diff mbox series

net: tun: Fix use-after-free in tun_detach()

Message ID	20221119075615.723290-1-syoshida@redhat.com
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: Shigeru Yoshida <syoshida@redhat.com> To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Shigeru Yoshida <syoshida@redhat.com> Subject: [PATCH] net: tun: Fix use-after-free in tun_detach() Date: Sat, 19 Nov 2022 16:56:15 +0900 Message-Id: <20221119075615.723290-1-syoshida@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	net: tun: Fix use-after-free in tun_detach() \| net: tun: Fix use-after-free in tun_detach()

Commit Message

Shigeru Yoshida Nov. 19, 2022, 7:56 a.m. UTC

  syzbot reported use-after-free in tun_detach() [1].  This causes call
trace like below:

==================================================================
BUG: KASAN: use-after-free in notifier_call_chain+0x1da/0x1e0
...
Call Trace:
 <TASK>
 dump_stack_lvl+0x100/0x178
 print_report+0x167/0x470
 ? __virt_addr_valid+0x5e/0x2d0
 ? __phys_addr+0xc6/0x140
 ? notifier_call_chain+0x1da/0x1e0
 ? notifier_call_chain+0x1da/0x1e0
 kasan_report+0xbf/0x1e0
 ? notifier_call_chain+0x1da/0x1e0
 notifier_call_chain+0x1da/0x1e0
 call_netdevice_notifiers_info+0x83/0x130
 netdev_run_todo+0xc33/0x11b0
 ? generic_xdp_install+0x490/0x490
 ? __tun_detach+0x1500/0x1500
 tun_chr_close+0xe2/0x190
 __fput+0x26a/0xa40
 task_work_run+0x14d/0x240
 ? task_work_cancel+0x30/0x30
 do_exit+0xb31/0x2a40
 ? reacquire_held_locks+0x4a0/0x4a0
 ? do_raw_spin_lock+0x12e/0x2b0
 ? mm_update_next_owner+0x7c0/0x7c0
 ? rwlock_bug.part.0+0x90/0x90
 ? lockdep_hardirqs_on_prepare+0x17f/0x410
 do_group_exit+0xd4/0x2a0
 __x64_sys_exit_group+0x3e/0x50
 do_syscall_64+0x38/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The cause of the issue is that sock_put() from __tun_detach() drops
last reference count for struct net, and then notifier_call_chain()
from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach()
after all necessary accesses for the struct net has done.

Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
 drivers/net/tun.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Eric Dumazet Nov. 19, 2022, 6:31 p.m. UTC | #1

On Fri, Nov 18, 2022 at 11:56 PM Shigeru Yoshida <syoshida@redhat.com> wrote:
>
> syzbot reported use-after-free in tun_detach() [1].  This causes call
> trace like below:
>
> ==================================================================
> BUG: KASAN: use-after-free in notifier_call_chain+0x1da/0x1e0
> ...
> Call Trace:

Please include a symbolic stack trace, I think syzbot has them.

>  <TASK>
>  dump_stack_lvl+0x100/0x178
>  print_report+0x167/0x470
>  ? __virt_addr_valid+0x5e/0x2d0
>  ? __phys_addr+0xc6/0x140
>  ? notifier_call_chain+0x1da/0x1e0
>  ? notifier_call_chain+0x1da/0x1e0
>  kasan_report+0xbf/0x1e0
>  ? notifier_call_chain+0x1da/0x1e0
>  notifier_call_chain+0x1da/0x1e0
>  call_netdevice_notifiers_info+0x83/0x130
>  netdev_run_todo+0xc33/0x11b0
>  ? generic_xdp_install+0x490/0x490
>  ? __tun_detach+0x1500/0x1500
>  tun_chr_close+0xe2/0x190
>  __fput+0x26a/0xa40
>  task_work_run+0x14d/0x240
>  ? task_work_cancel+0x30/0x30
>  do_exit+0xb31/0x2a40
>  ? reacquire_held_locks+0x4a0/0x4a0
>  ? do_raw_spin_lock+0x12e/0x2b0
>  ? mm_update_next_owner+0x7c0/0x7c0
>  ? rwlock_bug.part.0+0x90/0x90
>  ? lockdep_hardirqs_on_prepare+0x17f/0x410
>  do_group_exit+0xd4/0x2a0
>  __x64_sys_exit_group+0x3e/0x50
>  do_syscall_64+0x38/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> The cause of the issue is that sock_put() from __tun_detach() drops
> last reference count for struct net, and then notifier_call_chain()
> from netdev_state_change() accesses that struct net.
>
> This patch fixes the issue by calling sock_put() from tun_detach()
> after all necessary accesses for the struct net has done.
>
> Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1]
> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>

Please add a Fixes: tag, once you identified which commit added this bug.

