From: Marc Kleine-Budde <mkl@pengutronix.de>
To: YueHaibing <yuehaibing@huawei.com>
Cc: socketcan@hartkopp.net, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, urs.thuermann@volkswagen.de,
linux-can@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] can: bcm: Fix UAF in bcm_proc_show()
Date: Mon, 17 Jul 2023 09:47:36 +0200 [thread overview]
Message-ID: <20230717-uplifted-external-b00b04bbc903-mkl@pengutronix.de> (raw)
In-Reply-To: <20230715092543.15548-1-yuehaibing@huawei.com>
[-- Attachment #1: Type: text/plain, Size: 1860 bytes --]
On 15.07.2023 17:25:43, YueHaibing wrote:
> BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
> Read of size 8 at addr ffff888155846230 by task cat/7862
>
> CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0xd5/0x150
> print_report+0xc1/0x5e0
> kasan_report+0xba/0xf0
> bcm_proc_show+0x969/0xa80
> seq_read_iter+0x4f6/0x1260
> seq_read+0x165/0x210
> proc_reg_read+0x227/0x300
> vfs_read+0x1d5/0x8d0
> ksys_read+0x11e/0x240
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Allocated by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> __kasan_kmalloc+0x9e/0xa0
> bcm_sendmsg+0x264b/0x44e0
> sock_sendmsg+0xda/0x180
> ____sys_sendmsg+0x735/0x920
> ___sys_sendmsg+0x11d/0x1b0
> __sys_sendmsg+0xfa/0x1d0
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Freed by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> kasan_save_free_info+0x27/0x40
> ____kasan_slab_free+0x161/0x1c0
> slab_free_freelist_hook+0x119/0x220
> __kmem_cache_free+0xb4/0x2e0
> rcu_core+0x809/0x1bd0
>
> bcm_op is freed before procfs entry be removed in bcm_release(),
> this lead to bcm_proc_show() may read the freed bcm_op.
>
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Added to linux-can/testing.
Thanks,
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung Nürnberg | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-9 |
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
prev parent reply other threads:[~2023-07-17 7:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-15 9:25 [PATCH] can: bcm: Fix UAF in bcm_proc_show() YueHaibing
2023-07-16 19:31 ` Oliver Hartkopp
2023-07-17 7:47 ` Marc Kleine-Budde [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230717-uplifted-external-b00b04bbc903-mkl@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=socketcan@hartkopp.net \
--cc=urs.thuermann@volkswagen.de \
--cc=yuehaibing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).