* [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list [not found] <1678233154187.35009@alliedtelesis.co.nz> @ 2023-03-09 1:24 ` Kyuwon Shim 2023-03-16 11:28 ` Florian Westphal 0 siblings, 1 reply; 6+ messages in thread From: Kyuwon Shim @ 2023-03-09 1:24 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, Kyuwon Shim The issue "core dumped" occurred from ulogd_unregister_fd(). One of the processes is unlink from list and remove, but some struct 'pi' values freed without ulogd_unregister_fd(). Unlink process needs to access the previous pointer value of struct 'pi', but it was already freed. Therefore, the free() process moved location after finishing all ulogd_unregister_fd(). Signed-off-by: Kyuwon Shim <kyuwon.shim@alliedtelesis.co.nz> --- Notes: Add new patch revision in plain-text that applies cleanly to master src/ulogd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/ulogd.c b/src/ulogd.c index 8ea9793ec..944637e0d 100644 --- a/src/ulogd.c +++ b/src/ulogd.c @@ -1334,6 +1334,11 @@ static void stop_pluginstances() (*pi->plugin->stop)(pi); pi->private[0] = 0; } + } + } + + llist_for_each_entry(stack, &ulogd_pi_stacks, stack_list) { + llist_for_each_entry_safe(pi, npi, &stack->list, list) { free(pi); } } -- 2.39.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list 2023-03-09 1:24 ` [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list Kyuwon Shim @ 2023-03-16 11:28 ` Florian Westphal 2023-03-20 20:41 ` Kyuwon Shim 0 siblings, 1 reply; 6+ messages in thread From: Florian Westphal @ 2023-03-16 11:28 UTC (permalink / raw) To: Kyuwon Shim; +Cc: pablo, netfilter-devel Kyuwon Shim <kyuwon.shim@alliedtelesis.co.nz> wrote: > The issue "core dumped" occurred from > ulogd_unregister_fd(). One of the processes is unlink > from list and remove, but some struct 'pi' values > freed without ulogd_unregister_fd(). > Unlink process needs to access the previous pointer > value of struct 'pi', but it was already freed. > > Therefore, the free() process moved location > after finishing all ulogd_unregister_fd(). I don't understand this patch. llist_for_each_entry_safe() doesn't dereference 'pi' after its free'd. Where does this deref happen? Can you share a backtrace? > + } > + } > + > + llist_for_each_entry(stack, &ulogd_pi_stacks, stack_list) { > + llist_for_each_entry_safe(pi, npi, &stack->list, list) { > free(pi); Perhaps there should be a 'llist_del' before pi gets free'd instead? ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list 2023-03-16 11:28 ` Florian Westphal @ 2023-03-20 20:41 ` Kyuwon Shim 2023-03-20 21:43 ` Jeremy Sowden 2023-03-20 22:10 ` Florian Westphal 0 siblings, 2 replies; 6+ messages in thread From: Kyuwon Shim @ 2023-03-20 20:41 UTC (permalink / raw) To: fw@strlen.de; +Cc: pablo@netfilter.org, netfilter-devel@vger.kernel.org Hi, Florian This is valgrind logs. ==4797== Memcheck, a memory error detector ==4797== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. ==4797== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info ==4797== Command: ulogd -v -c /etc/ulogd.conf ==4797== Invalid read of size 4 ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) ==4797== by 0x4E4E3DF: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Address 0x4a84f40 is 160 bytes inside a block of size 4,848 free'd ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Block was alloc'd at ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) ==4797== by 0x405504: create_stack (ulogd.c:1014) ==4797== by 0x406FCE: config_parse_file (conffile.c:225) ==4797== by 0x403949: parse_conffile (ulogd.c:1107) ==4797== by 0x403949: main (ulogd.c:1589) ==4797== ==4797== Invalid read of size 8 ==4797== at 0x405F6E: ulogd_unregister_fd (select.c:73) ==4797== by 0x4E4E3DF: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Address 0x4a84f30 is 144 bytes inside a block of size 4,848 free'd ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Block was alloc'd at ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) ==4797== by 0x405504: create_stack (ulogd.c:1014) ==4797== by 0x406FCE: config_parse_file (conffile.c:225) ==4797== by 0x403949: parse_conffile (ulogd.c:1107) ==4797== by 0x403949: main (ulogd.c:1589) ==4797== Tue Mar 14 11:18:20 2023 <1> ulogd.c:1333 calling stop for IFINDEX ==4797== Invalid write of size 8 ==4797== at 0x405F31: __llist_del (linuxlist.h:107) ==4797== by 0x405F31: llist_del (linuxlist.h:119) ==4797== by 0x405F31: ulogd_unregister_fd (select.c:69) ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Address 0x4a84f38 is 152 bytes inside a block of size 4,848 free'd ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Block was alloc'd at ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) ==4797== by 0x405504: create_stack (ulogd.c:1014) ==4797== by 0x406FCE: config_parse_file (conffile.c:225) ==4797== by 0x403949: parse_conffile (ulogd.c:1107) ==4797== by 0x403949: main (ulogd.c:1589) ==4797== ==4797== Invalid read of size 4 ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Address 0x4a84f40 is 160 bytes inside a block of size 4,848 free'd ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Block was alloc'd at ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) ==4797== by 0x405504: create_stack (ulogd.c:1014) ==4797== by 0x406FCE: config_parse_file (conffile.c:225) ==4797== by 0x403949: parse_conffile (ulogd.c:1107) ==4797== by 0x403949: main (ulogd.c:1589) ==4797== ==4797== Invalid read of size 8 ==4797== at 0x405F6E: ulogd_unregister_fd (select.c:73) ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Address 0x4a84f30 is 144 bytes inside a block of size 4,848 free'd ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) ==4797== by 0x406163: ulogd_select_main (select.c:105) ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) ==4797== by 0x403CF3: main (ulogd.c:1649) ==4797== Block was alloc'd at ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) ==4797== by 0x405504: create_stack (ulogd.c:1014) ==4797== by 0x406FCE: config_parse_file (conffile.c:225) ==4797== by 0x403949: parse_conffile (ulogd.c:1107) ==4797== by 0x403949: main (ulogd.c:1589) ==4797== Tue Mar 14 11:18:20 2023 <1> ulogd.c:1333 calling stop for SYSLOG ==4797== ==4797== HEAP SUMMARY: ==4797== in use at exit: 301,152 bytes in 10 blocks ==4797== total heap usage: 1,133 allocs, 1,123 frees, 1,852,378 bytes allocated ==4797== ==4797== LEAK SUMMARY: ==4797== definitely lost: 300,928 bytes in 4 blocks ==4797== indirectly lost: 224 bytes in 6 blocks ==4797== possibly lost: 0 bytes in 0 blocks ==4797== still reachable: 0 bytes in 0 blocks ==4797== suppressed: 0 bytes in 0 blocks ==4797== Rerun with --leak-check=full to see details of leaked memory ==4797== ==4797== Use --track-origins=yes to see where uninitialised values come from ==4797== For lists of detected and suppressed errors, rerun with: -s ==4797== ERROR SUMMARY: 12 errors from 6 contexts (suppressed: 0 from 0) This is coredump backtrace. --------------------------------------------------------------------- ----------- Thread Information: Id Target Id Frame * 1 LWP 170 0x00007fa985225d40 in main_arena () from /tmp/tmp1fbxh6bj/vfw_x86_64/output/awplus- vfw_x86_64/image/rootfs/staging/lib64/libc.so.6 --------------------------------------------------------------------- ----------- Current Thread Local Variables: No symbol table info available. --------------------------------------------------------------------- ----------- Thread