netdev - Re: [PATCH net] net: do not delay dst_entries_add() in dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADvbK_eeeBtTZiOfE3Pp2GR=aKt8NP_56M1g_n8g18EQRtt5RQ@mail.gmail.com>
Date: Tue, 8 Oct 2024 17:59:07 -0400
From: Xin Long <lucien.xin@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org, eric.dumazet@...il.com, 
	Naresh Kamboju <naresh.kamboju@...aro.org>, 
	Linux Kernel Functional Testing <lkft@...aro.org>, Steffen Klassert <steffen.klassert@...unet.com>
Subject: Re: [PATCH net] net: do not delay dst_entries_add() in dst_release()

On Tue, Oct 8, 2024 at 10:31 AM Eric Dumazet <edumazet@...gle.com> wrote:
>
> dst_entries_add() uses per-cpu data that might be freed at netns
> dismantle from ip6_route_net_exit() calling dst_entries_destroy()
>
> Before ip6_route_net_exit() can be called, we release all
> the dsts associated with this netns, via calls to dst_release(),
> which waits an rcu grace period before calling dst_destroy()
>
> dst_entries_add() use in dst_destroy() is racy, because
> dst_entries_destroy() could have been called already.
>
> Decrementing the number of dsts must happen sooner.
>
> Notes:
>
> 1) in CONFIG_XFRM case, dst_destroy() can call
>    dst_release_immediate(child), this might also cause UAF
>    if the child does not have DST_NOCOUNT set.
>    IPSEC maintainers might take a look and see how to address this.
>
> 2) There is also discussion about removing this count of dst,
>    which might happen in future kernels.
>
> Fixes: f88649721268 ("ipv4: fix dst race in sk_dst_get()")
> Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnkjaL=w@mail.gmail.com/T/
> Reported-by: Naresh Kamboju <naresh.kamboju@...aro.org>
> Tested-by: Linux Kernel Functional Testing <lkft@...aro.org>
> Tested-by: Naresh Kamboju <naresh.kamboju@...aro.org>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Xin Long <lucien.xin@...il.com>
> Cc: Steffen Klassert <steffen.klassert@...unet.com>

Reviewed-by: Xin Long <lucien.xin@...il.com>