From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Baozeng Ding <sploving1@gmail.com>,
Andrey Konovalov <andreyknvl@google.com>,
Guillaume Nault <g.nault@alphalink.fr>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.8 09/45] l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
Date: Fri, 9 Dec 2016 17:20:38 +0100 [thread overview]
Message-ID: <20161209161755.294433296@linuxfoundation.org> (raw)
In-Reply-To: <20161209161754.912203877@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
[ Upstream commit 32c231164b762dddefa13af5a0101032c70b50ef ]
Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind().
Without lock, a concurrent call could modify the socket flags between
the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way,
a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it
would then leave a stale pointer there, generating use-after-free
errors when walking through the list or modifying adjacent entries.
BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8
Write of size 8 by task syz-executor/10987
CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0
ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc
ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0
Call Trace:
[<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15
[<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
[< inline >] print_address_description mm/kasan/report.c:194
[<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283
[< inline >] kasan_report mm/kasan/report.c:303
[<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329
[< inline >] __write_once_size ./include/linux/compiler.h:249
[< inline >] __hlist_del ./include/linux/list.h:622
[< inline >] hlist_del_init ./include/linux/list.h:637
[<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239
[<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415
[<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422
[<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570
[<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017
[<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208
[<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244
[<ffffffff813774f9>] task_work_run+0xf9/0x170
[<ffffffff81324aae>] do_exit+0x85e/0x2a00
[<ffffffff81326dc8>] do_group_exit+0x108/0x330
[<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307
[<ffffffff811b49af>] do_signal+0x7f/0x18f0
[<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259
[<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6
Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448
Allocated:
PID = 10987
[ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20
[ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0
[ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0
[ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20
[ 1116.897025] [< inline >] slab_post_alloc_hook mm/slab.h:417
[ 1116.897025] [< inline >] slab_alloc_node mm/slub.c:2708
[ 1116.897025] [< inline >] slab_alloc mm/slub.c:2716
[ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721
[ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326
[ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388
[ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182
[ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153
[ 1116.897025] [< inline >] sock_create net/socket.c:1193
[ 1116.897025] [< inline >] SYSC_socket net/socket.c:1223
[ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203
[ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 10987
[ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20
[ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0
[ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0
[ 1116.897025] [< inline >] slab_free_hook mm/slub.c:1352
[ 1116.897025] [< inline >] slab_free_freelist_hook mm/slub.c:1374
[ 1116.897025] [< inline >] slab_free mm/slub.c:2951
[ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973
[ 1116.897025] [< inline >] sk_prot_free net/core/sock.c:1369
[ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444
[ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452
[ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460
[ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471
[ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589
[ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243
[ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415
[ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422
[ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570
[ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017
[ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208
[ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244
[ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170
[ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00
[ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330
[ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307
[ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0
[ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156
[ 1116.897025] [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259
[ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6
Memory state around the buggy address:
ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table.
