lkml.org 
[lkml]   [2017]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 090/124] socket, bpf: fix sk_filter use after free in sk_clone_lock
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Daniel Borkmann <daniel@iogearbox.net>

    commit 95aa915c2f04c27bb3935c8b9446435f40f17f9d upstream.

    In sk_clone_lock(), we create a new socket and inherit most of the
    parent's members via sock_copy() which memcpy()'s various sections.
    Now, in case the parent socket had a BPF socket filter attached,
    then newsk->sk_filter points to the same instance as the original
    sk->sk_filter.

    sk_filter_charge() is then called on the newsk->sk_filter to take a
    reference and should that fail due to hitting max optmem, we bail
    out and release the newsk instance.

    The issue is that commit 278571baca2a ("net: filter: simplify socket
    charging") wrongly combined the dismantle path with the failure path
    of xfrm_sk_clone_policy(). This means, even when charging failed, we
    call sk_free_unlock_clone() on the newsk, which then still points to
    the same sk_filter as the original sk.

    Thus, sk_free_unlock_clone() calls into __sk_destruct() eventually
    where it tests for present sk_filter and calls sk_filter_uncharge()
    on it, which potentially lets sk_omem_alloc wrap around and releases
    the eBPF prog and sk_filter structure from the (still intact) parent.

    Fix it by making sure that when sk_filter_charge() failed, we reset
    newsk->sk_filter back to NULL before passing to sk_free_unlock_clone(),
    so that we don't mess with the parents sk_filter.

    Only if xfrm_sk_clone_policy() fails, we did reach the point where
    either the parent's filter was NULL and as a result newsk's as well
    or where we previously had a successful sk_filter_charge(), thus for
    that case, we do need sk_filter_uncharge() to release the prior taken
    reference on sk_filter.

    Fixes: 278571baca2a ("net: filter: simplify socket charging")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/core/sock.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/net/core/sock.c
    +++ b/net/core/sock.c
    @@ -1529,6 +1529,12 @@ struct sock *sk_clone_lock(const struct
    is_charged = sk_filter_charge(newsk, filter);

    if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk))) {
    + /* We need to make sure that we don't uncharge the new
    + * socket if we couldn't charge it in the first place
    + * as otherwise we uncharge the parent's filter.
    + */
    + if (!is_charged)
    + RCU_INIT_POINTER(newsk->sk_filter, NULL);
    /* It is still raw copy of parent, so invalidate
    * destructor and make plain sk_free() */
    newsk->sk_destruct = NULL;

    \
     
     \ /
      Last update: 2017-04-20 08:55    [W:4.021 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site