> ---
>  drivers/net/tun.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 7a3ab3427369..ce9fcf4c8ef4 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -686,7 +686,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>                 if (tun)
>                         xdp_rxq_info_unreg(&tfile->xdp_rxq);
>                 ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
> -               sock_put(&tfile->sk);
>         }
>  }
>
> @@ -702,6 +701,11 @@ static void tun_detach(struct tun_file *tfile, bool clean)
>         if (dev)
>                 netdev_state_change(dev);
>         rtnl_unlock();
> +
> +       if (clean) {
> +               synchronize_rcu();
> +               sock_put(&tfile->sk);
> +       }
>  }
>
>  static void tun_detach_all(struct net_device *dev)
> --
> 2.38.1
>

Shigeru Yoshida Nov. 20, 2022, 8:37 a.m. UTC | #2

Hi Eric,

On Sat, 19 Nov 2022 10:31:38 -0800, Eric Dumazet wrote:
> On Fri, Nov 18, 2022 at 11:56 PM Shigeru Yoshida <syoshida@redhat.com> wrote:
>>
>> syzbot reported use-after-free in tun_detach() [1].  This causes call
>> trace like below:
>>
>> ==================================================================
>> BUG: KASAN: use-after-free in notifier_call_chain+0x1da/0x1e0
>> ...
>> Call Trace:
> 
> Please include a symbolic stack trace, I think syzbot has them.

Thank you so much for your comment.  I got it.

>>  <TASK>
>>  dump_stack_lvl+0x100/0x178
>>  print_report+0x167/0x470
>>  ? __virt_addr_valid+0x5e/0x2d0
>>  ? __phys_addr+0xc6/0x140
>>  ? notifier_call_chain+0x1da/0x1e0
>>  ? notifier_call_chain+0x1da/0x1e0
>>  kasan_report+0xbf/0x1e0
>>  ? notifier_call_chain+0x1da/0x1e0
>>  notifier_call_chain+0x1da/0x1e0
>>  call_netdevice_notifiers_info+0x83/0x130
>>  netdev_run_todo+0xc33/0x11b0
>>  ? generic_xdp_install+0x490/0x490
>>  ? __tun_detach+0x1500/0x1500
>>  tun_chr_close+0xe2/0x190
>>  __fput+0x26a/0xa40
>>  task_work_run+0x14d/0x240
>>  ? task_work_cancel+0x30/0x30
>>  do_exit+0xb31/0x2a40
>>  ? reacquire_held_locks+0x4a0/0x4a0
>>  ? do_raw_spin_lock+0x12e/0x2b0
>>  ? mm_update_next_owner+0x7c0/0x7c0
>>  ? rwlock_bug.part.0+0x90/0x90
>>  ? lockdep_hardirqs_on_prepare+0x17f/0x410
>>  do_group_exit+0xd4/0x2a0
>>  __x64_sys_exit_group+0x3e/0x50
>>  do_syscall_64+0x38/0xb0
>>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>
>> The cause of the issue is that sock_put() from __tun_detach() drops
>> last reference count for struct net, and then notifier_call_chain()
>> from netdev_state_change() accesses that struct net.
>>
>> This patch fixes the issue by calling sock_put() from tun_detach()
>> after all necessary accesses for the struct net has done.
>>
>> Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1]
>> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
> 
> Please add a Fixes: tag, once you identified which commit added this bug.

I got it too.  I'll send v2 patch.

Thanks,
Shigeru

>> ---
>>  drivers/net/tun.c | 6 +++++-
>>  1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
>> index 7a3ab3427369..ce9fcf4c8ef4 100644
>> --- a/drivers/net/tun.c
>> +++ b/drivers/net/tun.c
>> @@ -686,7 +686,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>>                 if (tun)
>>                         xdp_rxq_info_unreg(&tfile->xdp_rxq);
>>                 ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
>> -               sock_put(&tfile->sk);
>>         }
>>  }
>>
>> @@ -702,6 +701,11 @@ static void tun_detach(struct tun_file *tfile, bool clean)
>>         if (dev)
>>                 netdev_state_change(dev);
>>         rtnl_unlock();
>> +
>> +       if (clean) {
>> +               synchronize_rcu();
>> +               sock_put(&tfile->sk);
>> +       }
>>  }
>>
>>  static void tun_detach_all(struct net_device *dev)
>> --
>> 2.38.1
>>
>

diff mbox series

Patch

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7a3ab3427369..ce9fcf4c8ef4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -686,7 +686,6 @@  static void __tun_detach(struct tun_file *tfile, bool clean)
 		if (tun)
 			xdp_rxq_info_unreg(&tfile->xdp_rxq);
 		ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
-		sock_put(&tfile->sk);
 	}
 }
 
@@ -702,6 +701,11 @@  static void tun_detach(struct tun_file *tfile, bool clean)
 	if (dev)
 		netdev_state_change(dev);
 	rtnl_unlock();
+
+	if (clean) {
+		synchronize_rcu();
+		sock_put(&tfile->sk);
+	}
 }
 
 static void tun_detach_all(struct net_device *dev)