Fixes: c51ce49735c1 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ip.c | 5 +++--
net/l2tp/l2tp_ip6.c | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -251,8 +251,6 @@ static int l2tp_ip_bind(struct sock *sk,
int ret;
int chk_addr_ret;
- if (!sock_flag(sk, SOCK_ZAPPED))
- return -EINVAL;
if (addr_len < sizeof(struct sockaddr_l2tpip))
return -EINVAL;
if (addr->l2tp_family != AF_INET)
@@ -267,6 +265,9 @@ static int l2tp_ip_bind(struct sock *sk,
read_unlock_bh(&l2tp_ip_lock);
lock_sock(sk);
+ if (!sock_flag(sk, SOCK_ZAPPED))
+ goto out;
+
if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip))
goto out;
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -269,8 +269,6 @@ static int l2tp_ip6_bind(struct sock *sk
int addr_type;
int err;
- if (!sock_flag(sk, SOCK_ZAPPED))
- return -EINVAL;
if (addr->l2tp_family != AF_INET6)
return -EINVAL;
if (addr_len < sizeof(*addr))
@@ -296,6 +294,9 @@ static int l2tp_ip6_bind(struct sock *sk
lock_sock(sk);
err = -EINVAL;
+ if (!sock_flag(sk, SOCK_ZAPPED))
+ goto out_unlock;
+
if (sk->sk_state != TCP_CLOSE)
goto out_unlock;
next prev parent reply other threads:[~2016-12-09 16:23 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161209162112epcas5p48e365650e03ecaae64d811516a0f837d@epcas5p4.samsung.com>
2016-12-09 16:20 ` [PATCH 4.8 00/45] 4.8.14-stable review Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 01/45] gro_cells: mark napi struct as not busy poll candidates Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 02/45] virtio-net: add a missing synchronize_net() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 03/45] net: dsa: b53: Fix VLAN usage and how we treat CPU port Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 04/45] net: check dead netns for peernet2id_alloc() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 05/45] ip6_tunnel: disable caching when the traffic class is inherited Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 06/45] net: sky2: Fix shutdown crash Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 07/45] af_unix: conditionally use freezable blocking calls in read Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 08/45] rtnetlink: fix FDB size computation Greg Kroah-Hartman
2016-12-09 16:20 ` Greg Kroah-Hartman [this message]
2016-12-09 16:20 ` [PATCH 4.8 10/45] rtnl: fix the loop index update error in rtnl_dump_ifinfo() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 11/45] ipv6: bump genid when the IFA_F_TENTATIVE flag is clear Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 12/45] udplite: call proper backlog handlers Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 13/45] net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 14/45] net, sched: respect rcu grace period on cls destruction Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 15/45] net: dsa: fix unbalanced dsa_switch_tree reference counting Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 16/45] net/sched: pedit: make sure that offset is valid Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 17/45] netlink: Call cb->done from a worker thread Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 18/45] netlink: Do not schedule work from sk_destruct Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 19/45] net: macb: fix the RX queue reset in macb_rx() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 20/45] net/dccp: fix use-after-free in dccp_invalid_packet Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 21/45] GSO: Reload iph after pskb_may_pull Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 22/45] packet: fix race condition in packet_set_ring Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 23/45] ip6_offload: check segs for NULL in ipv6_gso_segment Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 25/45] net: bcmgenet: Utilize correct struct device for all DMA operations Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 26/45] sh_eth: remove unchecked interrupts for RZ/A1 Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 28/45] geneve: avoid use-after-free of skb->data Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 29/45] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 30/45] net: ping: check minimum size on ICMP header length Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 31/45] ipv4: Restore fib_trie_flush_external function and fix call ordering Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 32/45] ipv4: Fix memory leak in exception case for splitting tries Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 33/45] ipv4: Drop leaf from suffix pull/push functions Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 34/45] ipv4: Drop suffix update from resize code Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 35/45] sparc64: Fix find_node warning if numa node cannot be found Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 36/45] sparc64: fix compile warning section mismatch in find_node() Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 37/45] sparc32: Fix inverted invalid_frame_pointer checks on sigreturns Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 38/45] Dont feed anything but regular iovecs to blk_rq_map_user_iov Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 39/45] constify iov_iter_count() and iter_is_iovec() Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 40/45] ipv6: Set skb->protocol properly for local output Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 41/45] ipv4: " Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 42/45] Revert: "ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit()" Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 44/45] esp4: Fix integrity verification when ESN are used Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 45/45] esp6: " Greg Kroah-Hartman
2016-12-09 18:24 ` [PATCH 4.8 00/45] 4.8.14-stable review Shuah Khan
2016-12-10 12:17 ` Greg Kroah-Hartman
2016-12-09 22:36 ` Guenter Roeck
2016-12-10 12:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161209161755.294433296@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=g.nault@alphalink.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=sploving1@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.