[{"id":1764495,"web_url":"http://patchwork.ozlabs.org/comment/1764495/","msgid":"<20170906.212419.1982531430917223449.davem@davemloft.net>","list_archive_url":null,"date":"2017-09-07T04:24:19","subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","submitter":{"id":15,"url":"http://patchwork.ozlabs.org/api/people/15/","name":"David Miller","email":"davem@davemloft.net"},"content":"From: Xin Long \nDate: Wed, 6 Sep 2017 11:47:12 +0800\n\n> ChunYu found a netlink use-after-free issue by syzkaller:\n> \n> [28448.842981] BUG: KASAN: use-after-free in __nla_put+0x37/0x40 at addr ffff8807185e2378\n> [28448.969918] Call Trace:\n> [...]\n> [28449.117207] __nla_put+0x37/0x40\n> [28449.132027] nla_put+0xf5/0x130\n> [28449.146261] sk_diag_fill.isra.4.constprop.5+0x5a0/0x750 [netlink_diag]\n> [28449.176608] __netlink_diag_dump+0x25a/0x700 [netlink_diag]\n> [28449.202215] netlink_diag_dump+0x176/0x240 [netlink_diag]\n> [28449.226834] netlink_dump+0x488/0xbb0\n> [28449.298014] __netlink_dump_start+0x4e8/0x760\n> [28449.317924] netlink_diag_handler_dump+0x261/0x340 [netlink_diag]\n> [28449.413414] sock_diag_rcv_msg+0x207/0x390\n> [28449.432409] netlink_rcv_skb+0x149/0x380\n> [28449.467647] sock_diag_rcv+0x2d/0x40\n> [28449.484362] netlink_unicast+0x562/0x7b0\n> [28449.564790] netlink_sendmsg+0xaa8/0xe60\n> [28449.661510] sock_sendmsg+0xcf/0x110\n> [28449.865631] __sys_sendmsg+0xf3/0x240\n> [28450.000964] SyS_sendmsg+0x32/0x50\n> [28450.016969] do_syscall_64+0x25c/0x6c0\n> [28450.154439] entry_SYSCALL64_slow_path+0x25/0x25\n> \n> It was caused by no protection between nlk groups' free in netlink_release\n> and nlk groups' accessing in sk_diag_dump_groups. The similar issue also\n> exists in netlink_seq_show().\n> \n> This patch is to defer nlk groups' free in deferred_put_nlk_sk.\n> \n> Reported-by: ChunYu Wang \n> Acked-by: Florian Westphal \n> Signed-off-by: Xin Long \n\nApplied.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xnnQw0sXJz9sCZ\n\tfor ;\n\tThu, 7 Sep 2017 14:24:24 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1752200AbdIGEYW (ORCPT );\n\tThu, 7 Sep 2017 00:24:22 -0400","from shards.monkeyblade.net ([184.105.139.130]:46644 \"EHLO\n\tshards.monkeyblade.net\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1750742AbdIGEYV (ORCPT\n\t); Thu, 7 Sep 2017 00:24:21 -0400","from localhost (74-93-104-98-Washington.hfc.comcastbusiness.net\n\t[74.93.104.98]) (using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(Client did not present a certificate)\n\t(Authenticated sender: davem-davemloft)\n\tby shards.monkeyblade.net (Postfix) with ESMTPSA id 125221019A4F1;\n\tWed, 6 Sep 2017 21:24:20 -0700 (PDT)"],"Date":"Wed, 06 Sep 2017 21:24:19 -0700 (PDT)","Message-Id":"<20170906.212419.1982531430917223449.davem@davemloft.net>","To":"lucien.xin@gmail.com","Cc":"netdev@vger.kernel.org, fw@strlen.de, chunwang@redhat.com,\n\tsyzkaller@googlegroups.com","Subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","From":"David Miller ","In-Reply-To":"<1217baf9faf9d034ba8224cb6362b822c51a0eae.1504669632.git.lucien.xin@gmail.com>","References":"<1217baf9faf9d034ba8224cb6362b822c51a0eae.1504669632.git.lucien.xin@gmail.com>","X-Mailer":"Mew version 6.7 on Emacs 25.2 / Mule 6.0 (HANACHIRUSATO)","Mime-Version":"1.0","Content-Type":"Text/Plain; charset=us-ascii","Content-Transfer-Encoding":"7bit","X-Greylist":"Sender succeeded SMTP AUTH, not delayed by\n\tmilter-greylist-4.5.12 (shards.monkeyblade.net\n\t[149.20.54.216]); Wed, 06 Sep 2017 21:24:20 -0700 (PDT)","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}},{"id":1765631,"web_url":"http://patchwork.ozlabs.org/comment/1765631/","msgid":"","list_archive_url":null,"date":"2017-09-08T21:56:36","subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","submitter":{"id":211,"url":"http://patchwork.ozlabs.org/api/people/211/","name":"Cong Wang","email":"xiyou.wangcong@gmail.com"},"content":"On Tue, Sep 5, 2017 at 8:47 PM, Xin Long wrote:\n> ChunYu found a netlink use-after-free issue by syzkaller:\n>\n> [28448.842981] BUG: KASAN: use-after-free in __nla_put+0x37/0x40 at addr ffff8807185e2378\n> [28448.969918] Call Trace:\n> [...]\n> [28449.117207] __nla_put+0x37/0x40\n> [28449.132027] nla_put+0xf5/0x130\n> [28449.146261] sk_diag_fill.isra.4.constprop.5+0x5a0/0x750 [netlink_diag]\n> [28449.176608] __netlink_diag_dump+0x25a/0x700 [netlink_diag]\n> [28449.202215] netlink_diag_dump+0x176/0x240 [netlink_diag]\n> [28449.226834] netlink_dump+0x488/0xbb0\n> [28449.298014] __netlink_dump_start+0x4e8/0x760\n> [28449.317924] netlink_diag_handler_dump+0x261/0x340 [netlink_diag]\n> [28449.413414] sock_diag_rcv_msg+0x207/0x390\n> [28449.432409] netlink_rcv_skb+0x149/0x380\n> [28449.467647] sock_diag_rcv+0x2d/0x40\n> [28449.484362] netlink_unicast+0x562/0x7b0\n> [28449.564790] netlink_sendmsg+0xaa8/0xe60\n> [28449.661510] sock_sendmsg+0xcf/0x110\n> [28449.865631] __sys_sendmsg+0xf3/0x240\n> [28450.000964] SyS_sendmsg+0x32/0x50\n> [28450.016969] do_syscall_64+0x25c/0x6c0\n> [28450.154439] entry_SYSCALL64_slow_path+0x25/0x25\n>\n> It was caused by no protection between nlk groups' free in netlink_release\n> and nlk groups' accessing in sk_diag_dump_groups. The similar issue also\n> exists in netlink_seq_show().\n>\n> This patch is to defer nlk groups' free in deferred_put_nlk_sk.\n\nThis looks odd too, at least not complete.\n\nThe netlink sock itself is protected by RCU to speed up\nthe lookup path, but not necessarily nlk->groups, at least\nI don't see rcu_dereference() in sk_diag_dump_groups().