[PATCH net] netfilter: ctnetlink: fix use-after-free of exp->master in single expectation GET

[Hyunwoo Kim <imv4bel@gmail.com>]

ctnetlink_get_expect() in the non-dump path calls
nf_ct_expect_find_get() which only takes a reference on the expectation
itself, not on exp->master.  It then calls ctnetlink_exp_fill_info()
which dereferences exp->master extensively (tuplehash, ct->ext via
nfct_help()).

A concurrent conntrack deletion through NFNL_SUBSYS_CTNETLINK (a
different nfnetlink subsystem mutex than NFNL_SUBSYS_CTNETLINK_EXP) can
free the master conntrack while the single GET is in progress, leading
to use-after-free.  In particular, kfree(ct->ext) is immediate and not
RCU-deferred.

Fix this by taking a reference on exp->master under rcu_read_lock
(required for SLAB_TYPESAFE_BY_RCU) before calling
ctnetlink_exp_fill_info() and releasing it afterwards.

KASAN report:

[    6.526107] ==================================================================
[    6.526345] BUG: KASAN: slab-use-after-free in ctnetlink_dump_tuples_ip+0xbc/0x1f0
[    6.526570] Read of size 2 at addr ffff8881042a8cb2 by task poc3/134
[    6.526745]
[    6.526798] CPU: 0 UID: 0 PID: 134 Comm: poc3 Not tainted 7.0.0-rc2+ #6 PREEMPTLAZY
[    6.526801] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[    6.526805] Call Trace:
[    6.526808]  <TASK>
[    6.526809]  dump_stack_lvl+0x64/0x80
[    6.526821]  print_report+0xce/0x660
[    6.526828]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[    6.526836]  ? kasan_save_stack+0x33/0x60
[    6.526841]  ? __virt_addr_valid+0xef/0x1a0
[    6.526848]  ? ctnetlink_dump_tuples_ip+0xbc/0x1f0
[    6.526850]  kasan_report+0xce/0x100
[    6.526852]  ? ctnetlink_dump_tuples_ip+0xbc/0x1f0
[    6.526855]  ctnetlink_dump_tuples_ip+0xbc/0x1f0
[    6.526858]  ? __pfx_ctnetlink_dump_tuples_ip+0x10/0x10
[    6.526860]  ? ctnetlink_dump_tuples_proto+0x144/0x190
[    6.526862]  ? skb_put+0x72/0xb0
[    6.526868]  ctnetlink_dump_tuples+0x19/0x60
[    6.526870]  ctnetlink_exp_dump_tuple+0x6f/0xd0
[    6.526872]  ctnetlink_exp_dump_expect+0x315/0x660
[    6.526875]  ? __pfx_ctnetlink_exp_dump_expect+0x10/0x10
[    6.526878]  ? __kmalloc_node_track_caller_noprof+0x1c6/0x590
[    6.526885]  ? kmalloc_reserve+0x75/0x160
[    6.526887]  ? skb_put+0x72/0xb0
[    6.526889]  ? __asan_memset+0x23/0x50
[    6.526892]  ? __nlmsg_put+0x97/0xb0
[    6.526897]  ctnetlink_exp_fill_info.constprop.0+0xf9/0x180
[    6.526899]  ctnetlink_get_expect+0x2f3/0x400
[    6.526901]  ? __pfx_ctnetlink_get_expect+0x10/0x10
[    6.526903]  ? __pfx___nla_validate_parse+0x10/0x10
[    6.526912]  ? mutex_lock+0x7e/0xd0
[    6.526914]  ? __pfx_mutex_lock+0x10/0x10
[    6.526917]  nfnetlink_rcv_msg+0x48e/0x510
[    6.526922]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[    6.526925]  ? __sys_sendmsg+0xf4/0x180
[    6.526927]  ? do_syscall_64+0xc3/0x6e0
[    6.526930]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[    6.526935]  netlink_rcv_skb+0xc9/0x1f0
[    6.526937]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[    6.526940]  ? __pfx_netlink_rcv_skb+0x10/0x10
[    6.526942]  ? security_capable+0xda/0x160
[    6.526947]  nfnetlink_rcv+0xdb/0x220
