releases/4.9.170/appletalk-fix-use-after-free-in-atalk_proc_exit.patch

   1 From 7add13a4d9b9c39f2d704f6d353eac91d602023e Mon Sep 17 00:00:00 2001
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Fri, 1 Mar 2019 10:57:57 +0800
   4 Subject: appletalk: Fix use-after-free in atalk_proc_exit
   5
   6 [ Upstream commit 6377f787aeb945cae7abbb6474798de129e1f3ac ]
   7
   8 KASAN report this:
   9
  10 BUG: KASAN: use-after-free in pde_subdir_find+0x12d/0x150 fs/proc/generic.c:71
  11 Read of size 8 at addr ffff8881f41fe5b0 by task syz-executor.0/2806
  12
  13 CPU: 0 PID: 2806 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
  14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  15 Call Trace:
  16  __dump_stack lib/dump_stack.c:77 [inline]
  17  dump_stack+0xfa/0x1ce lib/dump_stack.c:113
  18  print_address_description+0x65/0x270 mm/kasan/report.c:187
  19  kasan_report+0x149/0x18d mm/kasan/report.c:317
  20  pde_subdir_find+0x12d/0x150 fs/proc/generic.c:71
  21  remove_proc_entry+0xe8/0x420 fs/proc/generic.c:667
  22  atalk_proc_exit+0x18/0x820 [appletalk]
  23  atalk_exit+0xf/0x5a [appletalk]
  24  __do_sys_delete_module kernel/module.c:1018 [inline]
  25  __se_sys_delete_module kernel/module.c:961 [inline]
  26  __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
  27  do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
  28  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  29 RIP: 0033:0x462e99
  30 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
  31 RSP: 002b:00007fb2de6b9c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
  32 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
  33 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0
  34 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
  35 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb2de6ba6bc
  36 R13: 00000000004bccaa R14: 00000000006f6bc8 R15: 00000000ffffffff
  37
  38 Allocated by task 2806:
  39  set_track mm/kasan/common.c:85 [inline]
  40  __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:496
  41  slab_post_alloc_hook mm/slab.h:444 [inline]
  42  slab_alloc_node mm/slub.c:2739 [inline]
  43  slab_alloc mm/slub.c:2747 [inline]
  44  kmem_cache_alloc+0xcf/0x250 mm/slub.c:2752
  45  kmem_cache_zalloc include/linux/slab.h:730 [inline]
  46  __proc_create+0x30f/0xa20 fs/proc/generic.c:408
  47  proc_mkdir_data+0x47/0x190 fs/proc/generic.c:469
  48  0xffffffffc10c01bb
  49  0xffffffffc10c0166
  50  do_one_initcall+0xfa/0x5ca init/main.c:887
  51  do_init_module+0x204/0x5f6 kernel/module.c:3460
  52  load_module+0x66b2/0x8570 kernel/module.c:3808
  53  __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
  54  do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
  55  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  56
  57 Freed by task 2806:
  58  set_track mm/kasan/common.c:85 [inline]
  59  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:458
  60  slab_free_hook mm/slub.c:1409 [inline]
  61  slab_free_freelist_hook mm/slub.c:1436 [inline]
  62  slab_free mm/slub.c:2986 [inline]
  63  kmem_cache_free+0xa6/0x2a0 mm/slub.c:3002
  64  pde_put+0x6e/0x80 fs/proc/generic.c:647
  65  remove_proc_entry+0x1d3/0x420 fs/proc/generic.c:684
  66  0xffffffffc10c031c
  67  0xffffffffc10c0166
  68  do_one_initcall+0xfa/0x5ca init/main.c:887
  69  do_init_module+0x204/0x5f6 kernel/module.c:3460
  70  load_module+0x66b2/0x8570 kernel/module.c:3808
  71  __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
  72  do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
  73  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  74
  75 The buggy address belongs to the object at ffff8881f41fe500
  76  which belongs to the cache proc_dir_entry of size 256
  77 The buggy address is located 176 bytes inside of
  78  256-byte region [ffff8881f41fe500, ffff8881f41fe600)
  79 The buggy address belongs to the page:
  80 page:ffffea0007d07f80 count:1 mapcount:0 mapping:ffff8881f6e69a00 index:0x0
  81 flags: 0x2fffc0000000200(slab)
  82 raw: 02fffc0000000200 dead000000000100 dead000000000200 ffff8881f6e69a00
  83 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
  84 page dumped because: kasan: bad access detected
  85
  86 Memory state around the buggy address:
  87  ffff8881f41fe480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
  88  ffff8881f41fe500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  89 >ffff8881f41fe580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  90                                      ^
  91  ffff8881f41fe600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
