[PATCH net 0/1] net: hsr: fix node-table UAF on device teardown

[PATCH net 0/1] net: hsr: fix node-table UAF on device teardown

[Michael Bommarito]

Hi,

HSR generic-netlink node-list/status readers walk hsr->node_db under
rcu_read_lock(), but RTM_DELLINK teardown frees the same node table
immediately via plain list_del() + kfree(). A reader that has already
obtained a struct hsr_node can race hsr_dellink() and dereference
freed node memory.

The patch below uses list_del_rcu() and the existing
hsr_free_node_rcu() callback in hsr_del_nodes(). The HSR prune paths
already use this lifetime rule for the same node_db.

Reproduction.

  The natural reader window between hsr_get_next_node() acquiring
  a node and ether_addr_copy() consuming it is short, so I widened
  it with a temporary udelay() in hsr_get_next_node() and
  hsr_get_node_data() (debug-only, not in this submission). Under
  x86_64 KVM with KASAN, an in-netns RTM_NEWLINK / parallel-readers
  / RTM_DELLINK loop then produces:

    BUG: KASAN: slab-use-after-free in hsr_get_next_node+0x1db/0x350
    Read of size 6 at addr ffff888009e6f290 by task hsr_genl_spam/...
    Freed by task ip:
      hsr_del_nodes+0x144/0x250
      hsr_dellink+0x6c/0x90
      rtnl_dellink+...

  The reader walks node_db under rcu_read_lock() while hsr_dellink()
  -> hsr_del_nodes() removes and immediately frees the entries.

  Without the artificial widening the race is still real but the
  observable window is ns-to-us scale, which is presumably why
  syzbot has not flagged it in the open. The fix is the same
  either way: honour the RCU lifetime that the prune paths
  already use.

Testing.

  - net/hsr/hsr_framereg.o builds clean on an x86_64 KASAN config.
  - With the widening patch applied on top of this fix, 50 rounds
    of the RTM_NEWLINK / parallel-readers / RTM_DELLINK harness
    run KASAN-silent. The same harness fires the splat above on
    the unpatched tree in the first round.
  - Without the widening, 100 rounds of the same harness in
    list-readers mode run clean on the patched kernel.
  - tools/testing/selftests/net/hsr/{hsr_ping,prp_ping,hsr_redbox}.sh
    -4 all pass on both stock and patched kernels, diff-clean.
  - scripts/checkpatch.pl --strict is clean.

A separate status-path NULL deref in hsr_get_node_data() shows up
when the same harness runs with status readers and the widening
patch. That predates this fix and is not addressed here; I will
send it as its own patch once the primitive is characterised.

This targets net and carries a stable tag back to the dellink
cleanup commit b9a1e627405d.

Michael Bommarito (1):
  net: hsr: defer node table free until after RCU readers

 net/hsr/hsr_framereg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


base-commit: 8d90b09e6741f5103ccc81a53bf2391ea09419a7
--
2.53.0

[PATCH net 1/1] net: hsr: defer node table free until after RCU readers

[Michael Bommarito]

HSR node-list and node-status generic-netlink operations run under
rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and
hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table
with plain list_del() and frees each node immediately.

That lets a generic-netlink reader hold a struct hsr_node pointer across
hsr_dellink(). In a KASAN build, widening the reader window after
hsr_get_next_node() obtains the node reproduces a slab-use-after-free
when the reader copies node->macaddress_A; the freeing stack is
hsr_del_nodes() from hsr_dellink().

Use list_del_rcu() and defer the free through the existing
hsr_free_node_rcu() callback. This matches the lifetime rule used by the
HSR prune paths, which already delete nodes with list_del_rcu() and
call_rcu().

Fixes: b9a1e627405d ("hsr: implement dellink to clean up resources")
Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
---
 net/hsr/hsr_framereg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index d09875b33588..06b0977ab099 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -163,8 +163,8 @@ void hsr_del_nodes(struct list_head *node_db)
 	struct hsr_node *tmp;
 
 	list_for_each_entry_safe(node, tmp, node_db, mac_list) {
-		list_del(&node->mac_list);
-		hsr_free_node(node);
+		list_del_rcu(&node->mac_list);
+		call_rcu(&node->rcu_head, hsr_free_node_rcu);
 	}
 }
 
-- 
2.53.0