queue-4.14/ipvs-fix-use-after-free-in-ip_vs_in.patch

   1 From ac477cf8b336a345386a04f4f6e7e140e22a3098 Mon Sep 17 00:00:00 2001
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Fri, 17 May 2019 22:31:49 +0800
   4 Subject: ipvs: Fix use-after-free in ip_vs_in
   5
   6 [ Upstream commit 719c7d563c17b150877cee03a4b812a424989dfa ]
   7
   8 BUG: KASAN: use-after-free in ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
   9 Read of size 4 at addr ffff8881e9b26e2c by task sshd/5603
  10
  11 CPU: 0 PID: 5603 Comm: sshd Not tainted 4.19.39+ #30
  12 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
  13 Call Trace:
  14  dump_stack+0x71/0xab
  15  print_address_description+0x6a/0x270
  16  kasan_report+0x179/0x2c0
  17  ip_vs_in.part.29+0xe8/0xd20 [ip_vs]
  18  ip_vs_in+0xd8/0x170 [ip_vs]
  19  nf_hook_slow+0x5f/0xe0
  20  __ip_local_out+0x1d5/0x250
  21  ip_local_out+0x19/0x60
  22  __tcp_transmit_skb+0xba1/0x14f0
  23  tcp_write_xmit+0x41f/0x1ed0
  24  ? _copy_from_iter_full+0xca/0x340
  25  __tcp_push_pending_frames+0x52/0x140
  26  tcp_sendmsg_locked+0x787/0x1600
  27  ? tcp_sendpage+0x60/0x60
  28  ? inet_sk_set_state+0xb0/0xb0
  29  tcp_sendmsg+0x27/0x40
  30  sock_sendmsg+0x6d/0x80
  31  sock_write_iter+0x121/0x1c0
  32  ? sock_sendmsg+0x80/0x80
  33  __vfs_write+0x23e/0x370
  34  vfs_write+0xe7/0x230
  35  ksys_write+0xa1/0x120
  36  ? __ia32_sys_read+0x50/0x50
  37  ? __audit_syscall_exit+0x3ce/0x450
  38  do_syscall_64+0x73/0x200
  39  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  40 RIP: 0033:0x7ff6f6147c60
  41 Code: 73 01 c3 48 8b 0d 28 12 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 5d 73 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83
  42 RSP: 002b:00007ffd772ead18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
  43 RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007ff6f6147c60
  44 RDX: 0000000000000034 RSI: 000055df30a31270 RDI: 0000000000000003
  45 RBP: 000055df30a31270 R08: 0000000000000000 R09: 0000000000000000
  46 R10: 00007ffd772ead70 R11: 0000000000000246 R12: 00007ffd772ead74
  47 R13: 00007ffd772eae20 R14: 00007ffd772eae24 R15: 000055df2f12ddc0
  48
  49 Allocated by task 6052:
  50  kasan_kmalloc+0xa0/0xd0
  51  __kmalloc+0x10a/0x220
  52  ops_init+0x97/0x190
  53  register_pernet_operations+0x1ac/0x360
  54  register_pernet_subsys+0x24/0x40
  55  0xffffffffc0ea016d
  56  do_one_initcall+0x8b/0x253
  57  do_init_module+0xe3/0x335
  58  load_module+0x2fc0/0x3890
  59  __do_sys_finit_module+0x192/0x1c0
  60  do_syscall_64+0x73/0x200
  61  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  62
  63 Freed by task 6067:
  64  __kasan_slab_free+0x130/0x180
  65  kfree+0x90/0x1a0
  66  ops_free_list.part.7+0xa6/0xc0
  67  unregister_pernet_operations+0x18b/0x1f0
  68  unregister_pernet_subsys+0x1d/0x30
  69  ip_vs_cleanup+0x1d/0xd2f [ip_vs]
  70  __x64_sys_delete_module+0x20c/0x300
  71  do_syscall_64+0x73/0x200
  72  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  73
  74 The buggy address belongs to the object at ffff8881e9b26600 which belongs to the cache kmalloc-4096 of size 4096
  75 The buggy address is located 2092 bytes inside of 4096-byte region [ffff8881e9b26600, ffff8881e9b27600)
  76 The buggy address belongs to the page:
  77 page:ffffea0007a6c800 count:1 mapcount:0 mapping:ffff888107c0e600 index:0x0 compound_mapcount: 0
  78 flags: 0x17ffffc0008100(slab|head)
  79 raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888107c0e600
  80 raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000
  81 page dumped because: kasan: bad access detected
  82
  83 while unregistering ipvs module, ops_free_list calls
  84 __ip_vs_cleanup, then nf_unregister_net_hooks be called to
  85 do remove nf hook entries. It need a RCU period to finish,
  86 however net->ipvs is set to NULL immediately, which will
  87 trigger NULL pointer dereference when a packet is hooked
  88 and handled by ip_vs_in where net->ipvs is dereferenced.
  89
  90 Another scene is ops_free_list call ops_free to free the
  91 net_generic directly while __ip_vs_cleanup finished, then
  92 calling ip_vs_in will triggers use-after-free.
  93
  94 This patch moves nf_unregister_net_hooks from __ip_vs_cleanup()
  95 to __ip_vs_dev_cleanup(),  where rcu_barrier() is called by
  96 unregister_pernet_device -> unregister_pernet_operations,
  97 that will do the needed grace period.
  98
  99 Reported-by: Hulk Robot <hulkci@huawei.com>
 100 Fixes: efe41606184e ("ipvs: convert to use pernet nf_hook api")
 101 Suggested-by: Julian Anastasov <ja@ssi.bg>
 102 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
 103 Acked-by: Julian Anastasov <ja@ssi.bg>
 104 Signed-off-by: Simon Horman <horms@verge.net.au>
 105 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 106 Signed-off-by: Sasha Levin <sashal@kernel.org>
 107 ---
 108  net/netfilter/ipvs/ip_vs_core.c | 2 +-
 109  1 file changed, 1 insertion(+), 1 deletion(-)
 110
 111 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
 112 index d1c0378144f3..ee97ce176b9a 100644
 113 --- a/net/netfilter/ipvs/ip_vs_core.c
 114 +++ b/net/netfilter/ipvs/ip_vs_core.c
 115 @@ -2268,7 +2268,6 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
 116  {
 117         struct netns_ipvs *ipvs = net_ipvs(net);
 118
 119 -       nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 120         ip_vs_service_net_cleanup(ipvs);        /* ip_vs_flush() with locks */
 121         ip_vs_conn_net_cleanup(ipvs);
 122         ip_vs_app_net_cleanup(ipvs);
 123 @@ -2283,6 +2282,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
 124  {
 125         struct netns_ipvs *ipvs = net_ipvs(net);
 126         EnterFunction(2);
 127 +       nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 128         ipvs->enable = 0;       /* Disable packet reception */
 129         smp_wmb();
 130         ip_vs_sync_net_cleanup(ipvs);
 131 --
 132 2.20.1
 133