diff mbox series

can: bcm: Fix UAF in bcm_proc_show()

Message ID	20230715092543.15548-1-yuehaibing@huawei.com
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: YueHaibing <yuehaibing@huawei.com> To: <socketcan@hartkopp.net>, <mkl@pengutronix.de>, <davem@davemloft.net>, <edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>, <urs.thuermann@volkswagen.de> CC: <linux-can@vger.kernel.org>, <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>, YueHaibing <yuehaibing@huawei.com> Subject: [PATCH] can: bcm: Fix UAF in bcm_proc_show() Date: Sat, 15 Jul 2023 17:25:43 +0800 Message-ID: <20230715092543.15548-1-yuehaibing@huawei.com> MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk
Series	can: bcm: Fix UAF in bcm_proc_show() \| can: bcm: Fix UAF in bcm_proc_show()

Commit Message

Yue Haibing July 15, 2023, 9:25 a.m. UTC

  BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
Read of size 8 at addr ffff888155846230 by task cat/7862

CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xd5/0x150
 print_report+0xc1/0x5e0
 kasan_report+0xba/0xf0
 bcm_proc_show+0x969/0xa80
 seq_read_iter+0x4f6/0x1260
 seq_read+0x165/0x210
 proc_reg_read+0x227/0x300
 vfs_read+0x1d5/0x8d0
 ksys_read+0x11e/0x240
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Allocated by task 7846:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 __kasan_kmalloc+0x9e/0xa0
 bcm_sendmsg+0x264b/0x44e0
 sock_sendmsg+0xda/0x180
 ____sys_sendmsg+0x735/0x920
 ___sys_sendmsg+0x11d/0x1b0
 __sys_sendmsg+0xfa/0x1d0
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 7846:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_save_free_info+0x27/0x40
 ____kasan_slab_free+0x161/0x1c0
 slab_free_freelist_hook+0x119/0x220
 __kmem_cache_free+0xb4/0x2e0
 rcu_core+0x809/0x1bd0

bcm_op is freed before procfs entry be removed in bcm_release(),
this lead to bcm_proc_show() may read the freed bcm_op.

Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
 net/can/bcm.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

Comments

Oliver Hartkopp July 16, 2023, 7:31 p.m. UTC | #1

Hello YueHaibing,

thanks for the patch!

Indeed the proc entry can be removed as first action after lock_sock(). 
Good catch!

On 2023-07-15 11:25, YueHaibing wrote:
> BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
> Read of size 8 at addr ffff888155846230 by task cat/7862
> 
> CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
>   <TASK>
>   dump_stack_lvl+0xd5/0x150
>   print_report+0xc1/0x5e0
>   kasan_report+0xba/0xf0
>   bcm_proc_show+0x969/0xa80
>   seq_read_iter+0x4f6/0x1260
>   seq_read+0x165/0x210
>   proc_reg_read+0x227/0x300
>   vfs_read+0x1d5/0x8d0
>   ksys_read+0x11e/0x240
>   do_syscall_64+0x35/0xb0
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Allocated by task 7846:
>   kasan_save_stack+0x1e/0x40
>   kasan_set_track+0x21/0x30
>   __kasan_kmalloc+0x9e/0xa0
>   bcm_sendmsg+0x264b/0x44e0
>   sock_sendmsg+0xda/0x180
>   ____sys_sendmsg+0x735/0x920
>   ___sys_sendmsg+0x11d/0x1b0
>   __sys_sendmsg+0xfa/0x1d0
>   do_syscall_64+0x35/0xb0
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Freed by task 7846:
>   kasan_save_stack+0x1e/0x40
>   kasan_set_track+0x21/0x30
>   kasan_save_free_info+0x27/0x40
>   ____kasan_slab_free+0x161/0x1c0
>   slab_free_freelist_hook+0x119/0x220
>   __kmem_cache_free+0xb4/0x2e0
>   rcu_core+0x809/0x1bd0
> 
> bcm_op is freed before procfs entry be removed in bcm_release(),
> this lead to bcm_proc_show() may read the freed bcm_op.
> 
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>

Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>

Many thanks!