[    6.526951]  ? __pfx___netlink_lookup+0x10/0x10
[    6.526953]  ? __pfx_nfnetlink_rcv+0x10/0x10
[    6.526955]  ? netlink_deliver_tap+0x5f/0x400
[    6.526958]  netlink_unicast+0x3ec/0x590
[    6.526960]  ? __pfx_netlink_unicast+0x10/0x10
[    6.526961]  ? __pfx___alloc_skb+0x10/0x10
[    6.526963]  ? __alloc_frozen_pages_noprof+0x26f/0x560
[    6.526966]  ? __virt_addr_valid+0xef/0x1a0
[    6.526969]  ? __check_object_size+0x25f/0x450
[    6.526973]  netlink_sendmsg+0x397/0x690
[    6.526975]  ? __pfx_netlink_sendmsg+0x10/0x10
[    6.526977]  ? __import_iovec+0x220/0x270
[    6.526981]  ? __check_object_size+0x4b/0x450
[    6.526983]  ____sys_sendmsg+0x538/0x550
[    6.526987]  ? __pfx_____sys_sendmsg+0x10/0x10
[    6.526990]  ? __pfx_copy_msghdr_from_user+0x10/0x10
[    6.526992]  ? __pfx_lru_add+0x10/0x10
[    6.526998]  ___sys_sendmsg+0xfc/0x170
[    6.527000]  ? __pfx____sys_sendmsg+0x10/0x10
[    6.527002]  ? __pfx_do_wp_page+0x10/0x10
[    6.527008]  __sys_sendmsg+0xf4/0x180
[    6.527010]  ? __pfx___sys_sendmsg+0x10/0x10
[    6.527013]  ? do_user_addr_fault+0x3b5/0x750
[    6.527015]  do_syscall_64+0xc3/0x6e0
[    6.527017]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[    6.527020] RIP: 0033:0x424304
[    6.527025] Code: c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 00 f3 0f 1e fa 80 3d 5d 1d 09 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55
[    6.527027] RSP: 002b:00007ffcc8012368 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
[    6.527033] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424304
[    6.527034] RDX: 0000000000000000 RSI: 00007ffcc80123a0 RDI: 0000000000000003
[    6.527035] RBP: 00007ffcc80123e0 R08: 0000000000000000 R09: 0000000000000002
[    6.527037] R10: 0000000020797380 R11: 0000000000000202 R12: 00007ffcc80175c8
[    6.527038] R13: 00007ffcc80175d8 R14: 00000000004b0828 R15: 0000000000000001
[    6.527040]  </TASK>
[    6.527041]
[    6.537631] Allocated by task 131:
[    6.537736]  kasan_save_stack+0x33/0x60
[    6.537853]  kasan_save_track+0x14/0x30
[    6.537970]  __kasan_slab_alloc+0x6e/0x70
[    6.538094]  kmem_cache_alloc_noprof+0x134/0x440
[    6.538248]  __nf_conntrack_alloc+0xa8/0x2b0
[    6.538391]  ctnetlink_create_conntrack+0xa1/0x900
[    6.538547]  ctnetlink_new_conntrack+0x3cf/0x7d0
[    6.538687]  nfnetlink_rcv_msg+0x48e/0x510
[    6.538810]  netlink_rcv_skb+0xc9/0x1f0
[    6.538926]  nfnetlink_rcv+0xdb/0x220
[    6.539036]  netlink_unicast+0x3ec/0x590
[    6.539155]  netlink_sendmsg+0x397/0x690
[    6.539285]  ____sys_sendmsg+0x538/0x550
[    6.539418]  ___sys_sendmsg+0xfc/0x170
[    6.539545]  __sys_sendmsg+0xf4/0x180
[    6.539658]  do_syscall_64+0xc3/0x6e0
[    6.539769]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[    6.539916]
[    6.539967] Freed by task 0:
[    6.540053]  kasan_save_stack+0x33/0x60
[    6.540165]  kasan_save_track+0x14/0x30
[    6.540281]  kasan_save_free_info+0x3b/0x60
[    6.540406]  __kasan_slab_free+0x43/0x70
[    6.540523]  slab_free_after_rcu_debug+0xad/0x1e0
[    6.540664]  rcu_core+0x5c3/0x9c0
[    6.540769]  handle_softirqs+0x148/0x460
[    6.540892]  __irq_exit_rcu+0x97/0xf0
[    6.541004]  sysvec_apic_timer_interrupt+0x71/0x90
