| Message ID | 20220728051821.3160118-1-eric.dumazet@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d7c4c9e075f8cc6d88d277bc24e5d99297f03c06 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ax25: fix incorrect dev_tracker usage | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Wed, 27 Jul 2022 22:18:21 -0700 you wrote: > From: Eric Dumazet <edumazet@google.com> > > While investigating a separate rose issue [1], and enabling > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > An ax25_dev can be used by one (or many) struct ax25_cb. > We thus need different dev_tracker, one per struct ax25_cb. > > [...] Here is the summary with links: - [net] ax25: fix incorrect dev_tracker usage https://git.kernel.org/netdev/net/c/d7c4c9e075f8 You are awesome, thank you!
Hello, On 28/07/2022 07:18, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > While investigating a separate rose issue [1], and enabling > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > An ax25_dev can be used by one (or many) struct ax25_cb. > We thus need different dev_tracker, one per struct ax25_cb. > > After this patch is applied, we are able to focus on rose. FYI, we got a small conflict when merging -net in net-next in the MPTCP tree due to this patch applied in -net: d7c4c9e075f8 ("ax25: fix incorrect dev_tracker usage") and this one from net-next: d62607c3fe45 ("net: rename reference+tracking helpers") The conflict has been resolved on our side[1] and the resolution we suggest is attached to this email. I'm sharing this thinking it can help others but if it only creates noise, please tell me! :-) Cheers, Matt [1] https://github.com/multipath-tcp/mptcp_net-next/commit/b01791aa6b6c
On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > While investigating a separate rose issue [1], and enabling > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > An ax25_dev can be used by one (or many) struct ax25_cb. > We thus need different dev_tracker, one per struct ax25_cb. > > After this patch is applied, we are able to focus on rose. > > [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ > > [2] > [ 205.798723] reference already released. > [ 205.798732] allocated in: > [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] > [ 205.798747] __sys_bind+0xea/0x110 > [ 205.798753] __x64_sys_bind+0x18/0x20 > [ 205.798758] do_syscall_64+0x5c/0x80 > [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae > [ 205.798768] freed in: > [ 205.798770] ax25_release+0x115/0x370 [ax25] > [ 205.798778] __sock_release+0x42/0xb0 > [ 205.798782] sock_close+0x15/0x20 > [ 205.798785] __fput+0x9f/0x260 > [ 205.798789] ____fput+0xe/0x10 > [ 205.798792] task_work_run+0x64/0xa0 > [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 > [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 > [ 205.798808] do_syscall_64+0x69/0x80 > [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae > [ 205.798827] ------------[ cut here ]------------ > [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 > [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video > [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] > [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 > [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 > [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 > [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e > [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 > [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 > [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff > [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 > [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 > [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 > [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 > [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 > [ 205.799033] Call Trace: > [ 205.799035] <TASK> > [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] > [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] > [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 > [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 > [ 205.799065] ? dev_close_many+0xc8/0x120 > [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 > [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 > [ 205.799076] ? unregister_netdev+0x1d/0x30 > [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] > [ 205.799084] ? tty_ldisc_close+0x2e/0x40 > [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 > [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 > [ 205.799098] ? tty_vhangup+0x15/0x20 > [ 205.799103] ? pty_close+0x127/0x160 > [ 205.799108] ? tty_release+0x139/0x5e0 > [ 205.799112] ? __fput+0x9f/0x260 > [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] > [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] > [ 205.799135] raw_notifier_call_chain+0x49/0x60 > [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 > [ 205.799146] dev_close_many+0xc8/0x120 > [ 205.799152] unregister_netdevice_many+0x13d/0x890 > [ 205.799157] unregister_netdevice_queue+0x90/0xe0 > [ 205.799161] unregister_netdev+0x1d/0x30 > [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] > [ 205.799170] tty_ldisc_close+0x2e/0x40 > [ 205.799173] tty_ldisc_hangup+0x137/0x210 > [ 205.799178] __tty_hangup.part.0+0x208/0x350 > [ 205.799184] tty_vhangup+0x15/0x20 > [ 205.799188] pty_close+0x127/0x160 > [ 205.799193] tty_release+0x139/0x5e0 > [ 205.799199] __fput+0x9f/0x260 > [ 205.799203] ____fput+0xe/0x10 > [ 205.799208] task_work_run+0x64/0xa0 > [ 205.799213] do_exit+0x33b/0xab0 > [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 > [ 205.799224] do_group_exit+0x35/0xa0 > [ 205.799228] __x64_sys_exit_group+0x18/0x20 > [ 205.799232] do_syscall_64+0x5c/0x80 > [ 205.799238] ? handle_mm_fault+0xba/0x290 > [ 205.799242] ? debug_smp_processor_id+0x17/0x20 > [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 > [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 > [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 > [ 205.799260] ? irqentry_exit+0x33/0x40 > [ 205.799263] ? exc_page_fault+0x87/0x170 > [ 205.799268] ? asm_exc_page_fault+0x8/0x30 > [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae > [ 205.799277] RIP: 0033:0x7ff6b80eaca1 > [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. > [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 > [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 > [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 > [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 > [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 > [ 205.799304] </TASK> > > Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") > Reported-by: Bernard F6BVP <f6bvp@free.fr> > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Duoming Zhou <duoming@zju.edu.cn> > --- > include/net/ax25.h | 1 + > net/ax25/af_ax25.c | 4 ++-- > 2 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/include/net/ax25.h b/include/net/ax25.h > index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 > --- a/include/net/ax25.h > +++ b/include/net/ax25.h > @@ -236,6 +236,7 @@ typedef struct ax25_cb { > ax25_address source_addr, dest_addr; > ax25_digi *digipeat; > ax25_dev *ax25_dev; > + netdevice_tracker dev_tracker; > unsigned char iamdigi; > unsigned char state, modulus, pidincl; > unsigned short vs, vr, va; I'm sorry for the [too] late feedback, but it looks like this patch forgot to remove the old/unused tracker from ax25_dev, or am I missing something? Thanks! Paolo
