* [PATCH] can: bcm: Fix UAF in bcm_proc_show()
@ 2023-07-15 9:25 YueHaibing
2023-07-16 19:31 ` Oliver Hartkopp
2023-07-17 7:47 ` Marc Kleine-Budde
0 siblings, 2 replies; 3+ messages in thread
From: YueHaibing @ 2023-07-15 9:25 UTC (permalink / raw)
To: socketcan, mkl, davem, edumazet, kuba, pabeni, urs.thuermann
Cc: linux-can, netdev, linux-kernel, YueHaibing
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
Read of size 8 at addr ffff888155846230 by task cat/7862
CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xd5/0x150
print_report+0xc1/0x5e0
kasan_report+0xba/0xf0
bcm_proc_show+0x969/0xa80
seq_read_iter+0x4f6/0x1260
seq_read+0x165/0x210
proc_reg_read+0x227/0x300
vfs_read+0x1d5/0x8d0
ksys_read+0x11e/0x240
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Allocated by task 7846:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x9e/0xa0
bcm_sendmsg+0x264b/0x44e0
sock_sendmsg+0xda/0x180
____sys_sendmsg+0x735/0x920
___sys_sendmsg+0x11d/0x1b0
__sys_sendmsg+0xfa/0x1d0
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 7846:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x27/0x40
____kasan_slab_free+0x161/0x1c0
slab_free_freelist_hook+0x119/0x220
__kmem_cache_free+0xb4/0x2e0
rcu_core+0x809/0x1bd0
bcm_op is freed before procfs entry be removed in bcm_release(),
this lead to bcm_proc_show() may read the freed bcm_op.
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
net/can/bcm.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9ba35685b043..9168114fc87f 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *sock)
lock_sock(sk);
+#if IS_ENABLED(CONFIG_PROC_FS)
+ /* remove procfs entry */
+ if (net->can.bcmproc_dir && bo->bcm_proc_read)
+ remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+#endif /* CONFIG_PROC_FS */
+
list_for_each_entry_safe(op, next, &bo->tx_ops, list)
bcm_remove_op(op);
@@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *sock)
list_for_each_entry_safe(op, next, &bo->rx_ops, list)
bcm_remove_op(op);
-#if IS_ENABLED(CONFIG_PROC_FS)
- /* remove procfs entry */
- if (net->can.bcmproc_dir && bo->bcm_proc_read)
- remove_proc_entry(bo->procname, net->can.bcmproc_dir);
-#endif /* CONFIG_PROC_FS */
-
/* remove device reference */
if (bo->bound) {
bo->bound = 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] can: bcm: Fix UAF in bcm_proc_show()
2023-07-15 9:25 [PATCH] can: bcm: Fix UAF in bcm_proc_show() YueHaibing
@ 2023-07-16 19:31 ` Oliver Hartkopp
2023-07-17 7:47 ` Marc Kleine-Budde
1 sibling, 0 replies; 3+ messages in thread
From: Oliver Hartkopp @ 2023-07-16 19:31 UTC (permalink / raw)
To: YueHaibing, mkl, davem, edumazet, kuba, pabeni, urs.thuermann
Cc: linux-can, netdev, linux-kernel
Hello YueHaibing,
thanks for the patch!
Indeed the proc entry can be removed as first action after lock_sock().
Good catch!
On 2023-07-15 11:25, YueHaibing wrote:
> BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
> Read of size 8 at addr ffff888155846230 by task cat/7862
>
> CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0xd5/0x150
> print_report+0xc1/0x5e0
> kasan_report+0xba/0xf0
> bcm_proc_show+0x969/0xa80
> seq_read_iter+0x4f6/0x1260
> seq_read+0x165/0x210
> proc_reg_read+0x227/0x300
> vfs_read+0x1d5/0x8d0
> ksys_read+0x11e/0x240
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Allocated by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> __kasan_kmalloc+0x9e/0xa0
> bcm_sendmsg+0x264b/0x44e0
> sock_sendmsg+0xda/0x180
> ____sys_sendmsg+0x735/0x920
> ___sys_sendmsg+0x11d/0x1b0
> __sys_sendmsg+0xfa/0x1d0
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Freed by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> kasan_save_free_info+0x27/0x40
> ____kasan_slab_free+0x161/0x1c0
> slab_free_freelist_hook+0x119/0x220
> __kmem_cache_free+0xb4/0x2e0
> rcu_core+0x809/0x1bd0
>
> bcm_op is freed before procfs entry be removed in bcm_release(),
> this lead to bcm_proc_show() may read the freed bcm_op.
