From patchwork Wed Feb 14 16:27:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasiliy Kovalev X-Patchwork-Id: 201047 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:bc8a:b0:106:860b:bbdd with SMTP id dn10csp1351639dyb; Wed, 14 Feb 2024 08:57:36 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCUsHaBEnRWi4+1KDGwtqDeUyI5sCLesva+MVIpNDSkQ8UD7vhtPJoYG87rMiO/iJXEX/Kt4RM4wjiaCsdQJYeg1Hla89Q== X-Google-Smtp-Source: AGHT+IGfHT3GskN3kcgR5SajB6OFjX47Up5alzaN1xiK9ifUtHVjN2fEeYi+Xt9hafqq2UwFAzez X-Received: by 2002:a05:6a21:3418:b0:1a0:73f8:97ba with SMTP id yn24-20020a056a21341800b001a073f897bamr628600pzb.4.1707929856133; Wed, 14 Feb 2024 08:57:36 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1707929856; cv=pass; d=google.com; s=arc-20160816; b=APhBgJL1AP9dHdBxQM2ziz+Ml+vjVHQl1+C7WMIOQNaOXVwWGLeZVjClo66BTzMhgG cqVkJYXDajNvQqKzI7iytR9lm7ug48RShR1MVwiaHntT2pbZqpM9hNWUeVgfFIWjR+od tlsEhSTGvPrNjlG9U7B/i19PXu9SAPqptNIx34Ej1yHAVabdwnPzjLv0gRaKA/+J8ofg 4fIuV6VMIKbyRh30RN1yZqwkzbIaDxoB1KoAxvfhceI+rHRNuxtQT0dvzkGnvDBwhM8E NnPaYVnvXvPGPZjOcmr/ewN6EuFH/v/h/ozN9ZUDQMagIwXicYO9/59zsw31npbEX+I9 MVCg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from; bh=LHvG/BOXsE5wvO56mvws4D4m+o2GdAolAx9v0zDTFss=; fh=PhYg4H17ICB5gtoTGForNiZebdvRtJcS/FZdMvf3c5Y=; b=Fp2AFlCKUyVmi9ZaxhtXlLir71/aciwGBj/xRRPxVe8xz1vQg3jMmbU5o1bjyDA1a6 3yC1K8f+hGU6fXFXsnvmhVCW7yASX3k1Ve1GryLIdlbIfiwONnEvc7NQ7Up1Ej0kHeQ9 HMc0wSAM4ubJxmtgaPAfLdQ88ZW3I1GBOTNqMxHfJqjkJZOdYFrrEluwPXkZslFNQUJV bpPzXHMWslTaJZsGANL5XQR6jrMtS3HS19bl9o0HVSbSRspeZeA0KLB3KgKwsubeMcc5 DXeU4ov886zzzLwQ1qQo39iC3LLwwYxxCCeksUQOg7k6oElfM2xZ+F7CksVGny999gC0 G+Hw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=altlinux.org); spf=pass (google.com: domain of linux-kernel+bounces-65535-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-65535-ouuuleilei=gmail.com@vger.kernel.org" X-Forwarded-Encrypted: i=2; AJvYcCXvrwzki9ynm9dYpCzagYol7N67uFEJ/9FlgoAvNAFr2rvT8b3kpmS4O0oONztQvjn4O5k0iR4BGD0wMlD5SWf9xEk16w== Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [2604:1380:40f1:3f00::1]) by mx.google.com with ESMTPS id x22-20020a656ab6000000b005dc858b5b75si3003925pgu.848.2024.02.14.08.57.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Feb 2024 08:57:36 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-65535-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=altlinux.org); spf=pass (google.com: domain of linux-kernel+bounces-65535-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-65535-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 99656B224D8 for ; Wed, 14 Feb 2024 16:31:11 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 7E76F60BBC; Wed, 14 Feb 2024 16:27:59 +0000 (UTC) Received: from air.basealt.ru (air.basealt.ru [194.107.17.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC80D6025A; Wed, 14 Feb 2024 16:27:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=194.107.17.39 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707928077; cv=none; b=J0kJuF8JXLvCOT/F6u+PekvtmKKEonVx7tKWTItFP8aRmS7olGlHUWwmIYwueTv2GEDgD+qaWYVg+6A6A3fpvShtEyG7Tji7ATXpfEXo7f8bves3y0Wap8lHfMQUJRpeYxKjypMnUJ6bJytlBAW/k04Au5lNRakSRi+B5gBv6UA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707928077; c=relaxed/simple; bh=pQJlihVfjtSfZ4xDAFcZyiTy4mQy3t/31h0t8ugdBlA=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=s41YDUCVo6tJf7Dbx8H9Cn9cVYDXW6lKK8LmhhdH8GpfKrQ/LLqttLlBrsiN44bThe1wabcnFphi4aHKeJspu1j/GXfAhTQMlldBOgMLljWS3hfkLVpjX7x1v9g4LkcwhEFybojmdQuniNAEE/zDgAbSeWY8zz6YtJY745ztG3k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=altlinux.org; spf=pass smtp.mailfrom=altlinux.org; arc=none smtp.client-ip=194.107.17.