queue-6.7/rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch

   1 From 9258af0e74dc9690ed7e20cd9f35f4bfbdf977ec Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Fri, 8 Mar 2024 12:01:22 -0800
   4 Subject: rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
   5
   6 From: Kuniyuki Iwashima <kuniyu@amazon.com>
   7
   8 [ Upstream commit 2a750d6a5b365265dbda33330a6188547ddb5c24 ]
   9
  10 syzkaller reported a warning of netns tracker [0] followed by KASAN
  11 splat [1] and another ref tracker warning [1].
  12
  13 syzkaller could not find a repro, but in the log, the only suspicious
  14 sequence was as follows:
  15
  16   18:26:22 executing program 1:
  17   r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
  18   ...
  19   connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async)
  20
  21 The notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT.
  22
  23 So, the scenario would be:
  24
  25   1. unshare(CLONE_NEWNET) creates a per netns tcp listener in
  26       rds_tcp_listen_init().
  27   2. syz-executor connect()s to it and creates a reqsk.
  28   3. syz-executor exit()s immediately.
  29   4. netns is dismantled.  [0]
  30   5. reqsk timer is fired, and UAF happens while freeing reqsk.  [1]
  31   6. listener is freed after RCU grace period.  [2]
  32
  33 Basically, reqsk assumes that the listener guarantees netns safety
  34 until all reqsk timers are expired by holding the listener's refcount.
  35 However, this was not the case for kernel sockets.
  36
  37 Commit 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in
  38 inet_twsk_purge()") fixed this issue only for per-netns ehash.
  39
  40 Let's apply the same fix for the global ehash.
  41
  42 [0]:
  43 ref_tracker: net notrefcnt@0000000065449cc3 has 1/1 users at
  44      sk_alloc (./include/net/net_namespace.h:337 net/core/sock.c:2146)
  45      inet6_create (net/ipv6/af_inet6.c:192 net/ipv6/af_inet6.c:119)
  46      __sock_create (net/socket.c:1572)
  47      rds_tcp_listen_init (net/rds/tcp_listen.c:279)
  48      rds_tcp_init_net (net/rds/tcp.c:577)
  49      ops_init (net/core/net_namespace.c:137)
  50      setup_net (net/core/net_namespace.c:340)
  51      copy_net_ns (net/core/net_namespace.c:497)
  52      create_new_namespaces (kernel/nsproxy.c:110)
  53      unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4))
  54      ksys_unshare (kernel/fork.c:3429)
  55      __x64_sys_unshare (kernel/fork.c:3496)
  56      do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
  57      entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)
  58 ...
  59 WARNING: CPU: 0 PID: 27 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)
  60
  61 [1]:
  62 BUG: KASAN: slab-use-after-free in inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)
  63 Read of size 8 at addr ffff88801b370400 by task swapper/0/0
  64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
  65 Call Trace:
  66  <IRQ>
  67  dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1))
  68  print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)
  69  kasan_report (mm/kasan/report.c:603)
  70  inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)
  71  reqsk_timer_handler (net/ipv4/inet_connection_sock.c:979 net/ipv4/inet_connection_sock.c:1092)
  72  call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701)
  73  __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2038)
  74  run_timer_softirq (kernel/time/timer.c:2053)
  75  __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
  76  irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644)
  77  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14))
  78  </IRQ>
  79
  80 Allocated by task 258 on cpu 0 at 83.612050s:
  81  kasan_save_stack (mm/kasan/common.c:48)
  82  kasan_save_track (mm/kasan/common.c:68)
  83  __kasan_slab_alloc (mm/kasan/common.c:343)
  84  kmem_cache_alloc (mm/slub.c:3813 mm/slub.c:3860 mm/slub.c:3867)
  85  copy_net_ns (./include/linux/slab.h:701 net/core/net_namespace.c:421 net/core/net_namespace.c:480)
  86  create_new_namespaces (kernel/nsproxy.c:110)
  87  unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4))
  88  ksys_unshare (kernel/fork.c:3429)
  89  __x64_sys_unshare (kernel/fork.c:3496)
  90  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
  91  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)
  92
  93 Freed by task 27 on cpu 0 at 329.158864s:
  94  kasan_save_stack (mm/kasan/common.c:48)
  95  kasan_save_track (mm/kasan/common.c:68)
  96  kasan_save_free_info (mm/kasan/generic.c:643)
  97  __kasan_slab_free (mm/kasan/common.c:265)
  98  kmem_cache_free (mm/slub.c:4299 mm/slub.c:4363)
  99  cleanup_net (net/core/net_namespace.c:456 net/core/net_namespace.c:446 net/core/net_namespace.c:639)
 100  process_one_work (kernel/workqueue.c:2638)
 101  worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787)
 102  kthread (kernel/kthread.c:388)
 103  ret_from_fork (arch/x86/kernel/process.c:153)
 104  ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
 105
 106 The buggy address belongs to the object at ffff88801b370000
 107  which belongs to the cache net_namespace of size 4352
 108 The buggy address is located 1024 bytes inside of
 109  freed 4352-byte region [ffff88801b370000, ffff88801b371100)
 110
 111 [2]:
 112 WARNING: CPU: 0 PID: 95 at lib/ref_tracker.c:228 ref_tracker_free (lib/ref_tracker.c:228 (discriminator 1))
 113 Modules linked in:
 114 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
 115 RIP: 0010:ref_tracker_free (lib/ref_tracker.c:228 (discriminator 1))
 116 ...
 117 Call Trace:
 118 <IRQ>
 119  __sk_destruct (./include/net/net_namespace.h:353 net/core/sock.c:2204)
 120  rcu_core (./arch/x86/include/asm/preempt.h:26 kernel/rcu/tree.c:2165 kernel/rcu/tree.c:2433)
 121  __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
 122  irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644)
 123  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14))
 124 </IRQ>
 125
 126 Reported-by: syzkaller <syzkaller@googlegroups.com>
 127 Suggested-by: Eric Dumazet <edumazet@google.com>
 128 Fixes: 467fa15356ac ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
 129 Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
 130 Reviewed-by: Eric Dumazet <edumazet@google.com>
 131 Link: https://lore.kernel.org/r/20240308200122.64357-3-kuniyu@amazon.com
 132 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 133 Signed-off-by: Sasha Levin <sashal@kernel.org>
 134 ---
 135  net/ipv4/tcp_minisocks.c | 4 ----
 136  1 file changed, 4 deletions(-)
 137
 138 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
 139 index 9e85f2a0bddd4..0ecc7311dc6ce 100644
 140 --- a/net/ipv4/tcp_minisocks.c
 141 +++ b/net/ipv4/tcp_minisocks.c
 142 @@ -398,10 +398,6 @@ void tcp_twsk_purge(struct list_head *net_exit_list, int family)
 143                         /* Even if tw_refcount == 1, we must clean up kernel reqsk */
 144                         inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family);
 145                 } else if (!purged_once) {
 146 -                       /* The last refcount is decremented in tcp_sk_exit_batch() */
 147 -                       if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1)
 148 -                               continue;
 149 -
 150                         inet_twsk_purge(&tcp_hashinfo, family);
 151                         purged_once = true;
 152                 }
 153 --
 154 2.43.0
 155