[PATCH] nvme-tcp: Fix use-after-free of netns by kernel TCP socket.

[PATCH] nvme-tcp: Fix use-after-free of netns by kernel TCP socket.

[Kuniyuki Iwashima]

Commit 1be52169c348 ("nvme-tcp: fix selinux denied when calling
sock_sendmsg") converted sock_create() in nvme_tcp_alloc_queue()
to sock_create_kern().

sock_create_kern() creates a kernel socket, which does not hold
a reference to netns.  If the code does not manage the netns
lifetime properly, use-after-free could happen.

Also, TCP kernel socket with sk_net_refcnt 0 has a socket leak
problem: it remains FIN_WAIT_1 if it misses FIN after close()
because tcp_close() stops all timers.

To fix such problems, let's hold netns ref by sk_net_refcnt_upgrade().

We had the same issue in CIFS, SMC, etc, and applied the same
solution, see commit ef7134c7fc48 ("smb: client: Fix use-after-free
of network namespace.") and commit 9744d2bf1976 ("smc: Fix
use-after-free in tcp_write_timer_handler().").

Fixes: 1be52169c348 ("nvme-tcp: fix selinux denied when calling sock_sendmsg")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
---
 drivers/nvme/host/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 26c459f0198d..72d260201d8c 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1803,6 +1803,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid,
 		ret = PTR_ERR(sock_file);
 		goto err_destroy_mutex;
 	}
+
+	sk_net_refcnt_upgrade(queue->sock->sk);
 	nvme_tcp_reclassify_socket(queue->sock);
 
 	/* Single syn retry */
-- 
2.49.0

Re: [PATCH] nvme-tcp: Fix use-after-free of netns by kernel TCP socket.

[Christoph Hellwig]

Thanks, applied to nvme-6.15.

> To fix such problems, let's hold netns ref by sk_net_refcnt_upgrade().
> 
> We had the same issue in CIFS, SMC, etc, and applied the same
> solution, see commit ef7134c7fc48 ("smb: client: Fix use-after-free
> of network namespace.") and commit 9744d2bf1976 ("smc: Fix
> use-after-free in tcp_write_timer_handler().").

I wish the netns APIs would be a little more robus to prevent these
bugs from creeping in everywhere..

Re: [PATCH] nvme-tcp: Fix use-after-free of netns by kernel TCP socket.

[Kuniyuki Iwashima]

From: Christoph Hellwig <hch@lst.de>
Date: Wed, 9 Apr 2025 10:44:46 +0200
> Thanks, applied to nvme-6.15.

Thanks!

> 
> > To fix such problems, let's hold netns ref by sk_net_refcnt_upgrade().
> > 
> > We had the same issue in CIFS, SMC, etc, and applied the same
> > solution, see commit ef7134c7fc48 ("smb: client: Fix use-after-free
> > of network namespace.") and commit 9744d2bf1976 ("smc: Fix
> > use-after-free in tcp_write_timer_handler().").
> 
> I wish the netns APIs would be a little more robus to prevent these
> bugs from creeping in everywhere..

Can't agree more!

Actually, last year I tried to clean up such APIs to prevent this type
of issue.
https://lore.kernel.org/netdev/20241213092152.14057-1-kuniyu@amazon.com/

I'll revise this in this cycle once the fix reaches net tree.

Re: [PATCH] nvme-tcp: Fix use-after-free of netns by kernel TCP socket.

[Sagi Grimberg]

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>