Lin Ma 67677050ce nfc: nci: add flush_workqueue to prevent uaf ... [ Upstream commit ef27324e2c ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-20 09:23:18 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 12:11:54 +01:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:19:08 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm
ax25	ax25: Fix NULL pointer dereference in ax25_kill_by_device	2022-03-16 14:15:58 +01:00
batman-adv	ipv6: make mc_forwarding atomic	2022-04-13 21:00:56 +02:00
bluetooth	Bluetooth: Fix use after free in hci_send_acl	2022-04-13 21:01:00 +02:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-10-27 09:56:56 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:56:29 +02:00
bridge	net: bridge: vlan: fix memory leak in __allowed_ingress	2022-02-01 17:25:48 +01:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: isotp: set default value for N_As to 50 micro seconds	2022-04-13 21:01:00 +02:00
ceph
core	net/sched: flower: fix parsing of ethertype following VLAN header	2022-04-20 09:23:11 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:09:37 +01:00
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 14:04:08 +01:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver
dsa	net: dsa: Add missing of_node_put() in dsa_port_parse_of	2022-03-23 09:13:28 +01:00
ethernet
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-17 10:14:41 +01:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:30:37 +01:00
ife
ipv4	net: ipv4: fix route with nexthop object delete warning	2022-04-13 21:01:04 +02:00
ipv6	ipv6: Fix stats accounting in ip6_pkt_drop	2022-04-13 21:01:05 +02:00
iucv
kcm
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-04-08 14:39:48 +02:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:27:56 +02:00
l3mdev
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 09:57:10 +02:00
mac80211	mac80211: fix potential double free on mesh join	2022-03-28 09:57:10 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:03:23 +01:00
mptcp	mptcp: clear 'kern' flag from fallback sockets	2021-12-22 09:30:54 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:40:32 +01:00
netfilter	netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options	2022-04-08 14:40:28 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-13 21:01:00 +02:00
netlink	af_netlink: Fix shift out of bounds in group mask calculation	2022-04-08 14:40:22 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 10:54:03 +01:00
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-20 09:23:18 +02:00
nsh
openvswitch	net: openvswitch: fix leak of nested actions	2022-04-13 21:01:06 +02:00
packet	net/packet: fix slab-out-of-bounds access in packet_recvmsg()	2022-03-23 09:13:27 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:25:01 +01:00
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:30:54 +01:00
rfkill
rose
rxrpc	rxrpc: fix a race in rxrpc_exit_net()	2022-04-13 21:01:06 +02:00
sched	net/sched: taprio: Check if socket flags are valid	2022-04-20 09:23:13 +02:00
sctp	sctp: Initialize daddr on peeled off socket	2022-04-20 09:23:17 +02:00
smc	net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()	2022-04-20 09:23:14 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
sunrpc	SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()	2022-04-13 21:01:07 +02:00
switchdev
tipc	tipc: fix the timer expires after interval 100ms	2022-04-08 14:40:23 +02:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-13 21:01:04 +02:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 10:54:31 +01:00
vmw_vsock	vsock: each transport cycles only on its own sockets	2022-03-23 09:13:27 +01:00
wimax
wireless	cfg80211: hold bss_lock while updating nontrans_list	2022-04-20 09:23:13 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:40:30 +02:00
xdp	Revert "xsk: Do not sleep in poll() when need_wakeup set"	2021-12-22 09:30:59 +01:00
xfrm	xfrm: fix tunnel model fragmentation behavior	2022-04-08 14:39:47 +02:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c