netdev - Re: [PATCH v1 net] tipc: Fix use-after-free of kernel socket in cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241127034811.19682-1-kuniyu@amazon.com>
Date: Wed, 27 Nov 2024 12:48:11 +0900
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <ebiederm@...ssion.com>, <jmaloy@...hat.com>,
	<kuba@...nel.org>, <kuni1840@...il.com>, <kuniyu@...zon.com>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>, <syzkaller@...glegroups.com>,
	<tipc-discussion@...ts.sourceforge.net>, <ying.xue@...driver.com>
Subject: Re: [PATCH v1 net] tipc: Fix use-after-free of kernel socket in cleanup_bearer().

From: Eric Dumazet <edumazet@...gle.com>
Date: Tue, 26 Nov 2024 11:53:07 +0100
> I think 'kernel sockets' were not refcounted to allow the netns to be removed.
> 
> Otherwise, what would tipc_bearer_stop() be needed ?
> 
> tipc_exit_net(struct net *net)  // can only be called when all refcnt
> have been released
>  -> tipc_net_stop()
>   -> tipc_bearer_stop()
>     -> bearer_disable()
>      -> tipc_udp_disable()
>        -> INIT_WORK(&ub->work, cleanup_bearer); schedule_work(&ub->work);

I noticed tipc_net_stop() waits for all works to be completed by
checking tipc_net(net)->wq_count, but it was decremented a bit
early in the work, so I'll post the following as v2:

---8<---
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 10986b283ac8..ef3d8f71bde5 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -821,9 +821,9 @@ static void cleanup_bearer(struct work_struct *work)
 		kfree_rcu(rcast, rcu);
 	}
 
-	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
 	dst_cache_destroy(&ub->rcast.dst_cache);
 	udp_tunnel_sock_release(ub->ubsock);
 	synchronize_net();
+	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
 	kfree(ub);
 }
---8<---