From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 03/62] ipv6/flowlabel: wait rcu grace period before put_pid()
Date: Mon, 6 May 2019 16:32:34 +0200 [thread overview]
Message-ID: <20190506143051.397032869@linuxfoundation.org> (raw)
In-Reply-To: <20190506143051.102535767@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6c0afef5fb0c27758f4d52b2210c61b6bd8b4470 ]
syzbot was able to catch a use-after-free read in pid_nr_ns() [1]
ip6fl_seq_show() seems to use RCU protection, dereferencing fl->owner.pid
but fl_free() releases fl->owner.pid before rcu grace period is started.
[1]
BUG: KASAN: use-after-free in pid_nr_ns+0x128/0x140 kernel/pid.c:407
Read of size 4 at addr ffff888094012a04 by task syz-executor.0/18087
CPU: 0 PID: 18087 Comm: syz-executor.0 Not tainted 5.1.0-rc6+ #89
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
__asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
pid_nr_ns+0x128/0x140 kernel/pid.c:407
ip6fl_seq_show+0x2f8/0x4f0 net/ipv6/ip6_flowlabel.c:794
seq_read+0xad3/0x1130 fs/seq_file.c:268
proc_reg_read+0x1fe/0x2c0 fs/proc/inode.c:227
do_loop_readv_writev fs/read_write.c:701 [inline]
do_loop_readv_writev fs/read_write.c:688 [inline]
do_iter_read+0x4a9/0x660 fs/read_write.c:922
vfs_readv+0xf0/0x160 fs/read_write.c:984
kernel_readv fs/splice.c:358 [inline]
default_file_splice_read+0x475/0x890 fs/splice.c:413
do_splice_to+0x12a/0x190 fs/splice.c:876
splice_direct_to_actor+0x2d2/0x970 fs/splice.c:953
do_splice_direct+0x1da/0x2a0 fs/splice.c:1062
do_sendfile+0x597/0xd00 fs/read_write.c:1443
__do_sys_sendfile64 fs/read_write.c:1498 [inline]
__se_sys_sendfile64 fs/read_write.c:1490 [inline]
__x64_sys_sendfile64+0x15a/0x220 fs/read_write.c:1490
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f300d24bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458da9
RDX: 00000000200000c0 RSI: 0000000000000008 RDI: 0000000000000007
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000005a R11: 0000000000000246 R12: 00007f300d24c6d4
R13: 00000000004c5fa3 R14: 00000000004da748 R15: 00000000ffffffff
Allocated by task 17543:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_kmalloc mm/kasan/common.c:497 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:505
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc mm/slab.c:3393 [inline]
kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3555
alloc_pid+0x55/0x8f0 kernel/pid.c:168
copy_process.part.0+0x3b08/0x7980 kernel/fork.c:1932
copy_process kernel/fork.c:1709 [inline]
_do_fork+0x257/0xfd0 kernel/fork.c:2226
__do_sys_clone kernel/fork.c:2333 [inline]
__se_sys_clone kernel/fork.c:2327 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2327
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 7789:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:459
kasan_slab_free+0xe/0x10 mm/kasan/common.c:467
__cache_free mm/slab.c:3499 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
put_pid.part.0+0x111/0x150 kernel/pid.c:111
put_pid+0x20/0x30 kernel/pid.c:105
fl_free+0xbe/0xe0 net/ipv6/ip6_flowlabel.c:102
ip6_fl_gc+0x295/0x3e0 net/ipv6/ip6_flowlabel.c:152
call_timer_fn+0x190/0x720 kernel/time/timer.c:1325
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694
__do_softirq+0x266/0x95a kernel/softirq.c:293
The buggy address belongs to the object at ffff888094012a00
which belongs to the cache pid_2 of size 88
The buggy address is located 4 bytes inside of
88-byte region [ffff888094012a00, ffff888094012a58)
The buggy address belongs to the page:
page:ffffea0002500480 count:1 mapcount:0 mapping:ffff88809a483080 index:0xffff888094012980
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00018a3508 ffffea0002524a88 ffff88809a483080
raw: ffff888094012980 ffff888094012000 000000010000001b 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888094012900: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff888094012980: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
>ffff888094012a00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
^
ffff888094012a80: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff888094012b00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
Fixes: 4f82f45730c6 ("net ip6 flowlabel: Make owner a union of struct pid * and kuid_t")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_flowlabel.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(s
return fl;
}
+static void fl_free_rcu(struct rcu_head *head)
+{
+ struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu);
+
+ if (fl->share == IPV6_FL_S_PROCESS)
+ put_pid(fl->owner.pid);
+ kfree(fl->opt);
+ kfree(fl);
+}
+
static void fl_free(struct ip6_flowlabel *fl)
{
- if (fl) {
- if (fl->share == IPV6_FL_S_PROCESS)
- put_pid(fl->owner.pid);
- kfree(fl->opt);
- kfree_rcu(fl, rcu);
- }
+ if (fl)
+ call_rcu(&fl->rcu, fl_free_rcu);
}
static void fl_release(struct ip6_flowlabel *fl)
next prev parent reply other threads:[~2019-05-06 14:48 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-06 14:32 [PATCH 4.9 00/62] 4.9.174-stable review Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 01/62] ALSA: line6: use dynamic buffers Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 02/62] ipv4: ip_do_fragment: Preserve skb_iif during fragmentation Greg Kroah-Hartman
2019-05-06 14:32 ` Greg Kroah-Hartman [this message]
2019-05-06 14:32 ` [PATCH 4.9 04/62] ipv6: invert flowlabel sharing check in process and user mode Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 05/62] packet: validate msg_namelen in send directly Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 06/62] bnxt_en: Improve multicast address setup logic Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 07/62] net: phy: marvell: Fix buffer overrun with stats counters Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 08/62] x86/suspend: fix false positive KASAN warning on suspend/resume Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 09/62] kasan: turn on -fsanitize-address-use-after-scope Greg Kroah-Hartman
2019-05-06 14:55 ` Andrey Ryabinin
2019-05-06 15:10 ` Greg Kroah-Hartman
2019-05-06 15:36 ` Andrey Ryabinin
2019-05-06 15:42 ` Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 10/62] kasan: rework Kconfig settings Greg Kroah-Hartman
