From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Hulk Robot <hulkci@huawei.com>,
Julian Anastasov <ja@ssi.bg>, YueHaibing <yuehaibing@huawei.com>,
Simon Horman <horms@verge.net.au>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 13/45] ipvs: Fix use-after-free in ip_vs_in
Date: Thu, 20 Jun 2019 19:57:15 +0200 [thread overview]
Message-ID: <20190620174334.116954726@linuxfoundation.org> (raw)
In-Reply-To: <20190620174328.608036501@linuxfoundation.org>
[ Upstream commit 719c7d563c17b150877cee03a4b812a424989dfa ]
BUG: KASAN: use-after-free in ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
Read of size 4 at addr ffff8881e9b26e2c by task sshd/5603
CPU: 0 PID: 5603 Comm: sshd Not tainted 4.19.39+ #30
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
Call Trace:
dump_stack+0x71/0xab
print_address_description+0x6a/0x270
kasan_report+0x179/0x2c0
ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
ip_vs_in+0xd8/0x170 [ip_vs]
nf_hook_slow+0x5f/0xe0
__ip_local_out+0x1d5/0x250
ip_local_out+0x19/0x60
__tcp_transmit_skb+0xba1/0x14f0
tcp_write_xmit+0x41f/0x1ed0
? _copy_from_iter_full+0xca/0x340
__tcp_push_pending_frames+0x52/0x140
tcp_sendmsg_locked+0x787/0x1600
? tcp_sendpage+0x60/0x60
? inet_sk_set_state+0xb0/0xb0
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x6d/0x80
sock_write_iter+0x121/0x1c0
? sock_sendmsg+0x80/0x80
__vfs_write+0x23e/0x370
vfs_write+0xe7/0x230
ksys_write+0xa1/0x120
? __ia32_sys_read+0x50/0x50
? __audit_syscall_exit+0x3ce/0x450
do_syscall_64+0x73/0x200
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff6f6147c60
Code: 73 01 c3 48 8b 0d 28 12 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 5d 73 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83
RSP: 002b:00007ffd772ead18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007ff6f6147c60
RDX: 0000000000000034 RSI: 000055df30a31270 RDI: 0000000000000003
RBP: 000055df30a31270 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffd772ead70 R11: 0000000000000246 R12: 00007ffd772ead74
R13: 00007ffd772eae20 R14: 00007ffd772eae24 R15: 000055df2f12ddc0
Allocated by task 6052:
kasan_kmalloc+0xa0/0xd0
__kmalloc+0x10a/0x220
ops_init+0x97/0x190
register_pernet_operations+0x1ac/0x360
register_pernet_subsys+0x24/0x40
0xffffffffc0ea016d
do_one_initcall+0x8b/0x253
do_init_module+0xe3/0x335
load_module+0x2fc0/0x3890
__do_sys_finit_module+0x192/0x1c0
do_syscall_64+0x73/0x200
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 6067:
__kasan_slab_free+0x130/0x180
kfree+0x90/0x1a0
ops_free_list.part.7+0xa6/0xc0
unregister_pernet_operations+0x18b/0x1f0
unregister_pernet_subsys+0x1d/0x30
ip_vs_cleanup+0x1d/0xd2f [ip_vs]
__x64_sys_delete_module+0x20c/0x300
do_syscall_64+0x73/0x200
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881e9b26600 which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 2092 bytes inside of 4096-byte region [ffff8881e9b26600, ffff8881e9b27600)
The buggy address belongs to the page:
page:ffffea0007a6c800 count:1 mapcount:0 mapping:ffff888107c0e600 index:0x0 compound_mapcount: 0
flags: 0x17ffffc0008100(slab|head)
raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888107c0e600
raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
while unregistering ipvs module, ops_free_list calls
__ip_vs_cleanup, then nf_unregister_net_hooks be called to
do remove nf hook entries. It need a RCU period to finish,
however net->ipvs is set to NULL immediately, which will
trigger NULL pointer dereference when a packet is hooked
and handled by ip_vs_in where net->ipvs is dereferenced.
Another scene is ops_free_list call ops_free to free the
net_generic directly while __ip_vs_cleanup finished, then
calling ip_vs_in will triggers use-after-free.
