mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2024-12-29 17:23:36 +00:00
031ae72825
syzbot found an use-after-free Read in ila_nf_input [1]
Issue here is that ila_xlat_exit_net() frees the rhashtable,
then call nf_unregister_net_hooks().
It should be done in the reverse way, with a synchronize_rcu().
This is a good match for a pre_exit() method.
[1]
BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
rht_key_hashfn include/linux/rhashtable.h:159 [inline]
__rhashtable_lookup include/linux/rhashtable.h:604 [inline]
rhashtable_lookup include/linux/rhashtable.h:646 [inline]
rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]
ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:269 [inline]
NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312
__netif_receive_skb_one_core net/core/dev.c:5661 [inline]
__netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775
process_backlog+0x662/0x15b0 net/core/dev.c:6108
__napi_poll+0xcb/0x490 net/core/dev.c:6772
napi_poll net/core/dev.c:6841 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:6963
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xbfffffff(buddy)
raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000
raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493
prep_new_page mm/page_alloc.c:1501 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103
__kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130
__do_kmalloc_node mm/slub.c:4146 [inline]
__kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164
__kvmalloc_node_noprof+0x72/0x190 mm/util.c:650
bucket_table_alloc lib/rhashtable.c:186 [inline]
rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071
ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613
ops_init+0x359/0x610 net/core/net_namespace.c:139
setup_net+0x515/0xca0 net/core/net_namespace.c:343
copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508
create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228
ksys_unshare+0x619/0xc10 kernel/fork.c:3328
__do_sys_unshare kernel/fork.c:3399 [inline]
__se_sys_unshare kernel/fork.c:3397 [inline]
__x64_sys_unshare+0x38/0x40 kernel/fork.c:3397
page last free pid 11846 tgid 11846 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1094 [inline]
free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612
__folio_put+0x2c8/0x440 mm/swap.c:128
folio_put include/linux/mm.h:1486 [inline]
free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565
kfree+0x1c4/0x360 mm/slub.c:4588
rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169
ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
ops_exit_list net/core/net_namespace.c:173 [inline]
cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Fixes: 7f00feaf10
("ila: Add generic ILA translation facility")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20240904144418.1162839-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
130 lines
2.8 KiB
C
130 lines
2.8 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <net/genetlink.h>
|
|
#include <net/netns/generic.h>
|
|
#include <uapi/linux/genetlink.h>
|
|
#include "ila.h"
|
|
|
|
static const struct nla_policy ila_nl_policy[ILA_ATTR_MAX + 1] = {
|
|
[ILA_ATTR_LOCATOR] = { .type = NLA_U64, },
|
|
[ILA_ATTR_LOCATOR_MATCH] = { .type = NLA_U64, },
|
|
[ILA_ATTR_IFINDEX] = { .type = NLA_U32, },
|
|
[ILA_ATTR_CSUM_MODE] = { .type = NLA_U8, },
|
|
[ILA_ATTR_IDENT_TYPE] = { .type = NLA_U8, },
|
|
};
|
|
|
|
static const struct genl_ops ila_nl_ops[] = {
|
|
{
|
|
.cmd = ILA_CMD_ADD,
|
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
|
.doit = ila_xlat_nl_cmd_add_mapping,
|
|
.flags = GENL_ADMIN_PERM,
|
|
},
|
|
{
|
|
.cmd = ILA_CMD_DEL,
|
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
|
.doit = ila_xlat_nl_cmd_del_mapping,
|
|
.flags = GENL_ADMIN_PERM,
|
|
},
|
|
{
|
|
.cmd = ILA_CMD_FLUSH,
|
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
|
.doit = ila_xlat_nl_cmd_flush,
|
|
.flags = GENL_ADMIN_PERM,
|
|
},
|
|
{
|
|
.cmd = ILA_CMD_GET,
|
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
|
.doit = ila_xlat_nl_cmd_get_mapping,
|
|
.start = ila_xlat_nl_dump_start,
|
|
.dumpit = ila_xlat_nl_dump,
|
|
.done = ila_xlat_nl_dump_done,
|
|
},
|
|
};
|
|
|
|
unsigned int ila_net_id;
|
|
|
|
struct genl_family ila_nl_family __ro_after_init = {
|
|
.hdrsize = 0,
|
|
.name = ILA_GENL_NAME,
|
|
.version = ILA_GENL_VERSION,
|
|
.maxattr = ILA_ATTR_MAX,
|
|
.policy = ila_nl_policy,
|
|
.netnsok = true,
|
|
.parallel_ops = true,
|
|
.module = THIS_MODULE,
|
|
.ops = ila_nl_ops,
|
|
.n_ops = ARRAY_SIZE(ila_nl_ops),
|
|
.resv_start_op = ILA_CMD_FLUSH + 1,
|
|
};
|
|
|
|
static __net_init int ila_init_net(struct net *net)
|
|
{
|
|
int err;
|
|
|
|
err = ila_xlat_init_net(net);
|
|
if (err)
|
|
goto ila_xlat_init_fail;
|
|
|
|
return 0;
|
|
|
|
ila_xlat_init_fail:
|
|
return err;
|
|
}
|
|
|
|
static __net_exit void ila_pre_exit_net(struct net *net)
|
|
{
|
|
ila_xlat_pre_exit_net(net);
|
|
}
|
|
|
|
static __net_exit void ila_exit_net(struct net *net)
|
|
{
|
|
ila_xlat_exit_net(net);
|
|
}
|
|
|
|
static struct pernet_operations ila_net_ops = {
|
|
.init = ila_init_net,
|
|
.pre_exit = ila_pre_exit_net,
|
|
.exit = ila_exit_net,
|
|
.id = &ila_net_id,
|
|
.size = sizeof(struct ila_net),
|
|
};
|
|
|
|
static int __init ila_init(void)
|
|
{
|
|
int ret;
|
|
|
|
ret = register_pernet_device(&ila_net_ops);
|
|
if (ret)
|
|
goto register_device_fail;
|
|
|
|
ret = genl_register_family(&ila_nl_family);
|
|
if (ret)
|
|
goto register_family_fail;
|
|
|
|
ret = ila_lwt_init();
|
|
if (ret)
|
|
goto fail_lwt;
|
|
|
|
return 0;
|
|
|
|
fail_lwt:
|
|
genl_unregister_family(&ila_nl_family);
|
|
register_family_fail:
|
|
unregister_pernet_device(&ila_net_ops);
|
|
register_device_fail:
|
|
return ret;
|
|
}
|
|
|
|
static void __exit ila_fini(void)
|
|
{
|
|
ila_lwt_fini();
|
|
genl_unregister_family(&ila_nl_family);
|
|
unregister_pernet_device(&ila_net_ops);
|
|
}
|
|
|
|
module_init(ila_init);
|
|
module_exit(ila_fini);
|
|
MODULE_AUTHOR("Tom Herbert <tom@herbertland.com>");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_DESCRIPTION("IPv6: Identifier Locator Addressing (ILA)");
|