]>
Commit | Line | Data |
---|---|---|
cf6ea5cf TL |
1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
2 | From: Mao Wenan <maowenan@huawei.com> | |
3 | Date: Mon, 18 Feb 2019 10:44:44 +0800 | |
4 | Subject: [PATCH] net: crypto set sk to NULL when af_alg_release. | |
5 | ||
6 | KASAN has found use-after-free in sockfs_setattr. | |
7 | The existed commit 6d8c50dcb029 ("socket: close race condition between sock_close() | |
8 | and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore | |
9 | that crypto module forgets to set the sk to NULL after af_alg_release. | |
10 | ||
11 | KASAN report details as below: | |
12 | BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150 | |
13 | Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186 | |
14 | ||
15 | CPU: 2 PID: 4186 Comm: syz-executor0 Not tainted xxx + #1 | |
16 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS | |
17 | 1.10.2-1ubuntu1 04/01/2014 | |
18 | Call Trace: | |
19 | dump_stack+0xca/0x13e | |
20 | print_address_description+0x79/0x330 | |
21 | ? vprintk_func+0x5e/0xf0 | |
22 | kasan_report+0x18a/0x2e0 | |
23 | ? sockfs_setattr+0x120/0x150 | |
24 | sockfs_setattr+0x120/0x150 | |
25 | ? sock_register+0x2d0/0x2d0 | |
26 | notify_change+0x90c/0xd40 | |
27 | ? chown_common+0x2ef/0x510 | |
28 | chown_common+0x2ef/0x510 | |
29 | ? chmod_common+0x3b0/0x3b0 | |
30 | ? __lock_is_held+0xbc/0x160 | |
31 | ? __sb_start_write+0x13d/0x2b0 | |
32 | ? __mnt_want_write+0x19a/0x250 | |
33 | do_fchownat+0x15c/0x190 | |
34 | ? __ia32_sys_chmod+0x80/0x80 | |
35 | ? trace_hardirqs_on_thunk+0x1a/0x1c | |
36 | __x64_sys_fchownat+0xbf/0x160 | |
37 | ? lockdep_hardirqs_on+0x39a/0x5e0 | |
38 | do_syscall_64+0xc8/0x580 | |
39 | entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
40 | RIP: 0033:0x462589 | |
41 | Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 | |
42 | f7 48 89 d6 48 89 | |
43 | ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 | |
44 | 48 c7 c1 bc ff ff | |
45 | ff f7 d8 64 89 01 48 | |
46 | RSP: 002b:00007fb4b2c83c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000104 | |
47 | RAX: ffffffffffffffda RBX: 000000000072bfa0 RCX: 0000000000462589 | |
48 | RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000007 | |
49 | RBP: 0000000000000005 R08: 0000000000001000 R09: 0000000000000000 | |
50 | R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb4b2c846bc | |
51 | R13: 00000000004bc733 R14: 00000000006f5138 R15: 00000000ffffffff | |
52 | ||
53 | Allocated by task 4185: | |
54 | kasan_kmalloc+0xa0/0xd0 | |
55 | __kmalloc+0x14a/0x350 | |
56 | sk_prot_alloc+0xf6/0x290 | |
57 | sk_alloc+0x3d/0xc00 | |
58 | af_alg_accept+0x9e/0x670 | |
59 | hash_accept+0x4a3/0x650 | |
60 | __sys_accept4+0x306/0x5c0 | |
61 | __x64_sys_accept4+0x98/0x100 | |
62 | do_syscall_64+0xc8/0x580 | |
63 | entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
64 | ||
65 | Freed by task 4184: | |
66 | __kasan_slab_free+0x12e/0x180 | |
67 | kfree+0xeb/0x2f0 | |
68 | __sk_destruct+0x4e6/0x6a0 | |
69 | sk_destruct+0x48/0x70 | |
70 | __sk_free+0xa9/0x270 | |
71 | sk_free+0x2a/0x30 | |
72 | af_alg_release+0x5c/0x70 | |
73 | __sock_release+0xd3/0x280 | |
74 | sock_close+0x1a/0x20 | |
75 | __fput+0x27f/0x7f0 | |
76 | task_work_run+0x136/0x1b0 | |
77 | exit_to_usermode_loop+0x1a7/0x1d0 | |
78 | do_syscall_64+0x461/0x580 | |
79 | entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
80 | ||
81 | Syzkaller reproducer: | |
82 | r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, | |
83 | 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, | |
84 | 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, | |
85 | 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, | |
86 | 0xffffffffffffffff, 0x0) | |
87 | r1 = socket$alg(0x26, 0x5, 0x0) | |
88 | getrusage(0x0, 0x0) | |
89 | bind(r1, &(0x7f00000001c0)=@alg={0x26, 'hash\x00', 0x0, 0x0, | |
90 | 'sha256-ssse3\x00'}, 0x80) | |
91 | r2 = accept(r1, 0x0, 0x0) | |
92 | r3 = accept4$unix(r2, 0x0, 0x0, 0x0) | |
93 | r4 = dup3(r3, r0, 0x0) | |
94 | fchownat(r4, &(0x7f00000000c0)='\x00', 0x0, 0x0, 0x1000) | |
95 | ||
96 | Fixes: 6d8c50dcb029 ("socket: close race condition between sock_close() and sockfs_setattr()") | |
97 | Signed-off-by: Mao Wenan <maowenan@huawei.com> | |
98 | Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> | |
99 | --- | |
100 | crypto/af_alg.c | 4 +++- | |
101 | 1 file changed, 3 insertions(+), 1 deletion(-) | |
102 | ||
103 | diff --git a/crypto/af_alg.c b/crypto/af_alg.c | |
104 | index 671e42ff21d4..493002afae73 100644 | |
105 | --- a/crypto/af_alg.c | |
106 | +++ b/crypto/af_alg.c | |
107 | @@ -122,8 +122,10 @@ static void alg_do_release(const struct af_alg_type *type, void *private) | |
108 | ||
109 | int af_alg_release(struct socket *sock) | |
110 | { | |
111 | - if (sock->sk) | |
112 | + if (sock->sk) { | |
113 | sock_put(sock->sk); | |
114 | + sock->sk = NULL; | |
115 | + } | |
116 | return 0; | |
117 | } | |
118 | EXPORT_SYMBOL_GPL(af_alg_release); |