[    6.541149]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[    6.541304]
[    6.541355] Last potentially related work creation:
[    6.541498]  kasan_save_stack+0x33/0x60
[    6.541614]  kasan_record_aux_stack+0x8c/0xa0
[    6.541746]  kmem_cache_free+0x1f5/0x440
[    6.541865]  nf_conntrack_free+0xc1/0x140
[    6.541985]  ctnetlink_del_conntrack+0x4c4/0x520
[    6.542126]  nfnetlink_rcv_msg+0x48e/0x510
[    6.542249]  netlink_rcv_skb+0xc9/0x1f0
[    6.542365]  nfnetlink_rcv+0xdb/0x220
[    6.542475]  netlink_unicast+0x3ec/0x590
[    6.542593]  netlink_sendmsg+0x397/0x690
[    6.542711]  ____sys_sendmsg+0x538/0x550
[    6.542830]  ___sys_sendmsg+0xfc/0x170
[    6.542940]  __sys_sendmsg+0xf4/0x180
[    6.543049]  do_syscall_64+0xc3/0x6e0
[    6.543157]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[    6.543301]
[    6.543349] The buggy address belongs to the object at ffff8881042a8c80
[    6.543349]  which belongs to the cache nf_conntrack of size 248
[    6.543739] The buggy address is located 50 bytes inside of
[    6.543739]  freed 248-byte region [ffff8881042a8c80, ffff8881042a8d78)
[    6.544101]
[    6.544152] The buggy address belongs to the physical page:
[    6.544316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8881042a8500 pfn:0x1042a8
[    6.544584] flags: 0x200000000000200(workingset|node=0|zone=2)
[    6.544759] page_type: f5(slab)
[    6.544859] raw: 0200000000000200 ffff88810485d500 ffff88810485fd10 ffff88810485fd10
[    6.545083] raw: ffff8881042a8500 00000008000c0004 00000000f5000000 0000000000000000
[    6.545308] page dumped because: kasan: bad access detected
[    6.545469]
[    6.545521] Memory state around the buggy address:
[    6.545664]  ffff8881042a8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    6.545878]  ffff8881042a8c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    6.546089] >ffff8881042a8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    6.546300]                                      ^
[    6.546442]  ffff8881042a8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[    6.546654]  ffff8881042a8d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Fixes: c1d10adb4a52 ("[NETFILTER]: Add ctnetlink port for nf_conntrack")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/netfilter/nf_conntrack_netlink.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c9d725fc2d71..3225d4e98513 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3300,6 +3300,7 @@ static int ctnetlink_get_expect(struct sk_buff *skb,
 {
 	u_int8_t u3 = info->nfmsg->nfgen_family;
 	struct nf_conntrack_tuple tuple;
+	struct nf_conn *master;
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_zone zone;
 	struct sk_buff *skb2;
@@ -3354,10 +3355,19 @@ static int ctnetlink_get_expect(struct sk_buff *skb,
 	}
 
 	rcu_read_lock();
+	master = exp->master;
+	if (!refcount_inc_not_zero(&master->ct_general.use)) {
+		rcu_read_unlock();
+		nf_ct_expect_put(exp);
+		kfree_skb(skb2);
+		return -ENOENT;
+	}
+
 	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,
 				      info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
 				      exp);
 	rcu_read_unlock();
+	nf_ct_put(master);
 	nf_ct_expect_put(exp);
 	if (err <= 0) {
 		kfree_skb(skb2);
-- 
2.43.0