>
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Many thanks!
Oliver
> ---
> net/can/bcm.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index 9ba35685b043..9168114fc87f 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c
> @@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *sock)
>
> lock_sock(sk);
>
> +#if IS_ENABLED(CONFIG_PROC_FS)
> + /* remove procfs entry */
> + if (net->can.bcmproc_dir && bo->bcm_proc_read)
> + remove_proc_entry(bo->procname, net->can.bcmproc_dir);
> +#endif /* CONFIG_PROC_FS */
> +
> list_for_each_entry_safe(op, next, &bo->tx_ops, list)
> bcm_remove_op(op);
>
> @@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *sock)
> list_for_each_entry_safe(op, next, &bo->rx_ops, list)
> bcm_remove_op(op);
>
> -#if IS_ENABLED(CONFIG_PROC_FS)
> - /* remove procfs entry */
> - if (net->can.bcmproc_dir && bo->bcm_proc_read)
> - remove_proc_entry(bo->procname, net->can.bcmproc_dir);
> -#endif /* CONFIG_PROC_FS */
> -
> /* remove device reference */
> if (bo->bound) {
> bo->bound = 0;
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] can: bcm: Fix UAF in bcm_proc_show()
2023-07-15 9:25 [PATCH] can: bcm: Fix UAF in bcm_proc_show() YueHaibing
2023-07-16 19:31 ` Oliver Hartkopp
@ 2023-07-17 7:47 ` Marc Kleine-Budde
1 sibling, 0 replies; 3+ messages in thread
From: Marc Kleine-Budde @ 2023-07-17 7:47 UTC (permalink / raw)
To: YueHaibing
Cc: socketcan, davem, edumazet, kuba, pabeni, urs.thuermann,
linux-can, netdev, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1860 bytes --]
On 15.07.2023 17:25:43, YueHaibing wrote:
> BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
> Read of size 8 at addr ffff888155846230 by task cat/7862
>
> CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0xd5/0x150
> print_report+0xc1/0x5e0
> kasan_report+0xba/0xf0
> bcm_proc_show+0x969/0xa80
> seq_read_iter+0x4f6/0x1260
> seq_read+0x165/0x210
> proc_reg_read+0x227/0x300
> vfs_read+0x1d5/0x8d0
> ksys_read+0x11e/0x240
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Allocated by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> __kasan_kmalloc+0x9e/0xa0
> bcm_sendmsg+0x264b/0x44e0
> sock_sendmsg+0xda/0x180
> ____sys_sendmsg+0x735/0x920
> ___sys_sendmsg+0x11d/0x1b0
> __sys_sendmsg+0xfa/0x1d0
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Freed by task 7846:
> kasan_save_stack+0x1e/0x40
> kasan_set_track+0x21/0x30
> kasan_save_free_info+0x27/0x40
> ____kasan_slab_free+0x161/0x1c0
> slab_free_freelist_hook+0x119/0x220
> __kmem_cache_free+0xb4/0x2e0
> rcu_core+0x809/0x1bd0
>
> bcm_op is freed before procfs entry be removed in bcm_release(),
> this lead to bcm_proc_show() may read the freed bcm_op.
>
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Added to linux-can/testing.
Thanks,
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung Nürnberg | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-9 |
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-07-17 7:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-15 9:25 [PATCH] can: bcm: Fix UAF in bcm_proc_show() YueHaibing
2023-07-16 19:31 ` Oliver Hartkopp
2023-07-17 7:47 ` Marc Kleine-Budde
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).