netdev - Re: [Patch net v2] rtnetlink: fix double call of rtnl_link_get_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241202015112.78882-1-kuniyu@amazon.com>
Date: Mon, 2 Dec 2024 10:51:12 +0900
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <xiyou.wangcong@...il.com>
CC: <cong.wang@...edance.com>, <kuniyu@...zon.com>, <netdev@...r.kernel.org>,
	<syzbot+21ba4d5adff0b6a7cfc6@...kaller.appspotmail.com>
Subject: Re: [Patch net v2] rtnetlink: fix double call of rtnl_link_get_net_ifla()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Fri, 29 Nov 2024 13:25:19 -0800
> From: Cong Wang <cong.wang@...edance.com>
> 
> Currently rtnl_link_get_net_ifla() gets called twice when we create
> peer devices, once in rtnl_add_peer_net() and once in each ->newlink()
> implementation.
> 
> This looks safer, however, it leads to a classic Time-of-Check to
> Time-of-Use (TOCTOU) bug since IFLA_NET_NS_PID is very dynamic. And
> because of the lack of checking error pointer of the second call, it
> also leads to a kernel crash as reported by syzbot.
> 
> Fix this by getting rid of the second call, which already becomes
> redudant after Kuniyuki's work. We have to propagate the result of the
> first rtnl_link_get_net_ifla() down to each ->newlink().
> 
> Reported-by: syzbot+21ba4d5adff0b6a7cfc6@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=21ba4d5adff0b6a7cfc6
> Fixes: 0eb87b02a705 ("veth: Set VETH_INFO_PEER to veth_link_ops.peer_type.")
> Fixes: 6b84e558e95d ("vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type.")
> Fixes: fefd5d082172 ("netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type.")
> Cc: Kuniyuki Iwashima <kuniyu@...zon.com>
> Signed-off-by: Cong Wang <cong.wang@...edance.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Thanks for the fix and nice cleanup :)