.com, davem@...emloft.net, 
	dsahern@...nel.org, kuba@...nel.org, pabeni@...hat.com, 
	netdev@...r.kernel.org
Subject: Re: [PATCH] tcp: Fix Use-After-Free in tcp_ao_connect_init

On Mon, 22 Apr 2024 at 10:33, Hyunwoo Kim <v4bel@...ori.io> wrote:
>
> Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal
> of tcp_ao_connect_init, is not part of the RCU read critical section, it
> is possible that the RCU grace period will pass during the traversal and
> the key will be free.
>
> To prevent this, it should be changed to hlist_for_each_entry_safe.
>
> Fixes: 7c2ffaf21bd6 ("net/tcp: Calculate TCP-AO traffic keys")
> Signed-off-by: Hyunwoo Kim <v4bel@...ori.io>

Thank you,

Acked-by: Dmitry Safonov <0x7f454c46@...il.com>


> ---
>  net/ipv4/tcp_ao.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
> index 3afeeb68e8a7..781b67a52571 100644
> --- a/net/ipv4/tcp_ao.c
> +++ b/net/ipv4/tcp_ao.c
> @@ -1068,6 +1068,7 @@ void tcp_ao_connect_init(struct sock *sk)
>  {
>         struct tcp_sock *tp = tcp_sk(sk);
>         struct tcp_ao_info *ao_info;
> +       struct hlist_node *next;
>         union tcp_ao_addr *addr;
>         struct tcp_ao_key *key;
>         int family, l3index;
> @@ -1090,7 +1091,7 @@ void tcp_ao_connect_init(struct sock *sk)
>         l3index = l3mdev_master_ifindex_by_index(sock_net(sk),
>                                                  sk->sk_bound_dev_if);
>
> -       hlist_for_each_entry_rcu(key, &ao_info->head, node) {
> +       hlist_for_each_entry_safe(key, next, &ao_info->head, node) {
>                 if (!tcp_ao_key_cmp(key, l3index, addr, key->prefixlen, family, -1, -1))
>                         continue;
>
> --
> 2.34.1
>


--
             Dmitry