netdev - Re: [PATCH ipsec] xfrm: state: fix out-of-bounds read during lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z1LXVmY/cya/wZXS@gauss3.secunet.de>
Date: Fri, 6 Dec 2024 11:52:06 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Florian Westphal <fw@...len.de>
CC: <netdev@...r.kernel.org>, <herbert@...dor.apana.org.au>,
	<dvyukov@...gle.com>, <syzbot+5f9f31cb7d985f584d8e@...kaller.appspotmail.com>
Subject: Re: [PATCH ipsec] xfrm: state: fix out-of-bounds read during lookup

On Thu, Nov 28, 2024 at 03:26:25PM +0100, Florian Westphal wrote:
> lookup and resize can run in parallel.
> 
> The xfrm_state_hash_generation seqlock ensures a retry, but the hash
> functions can observe a hmask value that is too large for the new hlist
> array.
> 
> rehash does:
>   rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..]
>   net->xfrm.state_hmask = nhashmask;
> 
> While state lookup does:
>   h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
>   hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {
> 
> This is only safe in case the update to state_bydst is larger than
> net->xfrm.xfrm_state_hmask (or if the lookup function gets
> serialized via state spinlock again).
> 
> Fix this by prefetching state_hmask and the associated pointers.
> The xfrm_state_hash_generation seqlock retry will ensure that the pointer
> and the hmask will be consistent.
> 
> The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side,
> add lockdep assertions to document that they are only safe for insert
> side.
> 
> xfrm_state_lookup_byaddr() uses the spinlock rather than RCU.
> AFAICS this is an oversight from back when state lookup was converted to
> RCU, this lock should be replaced with RCU in a future patch.
> 
> Reported-by: syzbot+5f9f31cb7d985f584d8e@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/CACT4Y+azwfrE3uz6A5ZErov5YN2LYBN5KrsymBerT36VU8qzBA@mail.gmail.com/
> Diagnosed-by: Dmitry Vyukov <dvyukov@...gle.com>
> Fixes: c2f672fc9464 ("xfrm: state lookup can be lockless")
> Signed-off-by: Florian Westphal <fw@...len.de>

Applied, thanks a lot Florian!