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=altlinux.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=altlinux.org Received: by air.basealt.ru (Postfix, from userid 490) id 3C4CD2F20256; Wed, 14 Feb 2024 16:27:51 +0000 (UTC) X-Spam-Level: Received: from altlinux.ipa.basealt.ru (unknown [178.76.204.78]) by air.basealt.ru (Postfix) with ESMTPSA id 349C62F2025D; Wed, 14 Feb 2024 16:27:46 +0000 (UTC) From: kovalev@altlinux.org To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Cc: edumazet@google.com, pablo@netfilter.org, laforge@gnumonks.org, davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com, kovalev@altlinux.org, nickel@altlinux.org, oficerovas@altlinux.org, dutyrok@altlinux.org, stable@vger.kernel.org Subject: [PATCH ver.2] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() Date: Wed, 14 Feb 2024 19:27:33 +0300 Message-Id: <20240214162733.34214-1-kovalev@altlinux.org> X-Mailer: git-send-email 2.33.8 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1788966881534297178 X-GMAIL-MSGID: 1790894256942324873 From: Vasiliy Kovalev The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink family. Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014 RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp] Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86 df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74 RSP: 0018:ffff888014107220 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000 FS: 00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: ? show_regs+0x90/0xa0 ? die_addr+0x50/0xd0 ? exc_general_protection+0x148/0x220 ? asm_exc_general_protection+0x22/0x30 ? gtp_genl_dump_pdp+0x1be/0x800 [gtp] ? __alloc_skb+0x1dd/0x350 ? __pfx___alloc_skb+0x10/0x10 genl_dumpit+0x11d/0x230 netlink_dump+0x5b9/0xce0 ? lockdep_hardirqs_on_prepare+0x253/0x430 ? __pfx_netlink_dump+0x10/0x10 ? kasan_save_track+0x10/0x40 ? __kasan_kmalloc+0x9b/0xa0 ? genl_start+0x675/0x970 __netlink_dump_start+0x6fc/0x9f0 genl_family_rcv_msg_dumpit+0x1bb/0x2d0 ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 ? genl_op_from_small+0x2a/0x440 ? cap_capable+0x1d0/0x240 ? __pfx_genl_start+0x10/0x10 ? __pfx_genl_dumpit+0x10/0x10 ? __pfx_genl_done+0x10/0x10 ? security_capable+0x9d/0xe0 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Cc: stable@vger.kernel.org Signed-off-by: Vasiliy Kovalev --- drivers/net/gtp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index b1919278e931f4..2129ae42c70304 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1907,20 +1907,20 @@ static int __init gtp_init(void) if (err < 0) goto error_out; - err = genl_register_family(>p_genl_family); + err = register_pernet_subsys(>p_net_ops); if (err < 0) goto unreg_rtnl_link; - err = register_pernet_subsys(>p_net_ops); + err = genl_register_family(>p_genl_family); if (err < 0) - goto unreg_genl_family; + goto unreg_pernet_subsys; pr_info("GTP module loaded (pdp ctx size %zd bytes)\n", sizeof(struct pdp_ctx)); return 0; -unreg_genl_family: - genl_unregister_family(>p_genl_family); +unreg_pernet_subsys: + unregister_pernet_subsys(>p_net_ops); unreg_rtnl_link: rtnl_link_unregister(>p_link_ops); error_out: