Re: [PATCH net-next 1/9] sit: fix UAF in ipip6_tunnel_del_prl()

[Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>]

[-- Attachment #1: Type: text/plain, Size: 1703 bytes --]

> When flushing all potential router list (PRL) entries,
> ipip6_tunnel_del_prl() called call_rcu(&x->rcu_head, prl_list_destroy_rcu)
> before clearing t->prl.
> 
> A concurrent reader in isatap_chksrc() could enter an RCU read-side
> critical section after call_rcu() but before t->prl is set to NULL,
> allowing prl_list_destroy_rcu() to free nodes while the reader traverses
> them.
> 
> Clear t->prl using RCU_INIT_POINTER() before invoking call_rcu().
> Also use rcu_assign_pointer() when unlinking individual entries.
> 
> Fixes: ef9a9d1183b3 ("ipv6 sit: RCU conversion phase I")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Acked-by Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>

> ---
>  net/ipv6/sit.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index 19b7fa8d1a2a07991a00b250c5ae58819d104e79..4438b2472b28764f813b9162bdb9f6b6dee5a007 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -436,7 +436,7 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
>  		     (x = rtnl_dereference(*p)) != NULL;
>  		     p = &x->next) {
>  			if (x->addr == a->addr) {
> -				*p = x->next;
> +				rcu_assign_pointer(*p, rtnl_dereference(x->next));
>  				kfree_rcu(x, rcu_head);
>  				t->prl_count--;
>  				goto out;
> @@ -447,8 +447,8 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
>  		x = rtnl_dereference(t->prl);
>  		if (x) {
>  			t->prl_count = 0;
> +			RCU_INIT_POINTER(t->prl, NULL);
>  			call_rcu(&x->rcu_head, prl_list_destroy_rcu);
> -			t->prl = NULL;
>  		}
>  	}
>  out:
> -- 
> 2.55.0.979.g7e5102b832-goog
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]