mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net
History
YueHaibing 72634d7fd9 ipvs: Fix use-after-free in ip_vs_in 
[ Upstream commit 719c7d563c ]

BUG: KASAN: use-after-free in ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
Read of size 4 at addr ffff8881e9b26e2c by task sshd/5603

CPU: 0 PID: 5603 Comm: sshd Not tainted 4.19.39+ #30
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
Call Trace:
 dump_stack+0x71/0xab
 print_address_description+0x6a/0x270
 kasan_report+0x179/0x2c0
 ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
 ip_vs_in+0xd8/0x170 [ip_vs]
 nf_hook_slow+0x5f/0xe0
 __ip_local_out+0x1d5/0x250
 ip_local_out+0x19/0x60
 __tcp_transmit_skb+0xba1/0x14f0
 tcp_write_xmit+0x41f/0x1ed0
 ? _copy_from_iter_full+0xca/0x340
 __tcp_push_pending_frames+0x52/0x140
 tcp_sendmsg_locked+0x787/0x1600
 ? tcp_sendpage+0x60/0x60
 ? inet_sk_set_state+0xb0/0xb0
 tcp_sendmsg+0x27/0x40
 sock_sendmsg+0x6d/0x80
 sock_write_iter+0x121/0x1c0
 ? sock_sendmsg+0x80/0x80
 __vfs_write+0x23e/0x370
 vfs_write+0xe7/0x230
 ksys_write+0xa1/0x120
 ? __ia32_sys_read+0x50/0x50
 ? __audit_syscall_exit+0x3ce/0x450
 do_syscall_64+0x73/0x200
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff6f6147c60
Code: 73 01 c3 48 8b 0d 28 12 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 5d 73 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83
RSP: 002b:00007ffd772ead18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007ff6f6147c60
RDX: 0000000000000034 RSI: 000055df30a31270 RDI: 0000000000000003
RBP: 000055df30a31270 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffd772ead70 R11: 0000000000000246 R12: 00007ffd772ead74
R13: 00007ffd772eae20 R14: 00007ffd772eae24 R15: 000055df2f12ddc0

Allocated by task 6052:
 kasan_kmalloc+0xa0/0xd0
 __kmalloc+0x10a/0x220
 ops_init+0x97/0x190
 register_pernet_operations+0x1ac/0x360
 register_pernet_subsys+0x24/0x40
 0xffffffffc0ea016d
 do_one_initcall+0x8b/0x253
 do_init_module+0xe3/0x335
 load_module+0x2fc0/0x3890
 __do_sys_finit_module+0x192/0x1c0
 do_syscall_64+0x73/0x200
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 6067:
 __kasan_slab_free+0x130/0x180
 kfree+0x90/0x1a0
 ops_free_list.part.7+0xa6/0xc0
 unregister_pernet_operations+0x18b/0x1f0
 unregister_pernet_subsys+0x1d/0x30
 ip_vs_cleanup+0x1d/0xd2f [ip_vs]
 __x64_sys_delete_module+0x20c/0x300
 do_syscall_64+0x73/0x200
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff8881e9b26600 which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 2092 bytes inside of 4096-byte region [ffff8881e9b26600, ffff8881e9b27600)
The buggy address belongs to the page:
page:ffffea0007a6c800 count:1 mapcount:0 mapping:ffff888107c0e600 index:0x0 compound_mapcount: 0
flags: 0x17ffffc0008100(slab|head)
raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888107c0e600
raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

while unregistering ipvs module, ops_free_list calls
__ip_vs_cleanup, then nf_unregister_net_hooks be called to
do remove nf hook entries. It need a RCU period to finish,
however net->ipvs is set to NULL immediately, which will
trigger NULL pointer dereference when a packet is hooked
and handled by ip_vs_in where net->ipvs is dereferenced.

Another scene is ops_free_list call ops_free to free the
net_generic directly while __ip_vs_cleanup finished, then
calling ip_vs_in will triggers use-after-free.