This patch moves nf_unregister_net_hooks from __ip_vs_cleanup()
to __ip_vs_dev_cleanup(), where rcu_barrier() is called by
unregister_pernet_device -> unregister_pernet_operations,
that will do the needed grace period.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: efe41606184e ("ipvs: convert to use pernet nf_hook api")
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d1c0378144f3..ee97ce176b9a 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -2268,7 +2268,6 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
- nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
ip_vs_service_net_cleanup(ipvs); /* ip_vs_flush() with locks */
ip_vs_conn_net_cleanup(ipvs);
ip_vs_app_net_cleanup(ipvs);
@@ -2283,6 +2282,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
EnterFunction(2);
+ nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
ipvs->enable = 0; /* Disable packet reception */
smp_wmb();
ip_vs_sync_net_cleanup(ipvs);
--
2.20.1
next prev parent reply other threads:[~2019-06-20 18:24 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-20 17:57 [PATCH 4.14 00/45] 4.14.129-stable review Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 01/45] perf machine: Guard against NULL in machine__exit() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 02/45] ax25: fix inconsistent lock state in ax25_destroy_timer Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 03/45] be2net: Fix number of Rx queues used for flow hashing Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 04/45] ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 05/45] lapb: fixed leak of control-blocks Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 06/45] neigh: fix use-after-free read in pneigh_get_next Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 07/45] net: openvswitch: do not free vport if register_netdevice() is failed Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 08/45] sctp: Free cookie before we memdup a new one Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 09/45] sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 10/45] Staging: vc04_services: Fix a couple error codes Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 11/45] perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 12/45] netfilter: nf_queue: fix reinject verdict handling Greg Kroah-Hartman
2019-06-20 17:57 ` Greg Kroah-Hartman [this message]
2019-06-20 17:57 ` [PATCH 4.14 14/45] selftests: netfilter: missing error check when setting up veth interface Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 15/45] clk: ti: clkctrl: Fix clkdm_clk handling Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 16/45] powerpc/powernv: Return for invalid IMC domain Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 17/45] mISDN: make sure device name is NUL terminated Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 18/45] x86/CPU/AMD: Dont force the CPB cap when running under a hypervisor Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 19/45] perf/ring_buffer: Fix exposing a temporarily decreased data_head Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 20/45] perf/ring_buffer: Add ordering to rb->nest increment Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 21/45] perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page data Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 22/45] gpio: fix gpio-adp5588 build errors Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 23/45] net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 24/45] net: aquantia: fix LRO with FCS error Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 25/45] i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 26/45] ALSA: hda - Force polling mode on CNL for fixing codec communication Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 27/45] configfs: Fix use-after-free when accessing sd->s_dentry Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 28/45] perf data: Fix strncat may truncate build failure with recent gcc Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 29/45] perf record: Fix s390 missing module symbol and warning for non-root users Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 30/45] ia64: fix build errors by exporting paddr_to_nid() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 31/45] KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 32/45] KVM: PPC: Book3S HV: Dont take kvm->lock around kvm_for_each_vcpu Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 33/45] net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 34/45] net: phy: dp83867: Set up RGMII TX delay Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 35/45] scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 36/45] scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 37/45] scsi: scsi_dh_alua: Fix possible null-ptr-deref Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 38/45] scsi: libsas: delete sas port if expander discover failed Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 39/45] mlxsw: spectrum: Prevent force of 56G Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 40/45] HID: wacom: Dont set tool type until were in range Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 41/45] HID: wacom: Dont report anything prior to the tool entering range Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 42/45] HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 43/45] coredump: fix race condition between collapse_huge_page() and core dumping Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 44/45] infiniband: fix race condition between infiniband mlx4, mlx5 driver " Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 45/45] Abort file_remove_privs() for non-reg. files Greg Kroah-Hartman
2019-06-20 21:51 ` [PATCH 4.14 00/45] 4.14.129-stable review kernelci.org bot
2019-06-21 3:49 ` Naresh Kamboju
2019-06-22 0:44 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190620174334.116954726@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=horms@verge.net.au \
--cc=hulkci@huawei.com \
--cc=ja@ssi.bg \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=yuehaibing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).