| Message ID | 20200312054228.29688-1-xiyou.wangcong@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net_sched: hold rtnl lock in tcindex_partial_destroy_work() | expand |
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Wed, 11 Mar 2020 22:42:27 -0700 > syzbot reported a use-after-free in tcindex_dump(). This is due to > the lack of RTNL in the deferred rcu work. We queue this work with > RTNL in tcindex_change(), later, tcindex_dump() is called: > > fh = tp->ops->get(tp, t->tcm_handle); > ... > err = tp->ops->change(..., &fh, ...); > tfilter_notify(..., fh, ...); > > but there is nothing to serialize the pending > tcindex_partial_destroy_work() with tcindex_dump(). > > Fix this by simply holding RTNL in tcindex_partial_destroy_work(), > so that it won't be called until RTNL is released after > tc_new_tfilter() is completed. > > Reported-and-tested-by: syzbot+653090db2562495901dc@syzkaller.appspotmail.com > Fixes: 3d210534cc93 ("net_sched: fix a race condition in tcindex_destroy()") > Cc: Jamal Hadi Salim <jhs@mojatatu.com> > Cc: Jiri Pirko <jiri@resnulli.us> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable, thanks Cong.
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c index 09b7dc5fe7e0..f2cb24b6f0cf 100644 --- a/net/sched/cls_tcindex.c +++ b/net/sched/cls_tcindex.c @@ -261,8 +261,10 @@ static void tcindex_partial_destroy_work(struct work_struct *work) struct tcindex_data, rwork); + rtnl_lock(); kfree(p->perfect); kfree(p); + rtnl_unlock(); } static void tcindex_free_perfect_hash(struct tcindex_data *cp)
syzbot reported a use-after-free in tcindex_dump(). This is due to the lack of RTNL in the deferred rcu work. We queue this work with RTNL in tcindex_change(), later, tcindex_dump() is called: fh = tp->ops->get(tp, t->tcm_handle); ... err = tp->ops->change(..., &fh, ...); tfilter_notify(..., fh, ...); but there is nothing to serialize the pending tcindex_partial_destroy_work() with tcindex_dump(). Fix this by simply holding RTNL in tcindex_partial_destroy_work(), so that it won't be called until RTNL is released after tc_new_tfilter() is completed. Reported-and-tested-by: syzbot+653090db2562495901dc@syzkaller.appspotmail.com Fixes: 3d210534cc93 ("net_sched: fix a race condition in tcindex_destroy()") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> --- net/sched/cls_tcindex.c | 2 ++ 1 file changed, 2 insertions(+)