This patch moves nf_unregister_net_hooks from __ip_vs_cleanup()
to __ip_vs_dev_cleanup(),  where rcu_barrier() is called by
unregister_pernet_device -> unregister_pernet_operations,
that will do the needed grace period.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: efe4160618 ("ipvs: convert to use pernet nf_hook api")
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2019-06-22 08:16:15 +02:00
..
6lowpan 6lowpan: iphc: reset mac_header after decompress to fix panic 2018-10-03 17:00:47 -07:00
9p 9p: do not trust pdu content for stat item size 2019-04-20 09:15:04 +02:00
802 License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
8021q vlan: disable SIOCSHWTSTAMP in container 2019-05-16 19:42:34 +02:00
appletalk appletalk: Fix use-after-free in atalk_proc_exit 2019-04-20 09:15:07 +02:00
atm net: atm: Fix potential Spectre v1 vulnerabilities 2019-04-27 09:35:33 +02:00
ax25 ax25: fix inconsistent lock state in ax25_destroy_timer 2019-06-22 08:16:14 +02:00
batman-adv batman-adv: allow updating DAT entry timeouts on incoming ARP Replies 2019-05-31 06:47:33 -07:00
bluetooth Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections" 2019-06-15 11:54:59 +02:00
bpf
…
bridge bridge: Fix error path for kobject_init_and_add() 2019-05-16 19:42:33 +02:00
caif caif: reduce stack size with KASAN 2019-05-08 07:20:45 +02:00
can can: bcm: check timer values before ktime conversion 2019-01-31 08:13:46 +01:00
ceph libceph: wait for latest osdmap in ceph_monc_blacklist_add() 2019-03-27 14:13:51 +09:00
core neigh: fix use-after-free read in pneigh_get_next 2019-06-22 08:16:14 +02:00
dcb net: dcb: For wild-card lookups, use priority -1, not 0 2018-09-19 22:43:43 +02:00
dccp dccp: do not use ipv6 header for ipv4 flow 2019-04-03 06:25:08 +02:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-25 11:07:52 +01:00
dns_resolver KEYS: DNS: fix parsing multiple options 2018-07-22 14:28:49 +02:00
dsa net: dsa: Fix error cleanup path in dsa_init_module 2019-05-16 19:42:34 +02:00
ethernet
…
hsr net/hsr: fix possible crash in add_timer() 2019-03-19 13:13:22 +01:00
ieee802154 ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module 2019-04-27 09:35:40 +02:00
ife net: sched: ife: check on metadata length 2018-04-29 11:33:13 +02:00
ipv4 tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() 2019-06-17 19:52:45 +02:00
ipv6 ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero 2019-06-22 08:16:14 +02:00
ipx License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
iucv net/iucv: Free memory obtained by kzalloc 2018-03-31 18:10:41 +02:00
kcm kcm: switch order of device registration to fix a crash 2019-04-17 08:37:45 +02:00
key af_key: unconditionally clone on broadcast 2019-03-23 14:35:14 +01:00
l2tp l2tp: fix infoleak in l2tp_ip6_recvmsg() 2019-03-19 13:13:22 +01:00
l3mdev
…
lapb lapb: fixed leak of control-blocks. 2019-06-22 08:16:14 +02:00
llc llc: fix skb leak in llc_build_and_send_ui_pkt() 2019-06-09 09:18:10 +02:00
mac80211 mac80211/cfg80211: update bss channel on channel switch 2019-05-31 06:47:22 -07:00
mac802154 net: mac802154: tx: expand tailroom if necessary 2018-09-09 19:55:52 +02:00
mpls mpls: Return error for RTA_GATEWAY attribute 2019-03-13 14:03:09 -07:00
ncsi
…
netfilter ipvs: Fix use-after-free in ip_vs_in 2019-06-22 08:16:15 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2019-03-13 14:03:08 -07:00
netlink genetlink: Fix a memory leak on error path 2019-04-03 06:25:08 +02:00
netrom netrom: switch to sock timer API 2019-02-06 17:31:32 +01:00
nfc NFC: nci: Add some bounds checking in nci_hci_cmd_received() 2019-05-16 19:42:32 +02:00
nsh nsh: set mac len based on inner packet 2018-07-22 14:28:49 +02:00
openvswitch net: openvswitch: do not free vport if register_netdevice() is failed. 2019-06-22 08:16:15 +02:00
packet packet: Fix error path in packet_init 2019-05-16 19:42:34 +02:00
phonet phonet: fix building with clang 2019-03-23 14:35:16 +01:00
psample
…
qrtr net: qrtr: Broadcast messages only from control port 2018-08-24 13:09:13 +02:00
rds net: rds: fix memory leak in rds_ib_flush_mr_pool 2019-06-11 12:21:45 +02:00
rfkill rfkill: gpio: fix memory leak in probe error path 2018-05-16 10:10:26 +02:00
rose net/rose: fix unbound loop in rose_loopback_timer() 2019-05-02 09:40:34 +02:00
rxrpc rxrpc: Fix net namespace cleanup 2019-05-08 07:20:44 +02:00
sched net_sched: fix two more memory leaks in cls_tcindex 2019-05-16 19:42:30 +02:00
sctp sctp: Free cookie before we memdup a new one 2019-06-22 08:16:15 +02:00
smc net/smc: fix TCP fallback socket release 2019-01-09 17:14:46 +01:00
strparser strparser: Remove early eaten to fix full tcp receive buffer stall 2018-07-22 14:28:47 +02:00
sunrpc sunrpc: don't mark uninitialised items as VALID. 2019-05-02 09:40:29 +02:00
switchdev
…
tipc tipc: fix modprobe tipc failed after switch order of device registration 2019-06-09 09:18:12 +02:00
tls net/tls: Fixed return value when tls_complete_pending_work() fails 2018-12-05 19:41:11 +01:00
unix missing barriers in some of unix_sock ->addr and ->path accesses 2019-03-19 13:13:24 +01:00
vmw_vsock vsock/virtio: Initialize core virtio vsock before registering the driver 2019-05-25 18:25:17 +02:00
wimax License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
wireless mac80211/cfg80211: update bss channel on channel switch 2019-05-31 06:47:22 -07:00
x25 net/x25: fix a race in x25_bind() 2019-03-19 13:13:23 +01:00
xfrm xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink 2019-05-25 18:25:33 +02:00
Kconfig
…
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
compat.c sock: Make sock->sk_stamp thread-safe 2019-01-09 17:14:46 +01:00
socket.c net: socket: set sock->sk to NULL after calling proto_ops::release() 2019-03-13 14:03:09 -07:00
sysctl_net.c
…