]>
Commit | Line | Data |
---|---|---|
a15a8890 SL |
1 | From 283b14d6b947a572c8d207afb73fe43367bbdff3 Mon Sep 17 00:00:00 2001 |
2 | From: YueHaibing <yuehaibing@huawei.com> | |
3 | Date: Fri, 17 May 2019 22:31:49 +0800 | |
4 | Subject: ipvs: Fix use-after-free in ip_vs_in | |
5 | ||
6 | [ Upstream commit 719c7d563c17b150877cee03a4b812a424989dfa ] | |
7 | ||
8 | BUG: KASAN: use-after-free in ip_vs_in.part.29+0xe8/0xd20 [ip_vs] | |
9 | Read of size 4 at addr ffff8881e9b26e2c by task sshd/5603 | |
10 | ||
11 | CPU: 0 PID: 5603 Comm: sshd Not tainted 4.19.39+ #30 | |
12 | Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 | |
13 | Call Trace: | |
14 | dump_stack+0x71/0xab | |
15 | print_address_description+0x6a/0x270 | |
16 | kasan_report+0x179/0x2c0 | |
17 | ip_vs_in.part.29+0xe8/0xd20 [ip_vs] | |
18 | ip_vs_in+0xd8/0x170 [ip_vs] | |
19 | nf_hook_slow+0x5f/0xe0 | |
20 | __ip_local_out+0x1d5/0x250 | |
21 | ip_local_out+0x19/0x60 | |
22 | __tcp_transmit_skb+0xba1/0x14f0 | |
23 | tcp_write_xmit+0x41f/0x1ed0 | |
24 | ? _copy_from_iter_full+0xca/0x340 | |
25 | __tcp_push_pending_frames+0x52/0x140 | |
26 | tcp_sendmsg_locked+0x787/0x1600 | |
27 | ? tcp_sendpage+0x60/0x60 | |
28 | ? inet_sk_set_state+0xb0/0xb0 | |
29 | tcp_sendmsg+0x27/0x40 | |
30 | sock_sendmsg+0x6d/0x80 | |
31 | sock_write_iter+0x121/0x1c0 | |
32 | ? sock_sendmsg+0x80/0x80 | |
33 | __vfs_write+0x23e/0x370 | |
34 | vfs_write+0xe7/0x230 | |
35 | ksys_write+0xa1/0x120 | |
36 | ? __ia32_sys_read+0x50/0x50 | |
37 | ? __audit_syscall_exit+0x3ce/0x450 | |
38 | do_syscall_64+0x73/0x200 | |
39 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 | |
40 | RIP: 0033:0x7ff6f6147c60 | |
41 | Code: 73 01 c3 48 8b 0d 28 12 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 5d 73 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 | |
42 | RSP: 002b:00007ffd772ead18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 | |
43 | RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007ff6f6147c60 | |
44 | RDX: 0000000000000034 RSI: 000055df30a31270 RDI: 0000000000000003 | |
45 | RBP: 000055df30a31270 R08: 0000000000000000 R09: 0000000000000000 | |
46 | R10: 00007ffd772ead70 R11: 0000000000000246 R12: 00007ffd772ead74 | |
47 | R13: 00007ffd772eae20 R14: 00007ffd772eae24 R15: 000055df2f12ddc0 | |
48 | ||
49 | Allocated by task 6052: | |
50 | kasan_kmalloc+0xa0/0xd0 | |
51 | __kmalloc+0x10a/0x220 | |
52 | ops_init+0x97/0x190 | |
53 | register_pernet_operations+0x1ac/0x360 | |
54 | register_pernet_subsys+0x24/0x40 | |
55 | 0xffffffffc0ea016d | |
56 | do_one_initcall+0x8b/0x253 | |
57 | do_init_module+0xe3/0x335 | |
58 | load_module+0x2fc0/0x3890 | |
59 | __do_sys_finit_module+0x192/0x1c0 | |
60 | do_syscall_64+0x73/0x200 | |
61 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 | |
62 | ||
63 | Freed by task 6067: | |
64 | __kasan_slab_free+0x130/0x180 | |
65 | kfree+0x90/0x1a0 | |
66 | ops_free_list.part.7+0xa6/0xc0 | |
67 | unregister_pernet_operations+0x18b/0x1f0 | |
68 | unregister_pernet_subsys+0x1d/0x30 | |
69 | ip_vs_cleanup+0x1d/0xd2f [ip_vs] | |
70 | __x64_sys_delete_module+0x20c/0x300 | |
71 | do_syscall_64+0x73/0x200 | |
