lkml.org 
[lkml]   [2017]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 30/58] packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: WANG Cong <xiyou.wangcong@gmail.com>


    [ Upstream commit c800aaf8d869f2b9b47b10c5c312fe19f0a94042 ]

    There are multiple reports showing we have a use-after-free in
    the timer prb_retire_rx_blk_timer_expired(), where we use struct
    tpacket_kbdq_core::pkbdq, a pg_vec, after it gets freed by
    free_pg_vec().

    The interesting part is it is not freed via packet_release() but
    via packet_setsockopt(), which means we are not closing the socket.
    Looking into the big and fat function packet_set_ring(), this could
    happen if we satisfy the following conditions:

    1. closing == 0, not on packet_release() path
    2. req->tp_block_nr == 0, we don't allocate a new pg_vec
    3. rx_ring->pg_vec is already set as V3, which means we already called
    packet_set_ring() wtih req->tp_block_nr > 0 previously
    4. req->tp_frame_nr == 0, pass sanity check
    5. po->mapped == 0, never called mmap()

    In this scenario we are clearing the old rx_ring->pg_vec, so we need
    to free this pg_vec, but we don't stop the timer on this path because
    of closing==0.

    The timer has to be stopped as long as we need to free pg_vec, therefore
    the check on closing!=0 is wrong, we should check pg_vec!=NULL instead.

    Thanks to liujian for testing different fixes.

    Reported-by: alexander.levin@verizon.com
    Reported-by: Dave Jones <davej@codemonkey.org.uk>
    Reported-by: liujian (CE) <liujian56@huawei.com>
    Tested-by: liujian (CE) <liujian56@huawei.com>
    Cc: Ding Tianhong <dingtianhong@huawei.com>
    Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/packet/af_packet.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/packet/af_packet.c
    +++ b/net/packet/af_packet.c
    @@ -4225,7 +4225,7 @@ static int packet_set_ring(struct sock *
    register_prot_hook(sk);
    }
    spin_unlock(&po->bind_lock);
    - if (closing && (po->tp_version > TPACKET_V2)) {
    + if (pg_vec && (po->tp_version > TPACKET_V2)) {
    /* Because we don't support block-based V3 on tx-ring */
    if (!tx_ring)
    prb_shutdown_retire_blk_timer(po, rb_queue);

    \
     
     \ /
      Last update: 2017-08-09 21:50    [W:4.265 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site