2019-05-06 14:58 ` Andrey Ryabinin
2019-05-06 15:42 ` Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 11/62] mm/kasan: Switch to using __pa_symbol and lm_alias Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 12/62] x86/unwind: Disable KASAN checks for non-current tasks Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 13/62] arm64: kasan: avoid bad virt_to_pfn() Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 14/62] kasan: add a prototype of task_struct to avoid warning Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 15/62] kasan: avoid -Wmaybe-uninitialized warning Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 16/62] kasan: remove redundant initialization of variable real_size Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 17/62] arm64: proc: Set PTE_NG for table entries to avoid traversing them twice Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 18/62] kasan: prevent compiler from optimizing away memset in tests Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 19/62] arm64: mm: print out correct page table entries Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 20/62] arm64: mm: dont print out page table entries on EL0 faults Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 21/62] caif: reduce stack size with KASAN Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 22/62] USB: yurex: Fix protection fault after device removal Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 23/62] USB: w1 ds2490: Fix bug caused by improper use of altsetting array Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 24/62] usb: usbip: fix isoc packet num validation in get_pipe Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 25/62] USB: core: Fix unterminated string returned by usb_string() Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 26/62] USB: core: Fix bug caused by duplicate interface PM usage counter Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 27/62] nvme-loop: init nvmet_ctrl fatal_err_work when allocate Greg Kroah-Hartman
2019-05-06 14:32 ` [PATCH 4.9 28/62] HID: logitech: check the return value of create_singlethread_workqueue Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 29/62] HID: debug: fix race condition with between rdesc_show() and device removal Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 30/62] rtc: sh: Fix invalid alarm warning for non-enabled alarm Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 31/62] batman-adv: Reduce claim hash refcnt only for removed entry Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 32/62] batman-adv: Reduce tt_local " Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 33/62] batman-adv: Reduce tt_global " Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 34/62] igb: Fix WARN_ONCE on runtime suspend Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 35/62] net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 36/62] bonding: show full hw address in sysfs for slave entries Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 37/62] net: stmmac: dont overwrite discard_frame status Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 38/62] net: stmmac: fix dropping of multi-descriptor RX frames Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 39/62] net: stmmac: dont log oversized frames Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 40/62] jffs2: fix use-after-free on symlink traversal Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 41/62] debugfs: " Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 42/62] rtc: da9063: set uie_unsupported when relevant Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 43/62] vfio/pci: use correct format characters Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 44/62] scsi: core: add new RDAC LENOVO/DE_Series device Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 45/62] scsi: storvsc: Fix calculation of sub-channel count Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 46/62] net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw() Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 47/62] net: hns: Use NAPI_POLL_WEIGHT for hns driver Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 48/62] net: hns: Fix WARNING when remove HNS driver with SMMU enabled Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 49/62] hugetlbfs: fix memory leak for resv_map Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 50/62] sh: fix multiple function definition build errors Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 51/62] xsysace: Fix error handling in ace_setup Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 52/62] ARM: orion: dont use using 64-bit DMA masks Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 53/62] ARM: iop: " Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 54/62] perf/x86/amd: Update generic hardware cache events for Family 17h Greg Kroah-Hartman
2019-05-06 14:33 ` Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 55/62] staging: iio: adt7316: allow adt751x to use internal vref for all dacs Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 56/62] staging: iio: adt7316: fix the dac read calculation Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 57/62] staging: iio: adt7316: fix the dac write calculation Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 58/62] scsi: RDMA/srpt: Fix a credit leak for aborted commands Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 59/62] Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 60/62] selinux: never allow relabeling on context mounts Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 61/62] x86/mce: Improve error message when kernel cannot recover, p2 Greg Kroah-Hartman
2019-05-06 14:33 ` [PATCH 4.9 62/62] media: v4l2: i2c: ov7670: Fix PLL bypass register values Greg Kroah-Hartman
2019-05-07 8:12 ` [PATCH 4.9 00/62] 4.9.174-stable review Naresh Kamboju
2019-05-07 12:44 ` Jon Hunter
2019-05-07 12:44 ` Jon Hunter
2019-05-07 18:38 ` Guenter Roeck
2019-05-07 20:34 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190506143051.397032869@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=ebiederm@xmission.com \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.