72 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 | |
73 | ||
74 | The buggy address belongs to the object at ffff8881e9b26600 which belongs to the cache kmalloc-4096 of size 4096 | |
75 | The buggy address is located 2092 bytes inside of 4096-byte region [ffff8881e9b26600, ffff8881e9b27600) | |
76 | The buggy address belongs to the page: | |
77 | page:ffffea0007a6c800 count:1 mapcount:0 mapping:ffff888107c0e600 index:0x0 compound_mapcount: 0 | |
78 | flags: 0x17ffffc0008100(slab|head) | |
79 | raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888107c0e600 | |
80 | raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000 | |
81 | page dumped because: kasan: bad access detected | |
82 | ||
83 | while unregistering ipvs module, ops_free_list calls | |
84 | __ip_vs_cleanup, then nf_unregister_net_hooks be called to | |
85 | do remove nf hook entries. It need a RCU period to finish, | |
86 | however net->ipvs is set to NULL immediately, which will | |
87 | trigger NULL pointer dereference when a packet is hooked | |
88 | and handled by ip_vs_in where net->ipvs is dereferenced. | |
89 | ||
90 | Another scene is ops_free_list call ops_free to free the | |
91 | net_generic directly while __ip_vs_cleanup finished, then | |
92 | calling ip_vs_in will triggers use-after-free. | |
93 | ||
94 | This patch moves nf_unregister_net_hooks from __ip_vs_cleanup() | |
95 | to __ip_vs_dev_cleanup(), where rcu_barrier() is called by | |
96 | unregister_pernet_device -> unregister_pernet_operations, | |
97 | that will do the needed grace period. | |
98 | ||
99 | Reported-by: Hulk Robot <hulkci@huawei.com> | |
100 | Fixes: efe41606184e ("ipvs: convert to use pernet nf_hook api") | |
101 | Suggested-by: Julian Anastasov <ja@ssi.bg> | |
102 | Signed-off-by: YueHaibing <yuehaibing@huawei.com> | |
103 | Acked-by: Julian Anastasov <ja@ssi.bg> | |
104 | Signed-off-by: Simon Horman <horms@verge.net.au> | |
105 | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> | |
106 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
107 | --- | |
108 | net/netfilter/ipvs/ip_vs_core.c | 2 +- | |
109 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
110 | ||
111 | diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c | |
112 | index a42c1bc7c698..62c0e80dcd71 100644 | |
113 | --- a/net/netfilter/ipvs/ip_vs_core.c | |
114 | +++ b/net/netfilter/ipvs/ip_vs_core.c | |
115 | @@ -2280,7 +2280,6 @@ static void __net_exit __ip_vs_cleanup(struct net *net) | |
116 | { | |
117 | struct netns_ipvs *ipvs = net_ipvs(net); | |
118 | ||
119 | - nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); | |
120 | ip_vs_service_net_cleanup(ipvs); /* ip_vs_flush() with locks */ | |
121 | ip_vs_conn_net_cleanup(ipvs); | |
122 | ip_vs_app_net_cleanup(ipvs); | |
123 | @@ -2295,6 +2294,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net) | |
124 | { | |
125 | struct netns_ipvs *ipvs = net_ipvs(net); | |
126 | EnterFunction(2); | |
127 | + nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); | |
128 | ipvs->enable = 0; /* Disable packet reception */ | |
129 | smp_wmb(); | |
130 | ip_vs_sync_net_cleanup(ipvs); | |
131 | -- | |
132 | 2.20.1 | |
133 |