Backtraces: Thread 1 (LWP 170): #0 0x00007fa985225d40 in main_arena () from /tmp/tmp1fbxh6bj/vfw_x86_64/output/awplus- vfw_x86_64/image/rootfs/staging/lib64/libc.so.6 #1 0x0000000000405ca7 in ulogd_propagate_results (pi=pi@entry=0x8ebc50 ) at ulogd.c:617 #2 0x00007fa9850376b9 in interp_packet (upi=upi@entry=0x8ebc50, pf_family=<optimized out>, ldata=ldata@entry=0x7ffe805c2648) at ulogd_inppkt_NFLOG.c:400 #3 0x00007fa985037c55 in msg_cb (gh=<optimized out>, nfmsg=0x7ffe805c2770, nfa=0x7ffe805c2648, data=0x8e2d90) at ulogd_inppkt_NFLOG.c:479 #4 0x00007fa98503023e in __nflog_rcv_pkt (nlh=<optimized out>, nfa=<optimized out>, data=<optimized out>) at libnetfilter_log.c:162 #5 0x00007fa9850288fc in nfnl_step (h=h@entry=0x8e6f80, nlh=nlh@entry= 0x7ffe805c2760) at libnfnetlink.c:1365 #6 0x00007fa985028ff8 in nfnl_process (h=h@entry=0x8e6f80, buf=buf@entry=0x7ffe805c2760 "\214", len=len@entry=140) at libnfnetlink.c:1410 #7 0x00007fa985029344 in nfnl_catch (h=<optimized out>) at libnfnetlink.c:1564 #8 nfnl_catch (h=0x8e6f80) at libnfnetlink.c:1546 #9 0x00007fa985030612 in __build_send_cfg_msg (pf=0 '\000', groupnum=<optimized out>, command=2 '\002', h=0x8dfbc0) at libnetfilter_log.c:143 #10 nflog_unbind_group (gh=0x8e71a0) at libnetfilter_log.c:439 #11 0x00007fa9850373ec in stop (pi=0x8e2d90) at ulogd_inppkt_NFLOG.c:638 #12 0x0000000000405004 in stop_pluginstances () at ulogd.c:1335 #13 sigterm_handler_task (signal=signal@entry=15) at ulogd.c:1383 #14 0x0000000000405154 in call_signal_handler_tasks (sig=15) at ulogd.c:423 #15 signal_channel_callback (fd=4, what=<optimized out>, data=<optimized out>) at ulogd.c:442 #16 0x0000000000406184 in ulogd_select_main (tv=tv@entry=0x0) at select.c:105 #17 0x0000000000403cf4 in ulogd_main_loop () at ulogd.c:1070 #18 main (argc=<optimized out>, argv=<optimized out>) at ulogd.c:1649 --------------------------------------------------------------------- ----------- On Thu, 2023-03-16 at 12:28 +0100, Florian Westphal wrote: > Kyuwon Shim <kyuwon.shim@alliedtelesis.co.nz> wrote: > > The issue "core dumped" occurred from > > ulogd_unregister_fd(). One of the processes is unlink > > from list and remove, but some struct 'pi' values > > freed without ulogd_unregister_fd(). > > Unlink process needs to access the previous pointer > > value of struct 'pi', but it was already freed. > > > > Therefore, the free() process moved location > > after finishing all ulogd_unregister_fd(). > > I don't understand this patch. > > llist_for_each_entry_safe() doesn't dereference 'pi' after its > free'd. > > Where does this deref happen? Can you share a backtrace? > > > + } > > + } > > + > > + llist_for_each_entry(stack, &ulogd_pi_stacks, stack_list) { > > + llist_for_each_entry_safe(pi, npi, &stack->list, list) > > { > > free(pi); > > Perhaps there should be a 'llist_del' before pi gets free'd instead? ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list 2023-03-20 20:41 ` Kyuwon Shim @ 2023-03-20 21:43 ` Jeremy Sowden 2023-03-20 22:10 ` Florian Westphal 1 sibling, 0 replies; 6+ messages in thread From: Jeremy Sowden @ 2023-03-20 21:43 UTC (permalink / raw) To: Kyuwon Shim Cc: fw@strlen.de, pablo@netfilter.org, netfilter-devel@vger.kernel.org [-- Attachment #1: Type: text/plain, Size: 13251 bytes --] On 2023-03-20, at 20:41:46 +0000, Kyuwon Shim wrote: > On Thu, 2023-03-16 at 12:28 +0100, Florian Westphal wrote: > > Kyuwon Shim <kyuwon.shim@alliedtelesis.co.nz> wrote: > > > The issue "core dumped" occurred from ulogd_unregister_fd(). One > > > of the processes is unlink from list and remove, but some struct > > > 'pi' values freed without ulogd_unregister_fd(). Unlink process > > > needs to access the previous pointer value of struct 'pi', but it > > > was already freed. > > > > > > Therefore, the free() process moved location after finishing all > > > ulogd_unregister_fd(). > > > > I don't understand this patch. > > > > llist_for_each_entry_safe() doesn't dereference 'pi' after its > > free'd. > > > > Where does this deref happen? Can you share a backtrace? > > > > > + } > > > + } > > > + > > > + llist_for_each_entry(stack, &ulogd_pi_stacks, stack_list) { > > > + llist_for_each_entry_safe(pi, npi, &stack->list, list) > > > { > > > free(pi); > > > > Perhaps there should be a 'llist_del' before pi gets free'd instead? > > This is valgrind logs. > > ==4797== Memcheck, a memory error detector > ==4797== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. > ==4797== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info > ==4797== Command: ulogd -v -c /etc/ulogd.conf > ==4797== Invalid read of size 4 > ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) > ==4797== by 0x4E4E3DF: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f40 is 160 bytes inside a block of size 4,848 free'd > ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) > ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Block was alloc'd /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) > ==4797== by 0x405504: create_stack (ulogd.c:1014) > ==4797== by 0x406FCE: config_parse_file (conffile.c:225) > ==4797== by 0x403949: parse_conffile (ulogd.c:1107) > ==4797== by 0x403949: main (ulogd.c:1589) > ==4797== > ==4797== Invalid read of size 8 > ==4797== at 0x405F6E: ulogd_unregister_fd (select.c:73) > ==4797== by 0x4E4E3DF: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f30 is 144 bytes inside a block of size 4,848 free'd > ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) > ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Block was alloc'd at > ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) > ==4797== by 0x405504: create_stack (ulogd.c:1014) > ==4797== by 0x406FCE: config_parse_file (conffile.c:225) > ==4797== by 0x403949: parse_conffile (ulogd.c:1107) > ==4797== by 0x403949: main (ulogd.c:1589) > ==4797== > Tue Mar 14 11:18:20 2023 <1> ulogd.c:1333 calling stop for IFINDEX > ==4797== Invalid write of size 8 > ==4797== at 0x405F31: __llist_del (linuxlist.h:107) > ==4797== by 0x405F31: llist_del (linuxlist.h:119) > ==4797== by 0x405F31: ulogd_unregister_fd (select.c:69) > ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f38 is 152 bytes inside a block of size 4,848 free'd > ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) > ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Block was alloc'd at > ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) > ==4797== by 0x405504: create_stack (ulogd.c:1014) > ==4797== by 0x406FCE: config_parse_file (conffile.c:225) > ==4797== by 0x403949: parse_conffile (ulogd.c:1107) > ==4797== by 0x403949: main (ulogd.c:1589) > ==4797== > ==4797== Invalid read of size 4 > ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) > ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f40 is 160 bytes inside a block of size 4,848 free'd > ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) > ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Block was alloc'd at > ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) > ==4797== by 0x405504: create_stack (ulogd.c:1014) > ==4797== by 0x406FCE: config_parse_file (conffile.c:225) > ==4797== by 0x403949: parse_conffile (ulogd.c:1107) > ==4797== by 0x403949: main (ulogd.c:1589) > ==4797== > ==4797== Invalid read of size 8 > ==4797== at 0x405F6E: ulogd_unregister_fd (select.c:73) > ==4797== by 0x4E6427F: ??? (in /usr/lib/ulogd/ulogd_filter_IFINDEX.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f30 is 144 bytes inside a block of size 4,848 free'd > ==4797== at 0x4847551: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x40500E: stop_pluginstances (ulogd.c:1338) > ==4797== by 0x40500E: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Block was alloc'd at > ==4797== at 0x4849D82: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) > ==4797== by 0x405504: pluginstance_alloc_init (ulogd.c:664) > ==4797== by 0x405504: create_stack (ulogd.c:1014) > ==4797== by 0x406FCE: config_parse_file (conffile.c:225) > ==4797== by 0x403949: parse_conffile (ulogd.c:1107) > ==4797== by 0x403949: main (ulogd.c:1589) > ==4797== > Tue Mar 14 11:18:20 2023 <1> ulogd.c:1333 calling stop for SYSLOG > ==4797== > ==4797== HEAP SUMMARY: > ==4797== in use at exit: 301,152 bytes in 10 blocks > ==4797== total heap usage: 1,133 allocs, 1,123 frees, 1,852,378 bytes allocated > ==4797== > ==4797== LEAK SUMMARY: > ==4797== definitely lost: 300,928 bytes in 4 blocks > ==4797== indirectly lost: 224 bytes in 6 blocks > ==4797== possibly lost: 0 bytes in 0 blocks > ==4797== still reachable: 0 bytes in 0 blocks > ==4797== suppressed: 0 bytes in 0 blocks > ==4797== Rerun with --leak-check=full to see details of leaked memory > ==4797== > ==4797== Use --track-origins=yes to see where uninitialised values come from > ==4797== For lists of detected and suppressed errors, rerun with: -s > ==4797== ERROR SUMMARY: 12 errors from 6 contexts (suppressed: 0 from 0) I've seen these traces myself. Never got round to diagnosing and fixing them. J. > This is coredump backtrace. > > -------------------------------------------------------------------------------- > Thread Information: > Id Target Id Frame > * 1 LWP 170 0x00007fa985225d40 in main_arena () > from /tmp/tmp1fbxh6bj/vfw_x86_64/output/awplus- > vfw_x86_64/image/rootfs/staging/lib64/libc.so.6 > -------------------------------------------------------------------------------- > Current Thread Local Variables: > No symbol table info available. > -------------------------------------------------------------------------------- > Thread Backtraces: > Thread 1 (LWP 170): > #0 0x00007fa985225d40 in main_arena () from /tmp/tmp1fbxh6bj/vfw_x86_64/output/awplus-vfw_x86_64/image/rootfs/staging/lib64/libc.so.6 > #1 0x0000000000405ca7 in ulogd_propagate_results (pi=pi@entry=0x8ebc50) at ulogd.c:617 > #2 0x00007fa9850376b9 in interp_packet (upi=upi@entry=0x8ebc50, pf_family=<optimized out>, ldata=ldata@entry=0x7ffe805c2648) at ulogd_inppkt_NFLOG.c:400 > #3 0x00007fa985037c55 in msg_cb (gh=<optimized out>, nfmsg=0x7ffe805c2770, nfa=0x7ffe805c2648, data=0x8e2d90) at ulogd_inppkt_NFLOG.c:479 > #4 0x00007fa98503023e in __nflog_rcv_pkt (nlh=<optimized out>, nfa=<optimized out>, data=<optimized out>) at libnetfilter_log.c:162 > #5 0x00007fa9850288fc in nfnl_step (h=h@entry=0x8e6f80, nlh=nlh@entry=0x7ffe805c2760) at libnfnetlink.c:1365 > #6 0x00007fa985028ff8 in nfnl_process (h=h@entry=0x8e6f80, buf=buf@entry=0x7ffe805c2760 "\214", len=len@entry=140) at libnfnetlink.c:1410 > #7 0x00007fa985029344 in nfnl_catch (h=<optimized out>) at libnfnetlink.c:1564 > #8 nfnl_catch (h=0x8e6f80) at libnfnetlink.c:1546 > #9 0x00007fa985030612 in __build_send_cfg_msg (pf=0 '\000', groupnum=<optimized out>, command=2 '\002', h=0x8dfbc0) at libnetfilter_log.c:143 > #10 nflog_unbind_group (gh=0x8e71a0) at libnetfilter_log.c:439 > #11 0x00007fa9850373ec in stop (pi=0x8e2d90) at ulogd_inppkt_NFLOG.c:638 > #12 0x0000000000405004 in stop_pluginstances () at ulogd.c:1335 > #13 sigterm_handler_task (signal=signal@entry=15) at ulogd.c:1383 > #14 0x0000000000405154 in call_signal_handler_tasks (sig=15) at