On Tue, Aug 2, 2022 at 11:23 PM Paolo Abeni <pabeni@redhat.com> wrote: > > On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: > > From: Eric Dumazet <edumazet@google.com> > > > > While investigating a separate rose issue [1], and enabling > > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > > > An ax25_dev can be used by one (or many) struct ax25_cb. > > We thus need different dev_tracker, one per struct ax25_cb. > > > > After this patch is applied, we are able to focus on rose. > > > > [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ > > > > [2] > > [ 205.798723] reference already released. > > [ 205.798732] allocated in: > > [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] > > [ 205.798747] __sys_bind+0xea/0x110 > > [ 205.798753] __x64_sys_bind+0x18/0x20 > > [ 205.798758] do_syscall_64+0x5c/0x80 > > [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae > > [ 205.798768] freed in: > > [ 205.798770] ax25_release+0x115/0x370 [ax25] > > [ 205.798778] __sock_release+0x42/0xb0 > > [ 205.798782] sock_close+0x15/0x20 > > [ 205.798785] __fput+0x9f/0x260 > > [ 205.798789] ____fput+0xe/0x10 > > [ 205.798792] task_work_run+0x64/0xa0 > > [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 > > [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 > > [ 205.798808] do_syscall_64+0x69/0x80 > > [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae > > [ 205.798827] ------------[ cut here ]------------ > > [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 > > [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video > > [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] > > [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 > > [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 > > [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 > > [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e > > [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 > > [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 > > [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff > > [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 > > [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 > > [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 > > [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 > > [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 > > [ 205.799033] Call Trace: > > [ 205.799035] <TASK> > > [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] > > [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] > > [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 > > [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 > > [ 205.799065] ? dev_close_many+0xc8/0x120 > > [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 > > [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 > > [ 205.799076] ? unregister_netdev+0x1d/0x30 > > [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] > > [ 205.799084] ? tty_ldisc_close+0x2e/0x40 > > [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 > > [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 > > [ 205.799098] ? tty_vhangup+0x15/0x20 > > [ 205.799103] ? pty_close+0x127/0x160 > > [ 205.799108] ? tty_release+0x139/0x5e0 > > [ 205.799112] ? __fput+0x9f/0x260 > > [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] > > [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] > > [ 205.799135] raw_notifier_call_chain+0x49/0x60 > > [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 > > [ 205.799146] dev_close_many+0xc8/0x120 > > [ 205.799152] unregister_netdevice_many+0x13d/0x890 > > [ 205.799157] unregister_netdevice_queue+0x90/0xe0 > > [ 205.799161] unregister_netdev+0x1d/0x30 > > [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] > > [ 205.799170] tty_ldisc_close+0x2e/0x40 > > [ 205.799173] tty_ldisc_hangup+0x137/0x210 > > [ 205.799178] __tty_hangup.part.0+0x208/0x350 > > [ 205.799184] tty_vhangup+0x15/0x20 > > [ 205.799188] pty_close+0x127/0x160 > > [ 205.799193] tty_release+0x139/0x5e0 > > [ 205.799199] __fput+0x9f/0x260 > > [ 205.799203] ____fput+0xe/0x10 > > [ 205.799208] task_work_run+0x64/0xa0 > > [ 205.799213] do_exit+0x33b/0xab0 > > [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 > > [ 205.799224] do_group_exit+0x35/0xa0 > > [ 205.799228] __x64_sys_exit_group+0x18/0x20 > > [ 205.799232] do_syscall_64+0x5c/0x80 > > [ 205.799238] ? handle_mm_fault+0xba/0x290 > > [ 205.799242] ? debug_smp_processor_id+0x17/0x20 > > [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 > > [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 > > [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 > > [ 205.799260] ? irqentry_exit+0x33/0x40 > > [ 205.799263] ? exc_page_fault+0x87/0x170 > > [ 205.799268] ? asm_exc_page_fault+0x8/0x30 > > [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae > > [ 205.799277] RIP: 0033:0x7ff6b80eaca1 > > [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. > > [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 > > [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 > > [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 > > [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 > > [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 > > [ 205.799304] </TASK> > > > > Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") > > Reported-by: Bernard F6BVP <f6bvp@free.fr> > > Signed-off-by: Eric Dumazet <edumazet@google.com> > > Cc: Duoming Zhou <duoming@zju.edu.cn> > > --- > > include/net/ax25.h | 1 + > > net/ax25/af_ax25.c | 4 ++-- > > 2 files changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/include/net/ax25.h b/include/net/ax25.h > > index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 > > --- a/include/net/ax25.h > > +++ b/include/net/ax25.h > > @@ -236,6 +236,7 @@ typedef struct ax25_cb { > > ax25_address source_addr, dest_addr; > > ax25_digi *digipeat; > > ax25_dev *ax25_dev; > > + netdevice_tracker dev_tracker; > > unsigned char iamdigi; > > unsigned char state, modulus, pidincl; > > unsigned short vs, vr, va; > > I'm sorry for the [too] late feedback, but it looks like this patch > forgot to remove the old/unused tracker from ax25_dev, or am I missing > something? I think you are confused ;) The other tracker is still used. Only the blamed patch (feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation")) needed a separate tracker in 'struct ax25_cb'.
