mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 21:03:32 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Zhengchao Shao 6b6f5c6671 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet 
[ Upstream commit e2b706c691 ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-12-08 08:43:25 +01:00
..
6lowpan
9p 9p: virtio: make sure 'offs' is initialized in zc_request 2023-09-23 10:47:57 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 11:30:36 +01:00
8021q vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() 2023-05-30 12:42:11 +01:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 12:48:49 +02:00
atm atm: hide unused procfs functions 2023-06-09 10:24:01 +02:00
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-27 13:39:46 +02:00
batman-adv batman-adv: Fix batadv_v_ogm_aggr_send memory leak 2023-08-30 16:31:55 +02:00
bluetooth Bluetooth: Fix double free in hci_conn_cleanup 2023-11-28 16:46:31 +00:00
bpf bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() 2022-11-25 17:40:29 +01:00
bpfilter
bridge net: bridge: use DEV_STATS_INC() 2023-10-10 21:44:57 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:31:44 +01:00
can can: bcm: Fix UAF in bcm_proc_show() 2023-08-11 11:45:24 +02:00
ceph libceph: use kernel_connect() 2023-10-25 11:16:51 +02:00
core net: annotate data-races around sk->sk_dst_pending_confirm 2023-11-28 16:46:31 +00:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:04:10 +01:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 10:29:21 +01:00
decnet Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
dns_resolver
dsa net: dsa: Add missing of_node_put() in dsa_port_parse_of 2022-03-23 09:10:44 +01:00
ethernet
hsr net: hsr: Fix potential use-after-free 2022-12-08 11:18:33 +01:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:52:30 +09:00
ife
ipv4 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet 2023-12-08 08:43:25 +01:00
ipv6 dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 10:29:21 +01:00
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:27:10 +01:00
kcm kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). 2023-09-23 10:48:15 +02:00
key net: af_key: fix sadb_x_filter validation 2023-08-30 16:31:48 +02:00
l2tp ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() 2023-10-10 21:45:01 +02:00
l3mdev
lapb
llc llc: verify mac len before reading mac header 2023-11-20 10:29:21 +01:00
mac80211 wifi: mac80211: don't return unset power in ieee80211_get_tx_power() 2023-11-28 16:46:31 +00:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:28:28 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:47:21 +01:00
ncsi net/ncsi: Avoid channel_monitor hrtimer deadlock 2021-04-14 08:22:35 +02:00
netfilter netfilter: xt_recent: fix (increase) ipv6 literal buffer length 2023-11-20 10:29:21 +01:00
netlabel netlabel: fix shift wrapping bug in netlbl_catmap_setlong() 2023-09-23 10:47:58 +02:00
netlink netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-08-11 11:45:07 +02:00
netrom netrom: Deny concurrent connect(). 2023-09-23 10:48:01 +02:00
nfc nfc: nci: fix possible NULL pointer dereference in send_acknowledge() 2023-10-25 11:16:42 +02:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-30 12:42:11 +01:00
openvswitch net: openvswitch: fix flow memory leak in ovs_flow_cmd_new 2023-02-22 12:47:12 +01:00
packet net/packet: annotate data-races around tp->status 2023-08-16 18:13:00 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 13:58:50 +01:00
psample
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 09:58:00 +02:00
rds net: prevent address rewrite in kernel_bind() 2023-10-25 11:16:21 +02:00
rfkill net: rfkill: gpio: prevent value glitch during probe 2023-10-25 11:16:45 +02:00
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:47:19 +01:00
rxrpc rxrpc: Fix hard call timeout units 2023-05-17 11:13:24 +02:00
sched net: sched: fix race condition in qdisc_graft() 2023-11-28 16:46:36 +00:00
sctp sctp: update hb timer immediately after users change hb_interval 2023-10-10 21:45:01 +02:00
smc net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT 2023-11-20 10:29:21 +01:00
strparser
sunrpc SUNRPC: Fix UAF in svc_tcp_listen_data_ready() 2023-08-11 11:45:20 +02:00
switchdev
tipc tipc: Fix kernel-infoleak due to uninitialized TLV value 2023-11-28 16:46:33 +00:00
tls net/tls: Fix race in TLS device down flow 2022-07-29 17:10:32 +02:00
unix af_unix: Fix data-race around unix_tot_inflight. 2023-09-23 10:48:13 +02:00
vmw_vsock vsock: avoid to close connected socket after the timeout 2023-05-30 12:42:10 +01:00
wimax
wireless wifi: cfg80211: avoid leaking stack data into trace 2023-10-25 11:16:57 +02:00
x25 net/x25: Fix to not accept on connected socket 2023-02-22 12:47:12 +01:00
xdp xsk: Simplify detection of empty and full rings 2021-05-22 10:59:48 +02:00
xfrm xfrm: interface: use DEV_STATS_INC() 2023-10-25 11:16:44 +02:00
compat.c net: Return the correct errno code 2021-06-30 08:48:13 -04:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
socket.c net: prevent address rewrite in kernel_bind() 2023-10-25 11:16:21 +02:00
sysctl_net.c