\nAnd netlink_realloc_groups() needs fix too, right? Otherwise\nkrealloc() could reallocate a brand new memory and\nexisting readers will crash too?\n\nI am afraid you need more work to make nlk->groups\nRCU friendly. RCU is not just about call_rcu(), both\nreaders and writers need to use proper RCU API.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"I+o0Ejy+\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xprl34r6Zz9sRV\n\tfor ;\n\tSat, 9 Sep 2017 07:57:03 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1757307AbdIHV5A (ORCPT );\n\tFri, 8 Sep 2017 17:57:00 -0400","from mail-pf0-f195.google.com ([209.85.192.195]:36814 \"EHLO\n\tmail-pf0-f195.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1757303AbdIHV45 (ORCPT\n\t); Fri, 8 Sep 2017 17:56:57 -0400","by mail-pf0-f195.google.com with SMTP id f84so1986407pfj.3\n\tfor ; Fri, 08 Sep 2017 14:56:57 -0700 (PDT)","by 10.100.140.134 with HTTP; Fri, 8 Sep 2017 14:56:36 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=mime-version:in-reply-to:references:from:date:message-id:subject:to\n\t:cc; bh=y71iKEI1/FRuxIqQMIJE3z08v8/xZDKUueh2obXq000=;\n\tb=I+o0Ejy+eoh3nphFMNGA8TGN6lhzksE5+u9+yl/IjQmptEOYsEEV5IzKWdLq68AkeN\n\t+h3QA/rR6Uw3TylVPioUdN9WSwXDlBfCDQKT8NGalgmWZwpou2hcMqRLOQYGto65ksxb\n\t2oyzx5gVEQGtV5SfXL09TI404SOmpTgjvIvitgsemQZ8xekU5qPYeSvtj+KpwTNdRbv0\n\tc2SxAtEO3JKvJ4hiRttwQL4LK1GFv51IH4AqL6fa98Xz5GEcsAsDsor3n2pJZmZ3lw6U\n\tjWn33o4m4uXNH7pHRhF5hYB1Gj8HTF6FCVV8XC/nK+bHuhYtwvx4kPsFhdZNdOqxE1la\n\tTt7A==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:in-reply-to:references:from:date\n\t:message-id:subject:to:cc;\n\tbh=y71iKEI1/FRuxIqQMIJE3z08v8/xZDKUueh2obXq000=;\n\tb=SGSf0bkT+hY6xWTJrWkeI4HL0UqdzuowrJQ4IK2Hbhi34QnZk4/hETiavGvK/esVJB\n\tUa5PxnFHna2IVSIR86MVtephe9OEhRRsx6zR6TDFFIerco7oMDRqqGrMqtocubsIP33D\n\tgqxd6mQecElf/kSgW3tdKvPELJqDqoBFkceDDRzvKC31Wt2H17ABY50gJiOAxFpou9Za\n\t0x1vXbzDhBt9dozMJyKDF7RixMukK1Rw3rQ8QdBdjtTooDw/8LptltLcU8MookUkStZD\n\tbtawq9iQ3bdf2Nr7RMAlQ1/3X49J45aI3PveltMjVJ9Ui4fSU8ppMlF4UYEjHJcY4F0b\n\tTCfA==","X-Gm-Message-State":"AHPjjUg0Fokh+4O+uGjhSBvqb9XB+9FqT93rDVD8kTsarIjVhvUKoqmm\n\tOUCopxGZSfQ6y6Tk53bZsUsxtOqPlQ==","X-Google-Smtp-Source":"ADKCNb7/k4a5+Gdtx0xh9TYTKOj5H+YRCHrue2OfnyPuVe3F/lRdp0acnJLBEkXgh74wE/v46lULXGtc32LT1YULStg=","X-Received":"by 10.84.253.1 with SMTP id z1mr4942836pll.210.1504907817427;\n\tFri, 08 Sep 2017 14:56:57 -0700 (PDT)","MIME-Version":"1.0","In-Reply-To":"<1217baf9faf9d034ba8224cb6362b822c51a0eae.1504669632.git.lucien.xin@gmail.com>","References":"<1217baf9faf9d034ba8224cb6362b822c51a0eae.1504669632.git.lucien.xin@gmail.com>","From":"Cong Wang ","Date":"Fri, 8 Sep 2017 14:56:36 -0700","Message-ID":"","Subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","To":"Xin