netdev - Re: [PATCH v1 net] tcp: Fix use-after-free of nreq in reqsk_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89iLjWdhr35M9VRbuznO63Ue-jqWcC28DGC9pFoTPkqepbg@mail.gmail.com>
Date: Mon, 25 Nov 2024 10:14:04 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: "liujian (CE)" <liujian56@...wei.com>
Cc: Kuniyuki Iwashima <kuniyu@...zon.com>, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org
Subject: Re: [PATCH v1 net] tcp: Fix use-after-free of nreq in reqsk_timer_handler().

On Mon, Nov 25, 2024 at 2:19 AM liujian (CE) <liujian56@...wei.com> wrote:
>
>
>
> 在 2024/11/24 1:42, Kuniyuki Iwashima 写道:
> > The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with
> > __inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler().
> >
> > Then, oreq should be passed to reqsk_put() instead of req; otherwise
> > use-after-free of nreq could happen when reqsk is migrated but the
> > retry attempt failed (e.g. due to timeout).
> >
> > Let's pass oreq to reqsk_put().
> >
> > Fixes: e8c526f2bdf1 ("tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().")
> > Reported-by: Liu Jian <liujian56@...wei.com>
> > Closes: https://lore.kernel.org/netdev/1284490f-9525-42ee-b7b8-ccadf6606f6d@huawei.com/
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> > ---
> >   net/ipv4/inet_connection_sock.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> > index 491c2c6b683e..6872b5aff73e 100644
> > --- a/net/ipv4/inet_connection_sock.c
> > +++ b/net/ipv4/inet_connection_sock.c
> > @@ -1191,7 +1191,7 @@ static void reqsk_timer_handler(struct timer_list *t)
> >
> >   drop:
> >       __inet_csk_reqsk_queue_drop(sk_listener, oreq, true);
> > -     reqsk_put(req);
> > +     reqsk_put(oreq);
> >   }
> Reviewed-by: Liu Jian <liujian56@...wei.com>
> >
> >   static bool reqsk_queue_hash_req(struct request_sock *req,

Reviewed-by: Eric Dumazet <edumazet@...gle.com>

Thanks.