  92  ffff8881f41fe680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  93
  94 It should check the return value of atalk_proc_init fails,
  95 otherwise atalk_exit will trgger use-after-free in pde_subdir_find
  96 while unload the module.This patch fix error cleanup path of atalk_init
  97
  98 Reported-by: Hulk Robot <hulkci@huawei.com>
  99 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
 100 Signed-off-by: David S. Miller <davem@davemloft.net>
 101 Signed-off-by: Sasha Levin <sashal@kernel.org>
 102 ---
 103  include/linux/atalk.h            |  2 +-
 104  net/appletalk/atalk_proc.c       |  2 +-
 105  net/appletalk/ddp.c              | 37 ++++++++++++++++++++++++++------
 106  net/appletalk/sysctl_net_atalk.c |  5 ++++-
 107  4 files changed, 37 insertions(+), 9 deletions(-)
 108
 109 diff --git a/include/linux/atalk.h b/include/linux/atalk.h
 110 index 73fd8b7e9534..716d53799d1f 100644
 111 --- a/include/linux/atalk.h
 112 +++ b/include/linux/atalk.h
 113 @@ -150,7 +150,7 @@ extern int sysctl_aarp_retransmit_limit;
 114  extern int sysctl_aarp_resolve_time;
 115
 116  #ifdef CONFIG_SYSCTL
 117 -extern void atalk_register_sysctl(void);
 118 +extern int atalk_register_sysctl(void);
 119  extern void atalk_unregister_sysctl(void);
 120  #else
 121  #define atalk_register_sysctl()                do { } while(0)
 122 diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
 123 index af46bc49e1e9..b5f84f428aa6 100644
 124 --- a/net/appletalk/atalk_proc.c
 125 +++ b/net/appletalk/atalk_proc.c
 126 @@ -293,7 +293,7 @@ int __init atalk_proc_init(void)
 127         goto out;
 128  }
 129
 130 -void __exit atalk_proc_exit(void)
 131 +void atalk_proc_exit(void)
 132  {
 133         remove_proc_entry("interface", atalk_proc_dir);
 134         remove_proc_entry("route", atalk_proc_dir);
 135 diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
 136 index 10d2bdce686e..e206d98b3b82 100644
 137 --- a/net/appletalk/ddp.c
 138 +++ b/net/appletalk/ddp.c
 139 @@ -1912,12 +1912,16 @@ static const char atalk_err_snap[] __initconst =
 140  /* Called by proto.c on kernel start up */
 141  static int __init atalk_init(void)
 142  {
 143 -       int rc = proto_register(&ddp_proto, 0);
 144 +       int rc;
 145
 146 -       if (rc != 0)
 147 +       rc = proto_register(&ddp_proto, 0);
 148 +       if (rc)
 149                 goto out;
 150
 151 -       (void)sock_register(&atalk_family_ops);
 152 +       rc = sock_register(&atalk_family_ops);
 153 +       if (rc)
 154 +               goto out_proto;
 155 +
 156         ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
 157         if (!ddp_dl)
 158                 printk(atalk_err_snap);
 159 @@ -1925,12 +1929,33 @@ static int __init atalk_init(void)
 160         dev_add_pack(&ltalk_packet_type);
 161         dev_add_pack(&ppptalk_packet_type);
 162
 163 -       register_netdevice_notifier(&ddp_notifier);
 164 +       rc = register_netdevice_notifier(&ddp_notifier);
 165 +       if (rc)
 166 +               goto out_sock;
 167 +
 168         aarp_proto_init();
 169 -       atalk_proc_init();
 170 -       atalk_register_sysctl();
 171 +       rc = atalk_proc_init();
 172 +       if (rc)
 173 +               goto out_aarp;
 174 +
 175 +       rc = atalk_register_sysctl();
 176 +       if (rc)
 177 +               goto out_proc;
 178  out:
 179         return rc;
 180 +out_proc:
 181 +       atalk_proc_exit();
 182 +out_aarp:
 183 +       aarp_cleanup_module();
 184 +       unregister_netdevice_notifier(&ddp_notifier);
 185 +out_sock:
 186 +       dev_remove_pack(&ppptalk_packet_type);
 187 +       dev_remove_pack(&ltalk_packet_type);
 188 +       unregister_snap_client(ddp_dl);
 189 +       sock_unregister(PF_APPLETALK);
 190 +out_proto:
 191 +       proto_unregister(&ddp_proto);
 192 +       goto out;
 193  }
 194  module_init(atalk_init);
 195
 196 diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
 197 index ebb864361f7a..4e6042e0fcac 100644
 198 --- a/net/appletalk/sysctl_net_atalk.c
 199 +++ b/net/appletalk/sysctl_net_atalk.c
 200 @@ -44,9 +44,12 @@ static struct ctl_table atalk_table[] = {
 201
 202  static struct ctl_table_header *atalk_table_header;
 203
 204 -void atalk_register_sysctl(void)
 205 +int __init atalk_register_sysctl(void)
 206  {
 207         atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table);
 208 +       if (!atalk_table_header)
 209 +               return -ENOMEM;
 210 +       return 0;
 211  }
 212
 213  void atalk_unregister_sysctl(void)
 214 --
 215 2.19.1
 216