net/x25: fix use-after-free of the socket by its timers

The x25 timers are armed with mod_timer() and cancelled with
timer_delete(), so a pending timer holds no reference on the socket and a
cancel does not wait for a callback already running on another CPU.

x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall
sk->sk_timer after __x25_destroy_socket() has passed its cancel point.
The following __sock_put() frees the socket while the timer is still
queued, and the next expiry uses freed memory.  KASAN reports a
slab-use-after-free on the kmalloc-2k object freed by close().

timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and
x25_timer_expiry() both reach the cancels from inside the timer they
would wait on, through __x25_destroy_socket() and x25_disconnect().

Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer()
so that an armed timer owns a reference, and release it in both expiry
handlers.  Rearm the heartbeat only while sk_hashed(sk) is still true,
since __x25_destroy_socket() unlinks the socket before dropping it.  Arm
the deferred destroy timer the same way and drop its reference in
x25_destroy_timer().

Reproduced on net with KASAN, with the heartbeat period shortened so the
window recurs.  With this patch the reproducer no longer triggers a
report and /proc/net/x25 drains.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Link: https://patch.msgid.link/20260726220342.47245-1-baul.lee@xbow.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 8aae9273b7c144ff9c60508ce077a58d9c26b400..033e7d059f58c6d22f3c919c667d3b8f10b6f65b 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -363,6 +363,7 @@ static void x25_destroy_timer(struct timer_list *t)
        struct sock *sk = timer_container_of(sk, t, sk_timer);
 
        x25_destroy_socket_from_timer(sk);
+       sock_put(sk);
 }
 
 /*
@@ -398,9 +399,8 @@ static void __x25_destroy_socket(struct sock *sk)
 
        if (sk_has_allocations(sk)) {
                /* Defer: outstanding buffers */
-               sk->sk_timer.expires  = jiffies + 10 * HZ;
                sk->sk_timer.function = x25_destroy_timer;
-               add_timer(&sk->sk_timer);
+               sk_reset_timer(sk, &sk->sk_timer, jiffies + 10 * HZ);
        } else {
                /* drop last reference so sock_put will free */
                __sock_put(sk);

diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
index 2ec63a1f4c6d42e3fedb2ddfda57eed8cdab00de..7896cd43f1cc1e9be8f3e3e58d76fc12eda3444a 100644 (file)
--- a/net/x25/x25_timer.c
+++ b/net/x25/x25_timer.c
@@ -36,45 +36,45 @@ void x25_init_timers(struct sock *sk)
 
 void x25_start_heartbeat(struct sock *sk)
 {
-       mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
+       sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
 }
 
 void x25_stop_heartbeat(struct sock *sk)
 {
-       timer_delete(&sk->sk_timer);
+       sk_stop_timer(sk, &sk->sk_timer);
 }
 
 void x25_start_t2timer(struct sock *sk)
 {
        struct x25_sock *x25 = x25_sk(sk);
 
-       mod_timer(&x25->timer, jiffies + x25->t2);
+       sk_reset_timer(sk, &x25->timer, jiffies + x25->t2);
 }
 
 void x25_start_t21timer(struct sock *sk)
 {
        struct x25_sock *x25 = x25_sk(sk);
 
-       mod_timer(&x25->timer, jiffies + x25->t21);
+       sk_reset_timer(sk, &x25->timer, jiffies + x25->t21);
 }
 
 void x25_start_t22timer(struct sock *sk)
 {
        struct x25_sock *x25 = x25_sk(sk);
 
-       mod_timer(&x25->timer, jiffies + x25->t22);
+       sk_reset_timer(sk, &x25->timer, jiffies + x25->t22);
 }
 
 void x25_start_t23timer(struct sock *sk)
 {
        struct x25_sock *x25 = x25_sk(sk);
 
-       mod_timer(&x25->timer, jiffies + x25->t23);
+       sk_reset_timer(sk, &x25->timer, jiffies + x25->t23);
 }
 
 void x25_stop_timer(struct sock *sk)
 {
-       timer_delete(&x25_sk(sk)->timer);
+       sk_stop_timer(sk, &x25_sk(sk)->timer);
 }
 
 unsigned long x25_display_timer(struct sock *sk)
@@ -108,7 +108,7 @@ static void x25_heartbeat_expiry(struct timer_list *t)
                             sock_flag(sk, SOCK_DEAD))) {
                                bh_unlock_sock(sk);
                                x25_destroy_socket_from_timer(sk);
-                               return;
+                               goto out;
                        }
                        break;
 
@@ -120,8 +120,14 @@ static void x25_heartbeat_expiry(struct timer_list *t)
                        break;
        }
 restart_heartbeat:
-       x25_start_heartbeat(sk);
+       /* Do not rearm once __x25_destroy_socket() has unlinked the socket:
+        * it is past its cancel point and owns the teardown from there on.
+        */
+       if (sk_hashed(sk))
+               x25_start_heartbeat(sk);
        bh_unlock_sock(sk);
+out:
+       sock_put(sk);
 }
 
 /*
@@ -166,4 +172,5 @@ static void x25_timer_expiry(struct timer_list *t)
        } else
                x25_do_timer_expiry(sk);
        bh_unlock_sock(sk);
+       sock_put(sk);
 }