Re: [PATCH] nvmet-tcp: Fix a possible UAF in queue intialization setup

[SeongJae Park <sj@kernel.org>]

On Wed, 4 Oct 2023 16:25:13 +0300 Sagi Grimberg <sagi@grimberg.me> wrote:

> 
> >>> Hello,
> >>>
> >>> On Mon, 2 Oct 2023 13:54:28 +0300 Sagi Grimberg <sagi@grimberg.me> wrote:
> >>>
> >>>>   From Alon:
> >>>> "Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel,
> >>>> a malicious user can cause a UAF and a double free, which may lead to
> >>>> RCE (may also lead to an LPE in case the attacker already has local
> >>>> privileges)."
> >>>>
> >>>> Hence, when a queue initialization fails after the ahash requests are
> >>>> allocated, it is guaranteed that the queue removal async work will be
> >>>> called, hence leave the deallocation to the queue removal.
> >>>>
> >>>> Also, be extra careful not to continue processing the socket, so set
> >>>> queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error.
> >>>>
> >>>> Reported-by: Alon Zahavi <zahavi.alon@gmail.com>
> >>>> Tested-by: Alon Zahavi <zahavi.alon@gmail.com>
> >>>> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
> >>>
> >>> Would it be better to add Fixes: and Cc: stable lines?
> >>
> >> This issue existed since the introduction of the driver, I am not sure
> >> it applies cleanly that far back...

Based on the rule[1], I think people who need this fix on the old kernel would
do that.  I'd just say adding Fixes: would help it, so better than nothing.

[1] https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

> >>
> >> I figured that the description and Reported-by tag will trigger stable
> >> kernel pick up...
> > 
> > <formletter>
> > 
> > This is not the correct way to submit patches for inclusion in the
> > stable kernel tree.  Please read:
> >      https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> > for how to do this properly.
> > 
> > </formletter>
> 
> I could have sworn to have seen patches that did not have stable CCd
> nor a Fixes tag and was picked up for stable kernels :)

I could also swear.  Stable kernel maintainers are great at finding fixes on
their own.  But I think adding those could help them avoiding any mistake, and
therefore better than nothing, again.

> But I guess those were either hallucinations or someone sending patches
> to stable...
> 
> I can resend with CC to stable.

Thank you :)


Thanks,
SJ

> 
> Thanks.
> 
>