On Tue, 2022-08-02 at 23:46 -0700, Eric Dumazet wrote: > On Tue, Aug 2, 2022 at 11:23 PM Paolo Abeni <pabeni@redhat.com> wrote: > > > > On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: > > > From: Eric Dumazet <edumazet@google.com> > > > > > > While investigating a separate rose issue [1], and enabling > > > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > > > > > An ax25_dev can be used by one (or many) struct ax25_cb. > > > We thus need different dev_tracker, one per struct ax25_cb. > > > > > > After this patch is applied, we are able to focus on rose. > > > > > > [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ > > > > > > [2] > > > [ 205.798723] reference already released. > > > [ 205.798732] allocated in: > > > [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] > > > [ 205.798747] __sys_bind+0xea/0x110 > > > [ 205.798753] __x64_sys_bind+0x18/0x20 > > > [ 205.798758] do_syscall_64+0x5c/0x80 > > > [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > [ 205.798768] freed in: > > > [ 205.798770] ax25_release+0x115/0x370 [ax25] > > > [ 205.798778] __sock_release+0x42/0xb0 > > > [ 205.798782] sock_close+0x15/0x20 > > > [ 205.798785] __fput+0x9f/0x260 > > > [ 205.798789] ____fput+0xe/0x10 > > > [ 205.798792] task_work_run+0x64/0xa0 > > > [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 > > > [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 > > > [ 205.798808] do_syscall_64+0x69/0x80 > > > [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > [ 205.798827] ------------[ cut here ]------------ > > > [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 > > > [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video > > > [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] > > > [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 > > > [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 > > > [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 > > > [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e > > > [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 > > > [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 > > > [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff > > > [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 > > > [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 > > > [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 > > > [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 > > > [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 > > > [ 205.799033] Call Trace: > > > [ 205.799035] <TASK> > > > [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] > > > [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] > > > [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 > > > [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 > > > [ 205.799065] ? dev_close_many+0xc8/0x120 > > > [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 > > > [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 > > > [ 205.799076] ? unregister_netdev+0x1d/0x30 > > > [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] > > > [ 205.799084] ? tty_ldisc_close+0x2e/0x40 > > > [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 > > > [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 > > > [ 205.799098] ? tty_vhangup+0x15/0x20 > > > [ 205.799103] ? pty_close+0x127/0x160 > > > [ 205.799108] ? tty_release+0x139/0x5e0 > > > [ 205.799112] ? __fput+0x9f/0x260 > > > [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] > > > [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] > > > [ 205.799135] raw_notifier_call_chain+0x49/0x60 > > > [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 > > > [ 205.799146] dev_close_many+0xc8/0x120 > > > [ 205.799152] unregister_netdevice_many+0x13d/0x890 > > > [ 205.799157] unregister_netdevice_queue+0x90/0xe0 > > > [ 205.799161] unregister_netdev+0x1d/0x30 > > > [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] > > > [ 205.799170] tty_ldisc_close+0x2e/0x40 > > > [ 205.799173] tty_ldisc_hangup+0x137/0x210 > > > [ 205.799178] __tty_hangup.part.0+0x208/0x350 > > > [ 205.799184] tty_vhangup+0x15/0x20 > > > [ 205.799188] pty_close+0x127/0x160 > > > [ 205.799193] tty_release+0x139/0x5e0 > > > [ 205.799199] __fput+0x9f/0x260 > > > [ 205.799203] ____fput+0xe/0x10 > > > [ 205.799208] task_work_run+0x64/0xa0 > > > [ 205.799213] do_exit+0x33b/0xab0 > > > [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 > > > [ 205.799224] do_group_exit+0x35/0xa0 > > > [ 205.799228] __x64_sys_exit_group+0x18/0x20 > > > [ 205.799232] do_syscall_64+0x5c/0x80 > > > [ 205.799238] ? handle_mm_fault+0xba/0x290 > > > [ 205.799242] ? debug_smp_processor_id+0x17/0x20 > > > [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 > > > [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 > > > [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 > > > [ 205.799260] ? irqentry_exit+0x33/0x40 > > > [ 205.799263] ? exc_page_fault+0x87/0x170 > > > [ 205.799268] ? asm_exc_page_fault+0x8/0x30 > > > [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > [ 205.799277] RIP: 0033:0x7ff6b80eaca1 > > > [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. > > > [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > > [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 > > > [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 > > > [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 > > > [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 > > > [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 > > > [ 205.799304] </TASK> > > > > > > Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") > > > Reported-by: Bernard F6BVP <f6bvp@free.fr> > > > Signed-off-by: Eric Dumazet <edumazet@google.com> > > > Cc: Duoming Zhou <duoming@zju.edu.cn> > > > --- > > > include/net/ax25.h | 1 + > > > net/ax25/af_ax25.c | 4 ++-- > > > 2 files changed, 3 insertions(+), 2 deletions(-) > > > > > > diff --git a/include/net/ax25.h b/include/net/ax25.h > > > index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 > > > --- a/include/net/ax25.h > > > +++ b/include/net/ax25.h > > > @@ -236,6 +236,7 @@ typedef struct ax25_cb { > > > ax25_address source_addr, dest_addr; > > > ax25_digi *digipeat; > > > ax25_dev *ax25_dev; > > > + netdevice_tracker dev_tracker; > > > unsigned char iamdigi; > > > unsigned char state, modulus, pidincl; > > > unsigned short vs, vr, va; > > > > I'm sorry for the [too] late feedback, but it looks like this patch > > forgot to remove the old/unused tracker from ax25_dev, or am I missing > > something? > > I think you are confused ;) Indeed I'm (hopefully I was). > The other tracker is still used. > > Only the blamed patch (feef318c855a ("ax25: fix UAF bugs of net_device > caused by rebinding operation")) needed > a separate tracker in 'struct ax25_cb'. So this conflict resolution: https://lore.kernel.org/linux-next/20220802151932.2830110-1-broonie@kernel.org/T/#u is wrong - the first chunck must be dropped, only the last 2 are required, right? Thanks, Paolo
On Wed, Aug 3, 2022 at 12:03 AM Paolo Abeni <pabeni@redhat.com> wrote: > > On Tue, 2022-08-02 at 23:46 -0700, Eric Dumazet wrote: > > On Tue, Aug 2, 2022 at 11:23 PM Paolo Abeni <pabeni@redhat.com> wrote: > > > > > > On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: > > > > From: Eric Dumazet <edumazet@google.com> > > > > > > > > While investigating a separate rose issue [1], and enabling > > > > CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > > > > > > > > An ax25_dev can be used by one (or many) struct ax25_cb. > > > > We thus need different dev_tracker, one per struct ax25_cb. > > > > > > > > After this patch is applied, we are able to focus on rose. > > > > > > > > [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ > > > > > > > > [2] > > > > [ 205.798723] reference already released. > > > > [ 205.798732] allocated in: > > > > [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] > > > > [ 205.798747] __sys_bind+0xea/0x110 > > > > [ 205.798753] __x64_sys_bind+0x18/0x20 > > > > [ 205.798758] do_syscall_64+0x5c/0x80 > > > > [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > > [ 205.798768] freed in: > > > > [ 205.798770] ax25_release+0x115/0x370 [ax25] > > > > [ 205.798778] __sock_release+0x42/0xb0 > > > > [ 205.798782] sock_close+0x15/0x20 > > > > [ 205.798785] __fput+0x9f/0x260 > > > > [ 205.798789] ____fput+0xe/0x10 > > > > [ 205.798792] task_work_run+0x64/0xa0 > > > > [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 > > > > [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 > > > > [ 205.798808] do_syscall_64+0x69/0x80 > > > > [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > > [ 205.798827] ------------[ cut here ]------------ > > > > [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 > > > > [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video > > > > [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] > > > > [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 > > > > [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 > > > > [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 > > > > [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e > > > > [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 > > > > [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 > > > > [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff > > > > [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 > > > > [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 > > > > [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 > > > > [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 > > > > [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > > [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 > > > > [ 205.799033] Call Trace: > > > > [ 205.799035] <TASK> > > > > [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] > > > > [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] > > > > [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 > > > > [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 > > > > [ 205.799065] ? dev_close_many+0xc8/0x120 > > > > [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 > > > > [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 > > > > [ 205.799076] ? unregister_netdev+0x1d/0x30 > > > > [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] > > > > [ 205.799084] ? tty_ldisc_close+0x2e/0x40 > > > > [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 > > > > [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 > > > > [ 205.799098] ? tty_vhangup+0x15/0x20 > > > > [ 205.799103] ? pty_close+0x127/0x160 > > > > [ 