Long ","Cc":"network dev , David Miller ,\n\tFlorian Westphal , chunwang@redhat.com,\n\tsyzkaller ","Content-Type":"text/plain; charset=\"UTF-8\"","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}},{"id":1765938,"web_url":"http://patchwork.ozlabs.org/comment/1765938/","msgid":"","list_archive_url":null,"date":"2017-09-10T12:02:14","subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","submitter":{"id":61073,"url":"http://patchwork.ozlabs.org/api/people/61073/","name":"Xin Long","email":"lucien.xin@gmail.com"},"content":"On Sat, Sep 9, 2017 at 9:56 AM, Cong Wang wrote:\n> On Tue, Sep 5, 2017 at 8:47 PM, Xin Long wrote:\n>> ChunYu found a netlink use-after-free issue by syzkaller:\n>>\n>> [28448.842981] BUG: KASAN: use-after-free in __nla_put+0x37/0x40 at addr ffff8807185e2378\n>> [28448.969918] Call Trace:\n>> [...]\n>> [28449.117207] __nla_put+0x37/0x40\n>> [28449.132027] nla_put+0xf5/0x130\n>> [28449.146261] sk_diag_fill.isra.4.constprop.5+0x5a0/0x750 [netlink_diag]\n>> [28449.176608] __netlink_diag_dump+0x25a/0x700 [netlink_diag]\n>> [28449.202215] netlink_diag_dump+0x176/0x240 [netlink_diag]\n>> [28449.226834] netlink_dump+0x488/0xbb0\n>> [28449.298014] __netlink_dump_start+0x4e8/0x760\n>> [28449.317924] netlink_diag_handler_dump+0x261/0x340 [netlink_diag]\n>> [28449.413414] sock_diag_rcv_msg+0x207/0x390\n>> [28449.432409] netlink_rcv_skb+0x149/0x380\n>> [28449.467647] sock_diag_rcv+0x2d/0x40\n>> [28449.484362] netlink_unicast+0x562/0x7b0\n>> [28449.564790] netlink_sendmsg+0xaa8/0xe60\n>> [28449.661510] sock_sendmsg+0xcf/0x110\n>> [28449.865631] __sys_sendmsg+0xf3/0x240\n>> [28450.000964] SyS_sendmsg+0x32/0x50\n>> [28450.016969] do_syscall_64+0x25c/0x6c0\n>> [28450.154439] entry_SYSCALL64_slow_path+0x25/0x25\n>>\n>> It was caused by no protection between nlk groups' free in netlink_release\n>> and nlk groups' accessing in sk_diag_dump_groups. The similar issue also\n>> exists in netlink_seq_show().\n>>\n>> This patch is to defer nlk groups' free in deferred_put_nlk_sk.\n>\n> This looks odd too, at least not complete.\n>\n> The netlink sock itself is protected by RCU to speed up\n> the lookup path, but not necessarily nlk->groups, at least\n> I don't see rcu_dereference() in sk_diag_dump_groups().\n> And netlink_realloc_groups() needs fix too, right? Otherwise\n> krealloc() could reallocate a brand new memory and\n> existing readers will crash too?\nWe knew it's not good, but this one is not so bad as the one in\nnetlink_release, as krealloc will not alloc new memory when\nthe new size < old size, so it may not cause crash.\n\nI was planning to fix it as a long term. As you also said, here needs\nmore work for nlk->groups, including proper RCU api for readers.\nI will check more.\n\nThanks.