sctp: avoid auth_enable sysctl UAF during netns teardown

proc_sctp_do_auth() updates the SCTP control socket after changing
net.sctp.auth_enable. The handler gets the per-net SCTP state from
ctl->data, so an already opened sysctl file can still target a network
namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctp_defaults_init(),
while the control socket is created later from sctp_ctrlsock_init(). This
exposed a window during initialization where auth_enable was writable
before net->sctp.ctl_sock existed, and a teardown window where auth_enable
stayed writable after inet_ctl_sock_destroy() had released the control
socket.

Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after
sctp_ctl_sock_init() succeeds, and unregister the sysctl table before
destroying the control socket in sctp_ctrlsock_exit(). If sysctl
registration fails after the control socket was created, destroy the
control socket in the same init path.

Make sctp_sysctl_net_unregister() tolerate a missing header and clear the
saved pointer so init-error and exit paths can safely share the unregister
helper.

Fixes: 15649fd5415e ("sctp: sysctl: auth_enable: avoid using current->nsproxy")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Qi Tang <tpluszz77@gmail.com>
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/390cd5e91ed60eea27b0b64d0468301a9e73b808.1784033357.git.roxy520tt@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index cf335494bffe8c0ba6a9df26a904ed523a9fe629..49d9740b1e0f6deac07ae66f418e619a20a4be04 100644 (file)
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1383,10 +1383,6 @@ static int __net_init sctp_defaults_init(struct net *net)
        net->sctp.l3mdev_accept = 1;
 #endif
 
-       status = sctp_sysctl_net_register(net);
-       if (status)
-               goto err_sysctl_register;
-
        /* Allocate and initialise sctp mibs.  */
        status = init_sctp_mibs(net);
        if (status)
@@ -1420,8 +1416,6 @@ err_init_proc:
        cleanup_sctp_mibs(net);
 #endif
 err_init_mibs:
-       sctp_sysctl_net_unregister(net);
-err_sysctl_register:
        return status;
 }
 
@@ -1436,7 +1430,6 @@ static void __net_exit sctp_defaults_exit(struct net *net)
        net->sctp.proc_net_sctp = NULL;
 #endif
        cleanup_sctp_mibs(net);
-       sctp_sysctl_net_unregister(net);
 }
 
 static struct pernet_operations sctp_defaults_ops = {
@@ -1450,16 +1443,27 @@ static int __net_init sctp_ctrlsock_init(struct net *net)
 
        /* Initialize the control inode/socket for handling OOTB packets.  */
        status = sctp_ctl_sock_init(net);
-       if (status)
+       if (status) {
                pr_err("Failed to initialize the SCTP control sock\n");
+               return status;
+       }
+
+       status = sctp_sysctl_net_register(net);
+       if (status) {
+               inet_ctl_sock_destroy(net->sctp.ctl_sock);
+               net->sctp.ctl_sock = NULL;
+       }
 
        return status;
 }
 
 static void __net_exit sctp_ctrlsock_exit(struct net *net)
 {
+       sctp_sysctl_net_unregister(net);
+
        /* Free the control endpoint.  */
        inet_ctl_sock_destroy(net->sctp.ctl_sock);
+       net->sctp.ctl_sock = NULL;
 }
 
 static struct pernet_operations sctp_ctrlsock_ops = {

diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 15e7db9a3ab2e325f3951ac20c067a973a049618..fca840484ebf77853316704fa2ce7cc619524573 100644 (file)
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -615,11 +615,16 @@ int sctp_sysctl_net_register(struct net *net)
 
 void sctp_sysctl_net_unregister(struct net *net)
 {
+       struct ctl_table_header *header = net->sctp.sysctl_header;
        const struct ctl_table *table;
 
-       table = net->sctp.sysctl_header->ctl_table_arg;
-       unregister_net_sysctl_table(net->sctp.sysctl_header);
+       if (!header)
+               return;
+
+       table = header->ctl_table_arg;
+       unregister_net_sysctl_table(header);
        kfree(table);
+       net->sctp.sysctl_header = NULL;
 }
 
 static struct ctl_table_header *sctp_sysctl_header;