ulogd.c:423 > #15 signal_channel_callback (fd=4, what=<optimized out>, data=<optimized out>) at ulogd.c:442 > #16 0x0000000000406184 in ulogd_select_main (tv=tv@entry=0x0) at select.c:105 > #17 0x0000000000403cf4 in ulogd_main_loop () at ulogd.c:1070 > #18 main (argc=<optimized out>, argv=<optimized out>) at ulogd.c:1649 > -------------------------------------------------------------------------------- [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list 2023-03-20 20:41 ` Kyuwon Shim 2023-03-20 21:43 ` Jeremy Sowden @ 2023-03-20 22:10 ` Florian Westphal 2023-03-20 23:35 ` Kyuwon Shim 1 sibling, 1 reply; 6+ messages in thread From: Florian Westphal @ 2023-03-20 22:10 UTC (permalink / raw) To: Kyuwon Shim Cc: fw@strlen.de, pablo@netfilter.org, netfilter-devel@vger.kernel.org Kyuwon Shim <Kyuwon.Shim@alliedtelesis.co.nz> wrote: > Hi, Florian > This is valgrind logs. > > ==4797== Memcheck, a memory error detector > ==4797== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et > al. > ==4797== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright > info > ==4797== Command: ulogd -v -c /etc/ulogd.conf > ==4797== Invalid read of size 4 > ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) > ==4797== by 0x4E4E3DF: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > ==4797== by 0x406163: ulogd_select_main (select.c:105) > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > ==4797== by 0x403CF3: main (ulogd.c:1649) > ==4797== Address 0x4a84f40 is 160 bytes inside a block of size 4,848 > free'd Yuck, thanks for the backtrace. I've applied the patch with an amended changelog and a comment wrt. ::stop doing such things. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list 2023-03-20 22:10 ` Florian Westphal @ 2023-03-20 23:35 ` Kyuwon Shim 0 siblings, 0 replies; 6+ messages in thread From: Kyuwon Shim @ 2023-03-20 23:35 UTC (permalink / raw) To: fw@strlen.de; +Cc: pablo@netfilter.org, netfilter-devel@vger.kernel.org Thank you Florian! Have a great day! On Mon, 2023-03-20 at 23:10 +0100, Florian Westphal wrote: > Kyuwon Shim <Kyuwon.Shim@alliedtelesis.co.nz> wrote: > > Hi, Florian > > This is valgrind logs. > > > > ==4797== Memcheck, a memory error detector > > ==4797== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward > > et > > al. > > ==4797== Using Valgrind-3.19.0 and LibVEX; rerun with -h for > > copyright > > info > > ==4797== Command: ulogd -v -c /etc/ulogd.conf > > ==4797== Invalid read of size 4 > > ==4797== at 0x405F60: ulogd_unregister_fd (select.c:74) > > ==4797== by 0x4E4E3DF: ??? (in > > /usr/lib/ulogd/ulogd_inppkt_NFLOG.so) > > ==4797== by 0x405003: stop_pluginstances (ulogd.c:1335) > > ==4797== by 0x405003: sigterm_handler_task (ulogd.c:1383) > > ==4797== by 0x405153: call_signal_handler_tasks (ulogd.c:424) > > ==4797== by 0x405153: signal_channel_callback (ulogd.c:443) > > ==4797== by 0x406163: ulogd_select_main (select.c:105) > > ==4797== by 0x403CF3: ulogd_main_loop (ulogd.c:1070) > > ==4797== by 0x403CF3: main (ulogd.c:1649) > > ==4797== Address 0x4a84f40 is 160 bytes inside a block of size > > 4,848 > > free'd > > Yuck, thanks for the backtrace. I've applied the patch with an > amended > changelog and a comment wrt. ::stop doing such things. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-03-20 23:35 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1678233154187.35009@alliedtelesis.co.nz>
2023-03-09 1:24 ` [PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list Kyuwon Shim
2023-03-16 11:28 ` Florian Westphal
2023-03-20 20:41 ` Kyuwon Shim
2023-03-20 21:43 ` Jeremy Sowden
2023-03-20 22:10 ` Florian Westphal
2023-03-20 23:35 ` Kyuwon Shim
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.