\n\n>\n> I am afraid you need more work to make nlk->groups\n> RCU friendly. RCU is not just about call_rcu(), both\n> readers and writers need to use proper RCU API.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"eGQcDD+j\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xqqRz1tvCz9sNw\n\tfor ;\n\tSun, 10 Sep 2017 22:02:23 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751497AbdIJMCS (ORCPT );\n\tSun, 10 Sep 2017 08:02:18 -0400","from mail-qt0-f195.google.com ([209.85.216.195]:35539 \"EHLO\n\tmail-qt0-f195.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751472AbdIJMCQ (ORCPT\n\t); Sun, 10 Sep 2017 08:02:16 -0400","by mail-qt0-f195.google.com with SMTP id l25so1208587qtf.2\n\tfor ; Sun, 10 Sep 2017 05:02:15 -0700 (PDT)","by 10.140.108.100 with HTTP; Sun, 10 Sep 2017 05:02:14 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=mime-version:in-reply-to:references:from:date:message-id:subject:to\n\t:cc; bh=oV8X8Z/6ff5p+SeulT6Kz/tLc1Ye1I7C8W9kG1O4sEQ=;\n\tb=eGQcDD+jHEShvmx+umm5heRrNegyBjzwdNuMF9loGtcdCUw4RgBciJiuSWaTkZi5QR\n\tQk3DJUTmO6SPAP5krqpPOY3wd6lLeK3COI9OLxtaQItVx9ujZdyzMrD+6/g1oGq9POhg\n\tWdoASjZCcYbtcokPjqgU89oP2UlAtIHCDKjp2mrq+FqF8u+cabEL+Hq8wgcKjPj2d8Ei\n\tPPEMO9w0oSgmqj00QP7B7j3aAX/miXphzfEE+69friwXMww1qPM7nfCpF3a3KG1Qg+OA\n\tbhZ5ymbhcLMsVR/3zeIeRrcfjGFJlXIwVpsrgaADRtk8dXolONWLjPhYrupfPIk2Pz2S\n\tS6cw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:in-reply-to:references:from:date\n\t:message-id:subject:to:cc;\n\tbh=oV8X8Z/6ff5p+SeulT6Kz/tLc1Ye1I7C8W9kG1O4sEQ=;\n\tb=W57OoXMLfKBm66DeVq8nudk5kRNsnS4eVT9DGUy6sE9QPS6cL2kQk8ofrDGnF48uT/\n\tWJTQpvDqV503P/4dLUHiU3XJLzB/H5CQhcVu+IFYu0KDO/Kza4sMn3tnol4z7ffWKGvh\n\tiZHvRuqaW1nN4oK3GQKNVQ5YWmLQ4zAZuLrJ2mMcFtKlfsv0E+p7yp94oBEVMxwbFJ79\n\tBgOh5Jcj6MCEnn6wQPxZEKqD3Zrca+hDj4o6qG+KZpgh44pYlx9LdggNGl2Ka5tdDzIg\n\t1aGFMaF3wM32WWjVIpGzbwC7R4kqzcyX0bnoyrHmpR5rRv43N+nN0kRZ2FPO/wMLFJiJ\n\t4nfg==","X-Gm-Message-State":"AHPjjUhwXmFpRK0tGY35HLrS1mwLjFsLBh6UnSWuMRuvZWytjMyLG36E\n\t81mGLmDp3hkYYYQ3/jWcrV4I22lPaA==","X-Google-Smtp-Source":"AOwi7QDGmhelgvhsSmiem8q/fwTN+FsGJERwTO0Tb3zVVI7hkY4xQPYm2a+sKzZx0rRU4YmB+gFR+2xysCoDerH0hWo=","X-Received":"by 10.200.15.210 with SMTP id f18mr12248939qtk.226.1505044935431;\n\tSun, 10 Sep 2017 05:02:15 -0700 (PDT)","MIME-Version":"1.0","In-Reply-To":"","References":"<1217baf9faf9d034ba8224cb6362b822c51a0eae.1504669632.git.lucien.xin@gmail.com>\n\t","From":"Xin Long ","Date":"Mon, 11 Sep 2017 00:02:14 +1200","Message-ID":"","Subject":"Re: [PATCH net] netlink: fix an use-after-free issue for nlk groups","To":"Cong Wang ","Cc":"network dev , David Miller ,\n\tFlorian Westphal , chunwang@redhat.com,\n\tsyzkaller ","Content-Type":"text/plain; charset=\"UTF-8\"","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}}]