Oliver

> ---
>   net/can/bcm.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index 9ba35685b043..9168114fc87f 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c
> @@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *sock)
>   
>   	lock_sock(sk);
>   
> +#if IS_ENABLED(CONFIG_PROC_FS)
> +	/* remove procfs entry */
> +	if (net->can.bcmproc_dir && bo->bcm_proc_read)
> +		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
> +#endif /* CONFIG_PROC_FS */
> +
>   	list_for_each_entry_safe(op, next, &bo->tx_ops, list)
>   		bcm_remove_op(op);
>   
> @@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *sock)
>   	list_for_each_entry_safe(op, next, &bo->rx_ops, list)
>   		bcm_remove_op(op);
>   
> -#if IS_ENABLED(CONFIG_PROC_FS)
> -	/* remove procfs entry */
> -	if (net->can.bcmproc_dir && bo->bcm_proc_read)
> -		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
> -#endif /* CONFIG_PROC_FS */
> -
>   	/* remove device reference */
>   	if (bo->bound) {
>   		bo->bound   = 0;

Marc Kleine-Budde July 17, 2023, 7:47 a.m. UTC | #2

On 15.07.2023 17:25:43, YueHaibing wrote:
> BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
> Read of size 8 at addr ffff888155846230 by task cat/7862
> 
> CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xd5/0x150
>  print_report+0xc1/0x5e0
>  kasan_report+0xba/0xf0
>  bcm_proc_show+0x969/0xa80
>  seq_read_iter+0x4f6/0x1260
>  seq_read+0x165/0x210
>  proc_reg_read+0x227/0x300
>  vfs_read+0x1d5/0x8d0
>  ksys_read+0x11e/0x240
>  do_syscall_64+0x35/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Allocated by task 7846:
>  kasan_save_stack+0x1e/0x40
>  kasan_set_track+0x21/0x30
>  __kasan_kmalloc+0x9e/0xa0
>  bcm_sendmsg+0x264b/0x44e0
>  sock_sendmsg+0xda/0x180
>  ____sys_sendmsg+0x735/0x920
>  ___sys_sendmsg+0x11d/0x1b0
>  __sys_sendmsg+0xfa/0x1d0
>  do_syscall_64+0x35/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Freed by task 7846:
>  kasan_save_stack+0x1e/0x40
>  kasan_set_track+0x21/0x30
>  kasan_save_free_info+0x27/0x40
>  ____kasan_slab_free+0x161/0x1c0
>  slab_free_freelist_hook+0x119/0x220
>  __kmem_cache_free+0xb4/0x2e0
>  rcu_core+0x809/0x1bd0
> 
> bcm_op is freed before procfs entry be removed in bcm_release(),
> this lead to bcm_proc_show() may read the freed bcm_op.
> 
> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>

Added to linux-can/testing.

Thanks,
Marc

diff mbox series

Patch

diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9ba35685b043..9168114fc87f 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1526,6 +1526,12 @@  static int bcm_release(struct socket *sock)
 
 	lock_sock(sk);
 
+#if IS_ENABLED(CONFIG_PROC_FS)
+	/* remove procfs entry */
+	if (net->can.bcmproc_dir && bo->bcm_proc_read)
+		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+#endif /* CONFIG_PROC_FS */
+
 	list_for_each_entry_safe(op, next, &bo->tx_ops, list)
 		bcm_remove_op(op);
 
@@ -1561,12 +1567,6 @@  static int bcm_release(struct socket *sock)
 	list_for_each_entry_safe(op, next, &bo->rx_ops, list)
 		bcm_remove_op(op);
 
-#if IS_ENABLED(CONFIG_PROC_FS)
-	/* remove procfs entry */
-	if (net->can.bcmproc_dir && bo->bcm_proc_read)
-		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
-#endif /* CONFIG_PROC_FS */
-
 	/* remove device reference */
 	if (bo->bound) {
 		bo->bound   = 0;