205.799108] ? tty_release+0x139/0x5e0 > > > > [ 205.799112] ? __fput+0x9f/0x260 > > > > [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] > > > > [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] > > > > [ 205.799135] raw_notifier_call_chain+0x49/0x60 > > > > [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 > > > > [ 205.799146] dev_close_many+0xc8/0x120 > > > > [ 205.799152] unregister_netdevice_many+0x13d/0x890 > > > > [ 205.799157] unregister_netdevice_queue+0x90/0xe0 > > > > [ 205.799161] unregister_netdev+0x1d/0x30 > > > > [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] > > > > [ 205.799170] tty_ldisc_close+0x2e/0x40 > > > > [ 205.799173] tty_ldisc_hangup+0x137/0x210 > > > > [ 205.799178] __tty_hangup.part.0+0x208/0x350 > > > > [ 205.799184] tty_vhangup+0x15/0x20 > > > > [ 205.799188] pty_close+0x127/0x160 > > > > [ 205.799193] tty_release+0x139/0x5e0 > > > > [ 205.799199] __fput+0x9f/0x260 > > > > [ 205.799203] ____fput+0xe/0x10 > > > > [ 205.799208] task_work_run+0x64/0xa0 > > > > [ 205.799213] do_exit+0x33b/0xab0 > > > > [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 > > > > [ 205.799224] do_group_exit+0x35/0xa0 > > > > [ 205.799228] __x64_sys_exit_group+0x18/0x20 > > > > [ 205.799232] do_syscall_64+0x5c/0x80 > > > > [ 205.799238] ? handle_mm_fault+0xba/0x290 > > > > [ 205.799242] ? debug_smp_processor_id+0x17/0x20 > > > > [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 > > > > [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 > > > > [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 > > > > [ 205.799260] ? irqentry_exit+0x33/0x40 > > > > [ 205.799263] ? exc_page_fault+0x87/0x170 > > > > [ 205.799268] ? asm_exc_page_fault+0x8/0x30 > > > > [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae > > > > [ 205.799277] RIP: 0033:0x7ff6b80eaca1 > > > > [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. > > > > [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > > > [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 > > > > [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 > > > > [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 > > > > [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 > > > > [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 > > > > [ 205.799304] </TASK> > > > > > > > > Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") > > > > Reported-by: Bernard F6BVP <f6bvp@free.fr> > > > > Signed-off-by: Eric Dumazet <edumazet@google.com> > > > > Cc: Duoming Zhou <duoming@zju.edu.cn> > > > > --- > > > > include/net/ax25.h | 1 + > > > > net/ax25/af_ax25.c | 4 ++-- > > > > 2 files changed, 3 insertions(+), 2 deletions(-) > > > > > > > > diff --git a/include/net/ax25.h b/include/net/ax25.h > > > > index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 > > > > --- a/include/net/ax25.h > > > > +++ b/include/net/ax25.h > > > > @@ -236,6 +236,7 @@ typedef struct ax25_cb { > > > > ax25_address source_addr, dest_addr; > > > > ax25_digi *digipeat; > > > > ax25_dev *ax25_dev; > > > > + netdevice_tracker dev_tracker; > > > > unsigned char iamdigi; > > > > unsigned char state, modulus, pidincl; > > > > unsigned short vs, vr, va; > > > > > > I'm sorry for the [too] late feedback, but it looks like this patch > > > forgot to remove the old/unused tracker from ax25_dev, or am I missing > > > something? > > > > I think you are confused ;) > > Indeed I'm (hopefully I was). > > > > The other tracker is still used. > > > > Only the blamed patch (feef318c855a ("ax25: fix UAF bugs of net_device > > caused by rebinding operation")) needed > > a separate tracker in 'struct ax25_cb'. > > So this conflict resolution: > > https://lore.kernel.org/linux-next/20220802151932.2830110-1-broonie@kernel.org/T/#u > > is wrong - the first chunck must be dropped, only the last 2 are > required, right? Indeed, this conflict resolution is wrong. I knew this renaming thing was going to hurt us, this is only the beginning :/ Thanks. > > Thanks, > > Paolo >
This patch is still not applied to net-next. This is probably due to renaming thing ... that was confusing. Any possibility to build on for old stables ? Eric could you clarify the situation ? Regards, Bernard Le 03/08/2022 à 09:15, Eric Dumazet a écrit : > On Wed, Aug 3, 2022 at 12:03 AM Paolo Abeni <pabeni@redhat.com> wrote: >> >> On Tue, 2022-08-02 at 23:46 -0700, Eric Dumazet wrote: >>> On Tue, Aug 2, 2022 at 11:23 PM Paolo Abeni <pabeni@redhat.com> wrote: >>>> >>>> On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: >>>>> From: Eric Dumazet <edumazet@google.com> >>>>> >>>>> While investigating a separate rose issue [1], and enabling >>>>> CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] >>>>> >>>>> An ax25_dev can be used by one (or many) struct ax25_cb. >>>>> We thus need different dev_tracker, one per struct ax25_cb. >>>>> >>>>> After this patch is applied, we are able to focus on rose. >>>>> >>>>> [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ >>>>> >>>>> [2] >>>>> [ 205.798723] reference already released. >>>>> [ 205.798732] allocated in: >>>>> [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] >>>>> [ 205.798747] __sys_bind+0xea/0x110 >>>>> [ 205.798753] __x64_sys_bind+0x18/0x20 >>>>> [ 205.798758] do_syscall_64+0x5c/0x80 >>>>> [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae >>>>> [ 205.798768] freed in: >>>>> [ 205.798770] ax25_release+0x115/0x370 [ax25] >>>>> [ 205.798778] __sock_release+0x42/0xb0 >>>>> [ 205.798782] sock_close+0x15/0x20 >>>>> [ 205.798785] __fput+0x9f/0x260 >>>>> [ 205.798789] ____fput+0xe/0x10 >>>>> [ 205.798792] task_work_run+0x64/0xa0 >>>>> [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 >>>>> [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 >>>>> [ 205.798808] do_syscall_64+0x69/0x80 >>>>> [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae >>>>> [ 205.798827] ------------[ cut here ]------------ >>>>> [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 >>>>> [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video >>>>> [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] >>>>> [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 >>>>> [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 >>>>> [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 >>>>> [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e >>>>> [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 >>>>> [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 >>>>> [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff >>>>> [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 >>>>> [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 >>>>> [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 >>>>> [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 >>>>> [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>>>> [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 >>>>> [ 205.799033] Call Trace: >>>>> [ 205.799035] <TASK> >>>>> [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] >>>>> [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] >>>>> [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 >>>>> [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 >>>>> [ 205.799065] ? dev_close_many+0xc8/0x120 >>>>> [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 >>>>> [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 >>>>> [ 205.799076] ? unregister_netdev+0x1d/0x30 >>>>> [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] >>>>> [ 205.799084] ? tty_ldisc_close+0x2e/0x40 >>>>> [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 >>>>> [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 >>>>> [ 205.799098] ? tty_vhangup+0x15/0x20 >>>>> [ 205.799103] ? pty_close+0x127/0x160 >>>>> [ 205.799108] ? tty_release+0x139/0x5e0 >>>>> [ 205.799112] ? __fput+0x9f/0x260 >>>>> [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] >>>>> [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] >>>>> [ 205.799135] raw_notifier_call_chain+0x49/0x60 >>>>> [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 >>>>> [ 205.799146] dev_close_many+0xc8/0x120 >>>>> [ 205.799152] unregister_netdevice_many+0x13d/0x890 >>>>> [ 205.799157] unregister_netdevice_queue+0x90/0xe0 >>>>> [ 205.799161] unregister_netdev+0x1d/0x30 >>>>> [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] >>>>> [ 205.799170] tty_ldisc_close+0x2e/0x40 >>>>> [ 205.799173] tty_ldisc_hangup+0x137/0x210 >>>>> [ 205.799178] __tty_hangup.part.0+0x208/0x350 >>>>> [ 205.799184] tty_vhangup+0x15/0x20 >>>>> [ 205.799188] pty_close+0x127/0x160 >>>>> [ 205.799193] tty_release+0x139/0x5e0 >>>>> [ 205.799199] __fput+0x9f/0x260 >>>>> [ 205.799203] ____fput+0xe/0x10 >>>>> [ 205.799208] task_work_run+0x64/0xa0 >>>>> [ 205.799213] do_exit+0x33b/0xab0 >>>>> [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 >>>>> [ 205.799224] do_group_exit+0x35/0xa0 >>>>> [ 205.799228] __x64_sys_exit_group+0x18/0x20 >>>>> [ 205.799232] do_syscall_64+0x5c/0x80 >>>>> [ 205.799238] ? handle_mm_fault+0xba/0x290 >>>>> [ 205.799242] ? debug_smp_processor_id+0x17/0x20 >>>>> [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 >>>>> [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 >>>>> [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 >>>>> [ 205.799260] ? irqentry_exit+0x33/0x40 >>>>> [ 205.799263] ? exc_page_fault+0x87/0x170 >>>>> [ 205.799268] ? asm_exc_page_fault+0x8/0x30 >>>>> [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae >>>>> [ 205.799277] RIP: 0033:0x7ff6b80eaca1 >>>>> [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. >>>>> [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>>>> [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 >>>>> [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 >>>>> [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 >>>>> [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 >>>>> [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 >>>>> [ 205.799304] </TASK> >>>>> >>>>> Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") >>>>> Reported-by: Bernard F6BVP <f6bvp@free.fr> >>>>> Signed-off-by: Eric Dumazet <edumazet@google.com> >>>>> Cc: Duoming Zhou <duoming@zju.edu.cn> >>>>> --- >>>>> include/net/ax25.h | 1 + >>>>> net/ax25/af_ax25.c | 4 ++-- >>>>> 2 files changed, 3 insertions(+), 2 deletions(-) >>>>> >>>>> diff --git a/include/net/ax25.h b/include/net/ax25.h >>>>> index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 >>>>> --- a/include/net/ax25.h >>>>> +++ b/include/net/ax25.h >>>>> @@ -236,6 +236,7 @@ typedef struct ax25_cb { >>>>> ax25_address source_addr, dest_addr; >>>>> ax25_digi *digipeat; >>>>> ax25_dev *ax25_dev; >>>>> + netdevice_tracker dev_tracker; >>>>> unsigned char iamdigi; >>>>> unsigned char state, modulus, pidincl; >>>>> unsigned short vs, vr, va; >>>> >>>> I'm sorry for the [too] late feedback, but it looks like this patch >>>> forgot to remove the old/unused tracker from ax25_dev, or am I missing >>>> something? >>> >>> I think you are confused ;) >> >> Indeed I'm (hopefully I was). >> >> >>> The other tracker is still used. >>> >>> Only the blamed patch (feef318c855a ("ax25: fix UAF bugs of net_device >>> caused by rebinding operation")) needed >>> a separate tracker in 'struct ax25_cb'. >> >> So this conflict resolution: >> >> https://lore.kernel.org/linux-next/20220802151932.2830110-1-broonie@kernel.org/T/#u >> >> is wrong - the first chunck must be dropped, only the last 2 are >> required, right? > > Indeed, this conflict resolution is wrong. > > I knew this renaming thing was going to hurt us, this is only the beginning :/ > > Thanks. > >> >> Thanks, >> >> Paolo >>
On Sat, Sep 3, 2022 at 1:57 AM Bernard Pidoux <bernard.f6bvp@gmail.com> wrote: > > This patch is still not applied to net-next. > This is probably due to renaming thing ... that was confusing. > > Any possibility to build on for old stables ? > > Eric could you clarify the situation ? > > Regards, > > Bernard > Patch is definitely there. Let me point you to the relevant parts, with a fake diff on the current net-next tree. diff --git a/include/net/ax25.h b/include/net/ax25.h index f8cf3629a41934f96f33e5d70ad90cc8ae796d38..025a9f5d9f67d77897e3caf4c2ca1ef4b42c8c6c 100644 --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -236,7 +236,7 @@ typedef struct ax25_cb { ax25_address source_addr, dest_addr; ax25_digi *digipeat; ax25_dev *ax25_dev; - netdevice_tracker dev_tracker; +// netdevice_tracker dev_tracker; unsigned char iamdigi; unsigned char state, modulus, pidincl; unsigned short vs, vr, va; diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index 6b4c25a9237746265158900ab92d7f411b77ab79..c0a2e860eeaa76a7cd4c9f8068aa03659ce9452a 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1066,7 +1066,7 @@ static int ax25_release(struct socket *sock) del_timer_sync(&ax25->t3timer); del_timer_sync(&ax25->idletimer); } - netdev_put(ax25_dev->dev, &ax25->dev_tracker); +// netdev_put(ax25_dev->dev, &ax25->dev_tracker); ax25_dev_put(ax25_dev); } @@ -1147,7 +1147,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) if (ax25_dev) { ax25_fillin_cb(ax25, ax25_dev); - netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC); +// netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC); } done: > Le 03/08/2022 à 09:15, Eric Dumazet a écrit : > > On Wed, Aug 3, 2022 at 12:03 AM Paolo Abeni <pabeni@redhat.com> wrote: > >> > >> On Tue, 2022-08-02 at 23:46 -0700, Eric Dumazet wrote: > >>> On Tue, Aug 2, 2022 at 11:23 PM Paolo Abeni <pabeni@redhat.com> wrote: > >>>> > >>>> On Wed, 2022-07-27 at 22:18 -0700, Eric Dumazet wrote: > >>>>> From: Eric Dumazet <edumazet@google.com> > >>>>> > >>>>> While investigating a separate rose issue [1], and enabling > >>>>> CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] > >>>>> > >>>>> An ax25_dev can be used by one (or many) struct ax25_cb. > >>>>> We thus need different dev_tracker, one per struct ax25_cb. > >>>>> > >>>>> After this patch is applied, we are able to focus on rose. > >>>>> > >>>>> [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ > >>>>> > >>>>> [2] > >>>>> [ 205.798723] reference already released. > >>>>> [ 205.798732] allocated in: > >>>>> [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] > >>>>> [ 205.798747] __sys_bind+0xea/0x110 > >>>>> [ 205.798753] __x64_sys_bind+0x18/0x20 > >>>>> [ 205.798758] do_syscall_64+0x5c/0x80 > >>>>> [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae > >>>>> [ 205.798768] freed in: > >>>>> [ 205.798770] ax25_release+0x115/0x370 [ax25] > >>>>> [ 205.798778] __sock_release+0x42/0xb0 > >>>>> [ 205.798782] sock_close+0x15/0x20 > >>>>> [ 205.798785] __fput+0x9f/0x260 > >>>>> [ 205.798789] ____fput+0xe/0x10 > >>>>> [ 205.798792] task_work_run+0x64/0xa0 > >>>>> [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 > >>>>> [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 > >>>>> [ 205.798808] do_syscall_64+0x69/0x80 > >>>>> [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae > >>>>> [ 205.798827] ------------[ cut here ]------------ > >>>>> [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 > >>>>> [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video > >>>>> [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] > >>>>> [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 > >>>>> [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 > >>>>> [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 > >>>>> [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e > >>>>> [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 > >>>>> [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 > >>>>> [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff > >>>>> [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 > >>>>> [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 > >>>>> [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 > >>>>> [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 > >>>>> [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > >>>>> [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 > >>>>> [ 205.799033] Call Trace: > >>>>> [ 205.799035] <TASK> > >>>>> [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] > >>>>> [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] > >>>>> [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 > >>>>> [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 > >>>>> [ 205.799065] ? dev_close_many+0xc8/0x120 > >>>>> [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 > >>>>> [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 > >>>>> [ 205.799076] ? unregister_netdev+0x1d/0x30 > >>>>> [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] > >>>>> [ 205.799084] ? tty_ldisc_close+0x2e/0x40 > >>>>> [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 > >>>>> [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 > >>>>> [ 205.799098] ? tty_vhangup+0x15/0x20 > >>>>> [ 205.799103] ? pty_close+0x127/0x160 > >>>>> [ 205.799108] ? tty_release+0x139/0x5e0 > >>>>> [ 205.799112] ? __fput+0x9f/0x260 > >>>>> [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] > >>>>> [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] > >>>>> [ 205.799135] raw_notifier_call_chain+0x49/0x60 > >>>>> [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 > >>>>> [ 205.799146] dev_close_many+0xc8/0x120 > >>>>> [ 205.799152] unregister_netdevice_many+0x13d/0x890 > >>>>> [ 205.799157] unregister_netdevice_queue+0x90/0xe0 > >>>>> [ 205.799161] unregister_netdev+0x1d/0x30 > >>>>> [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] > >>>>> [ 205.799170] tty_ldisc_close+0x2e/0x40 > >>>>> [ 205.799173] tty_ldisc_hangup+0x137/0x210 > >>>>> [ 205.799178] __tty_hangup.part.0+0x208/0x350 > >>>>> [ 205.799184] tty_vhangup+0x15/0x20 > >>>>> [ 205.799188] pty_close+0x127/0x160 > >>>>> [ 205.799193] tty_release+0x139/0x5e0 > >>>>> [ 205.799199] __fput+0x9f/0x260 > >>>>> [ 205.799203] ____fput+0xe/0x10 > >>>>> [ 205.799208] task_work_run+0x64/0xa0 > >>>>> [ 205.799213] do_exit+0x33b/0xab0 > >>>>> [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 > >>>>> [ 205.799224] do_group_exit+0x35/0xa0 > >>>>> [ 205.799228] __x64_sys_exit_group+0x18/0x20 > >>>>> [ 205.799232] do_syscall_64+0x5c/0x80 > >>>>> [ 205.799238] ? handle_mm_fault+0xba/0x290 > >>>>> [ 205.799242] ? debug_smp_processor_id+0x17/0x20 > >>>>> [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 > >>>>> [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 > >>>>> [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 > >>>>> [ 205.799260] ? irqentry_exit+0x33/0x40 > >>>>> [ 205.799263] ? exc_page_fault+0x87/0x170 > >>>>> [ 205.799268] ? asm_exc_page_fault+0x8/0x30 > >>>>> [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae > >>>>> [ 205.799277] RIP: 0033:0x7ff6b80eaca1 > >>>>> [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. > >>>>> [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > >>>>> [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 > >>>>> [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 > >>>>> [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 > >>>>> [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 > >>>>> [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 > >>>>> [ 205.799304] </TASK> > >>>>> > >>>>> Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") > >>>>> Reported-by: Bernard F6BVP <f6bvp@free.fr> > >>>>> Signed-off-by: Eric Dumazet <edumazet@google.com> > >>>>> Cc: Duoming Zhou <duoming@zju.edu.cn> > >>>>> --- > >>>>> include/net/ax25.h | 1 + > >>>>> net/ax25/af_ax25.c | 4 ++-- > >>>>> 2 files changed, 3 insertions(+), 2 deletions(-) > >>>>> > >>>>> diff --git a/include/net/ax25.h b/include/net/ax25.h > >>>>> index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 > >>>>> --- a/include/net/ax25.h > >>>>> +++ b/include/net/ax25.h > >>>>> @@ -236,6 +236,7 @@ typedef struct ax25_cb { > >>>>> ax25_address source_addr, dest_addr; > >>>>> ax25_digi *digipeat; > >>>>> ax25_dev *ax25_dev; > >>>>> + netdevice_tracker dev_tracker; > >>>>> unsigned char iamdigi; > >>>>> unsigned char state, modulus, pidincl; > >>>>> unsigned short vs, vr, va; > >>>> > >>>> I'm sorry for the [too] late feedback, but it looks like this patch > >>>> forgot to remove the old/unused tracker from ax25_dev, or am I missing > >>>> something? > >>> > >>> I think you are confused ;) > >> > >> Indeed I'm (hopefully I was). > >> > >> > >>> The other tracker is still used. > >>> > >>> Only the blamed patch (feef318c855a ("ax25: fix UAF bugs of net_device > >>> caused by rebinding operation")) needed > >>> a separate tracker in 'struct ax25_cb'. > >> > >> So this conflict resolution: > >> > >> https://lore.kernel.org/linux-next/20220802151932.2830110-1-broonie@kernel.org/T/#u > >> > >> is wrong - the first chunck must be dropped, only the last 2 are > >> required, right? > > > > Indeed, this conflict resolution is wrong. > > > > I knew this renaming thing was going to hurt us, this is only the beginning :/ > > > > Thanks. > > > >> > >> Thanks, > >> > >> Paolo > >>
refcount warning when a rose connection is performed from remote node:
[26215.100860] NET: Registered PF_AX25 protocol family
[26215.108188] mkiss: AX.25 Multikiss, Hans Albas PE1AYX
[26215.108896] mkiss: ax0: crc mode is auto.
[26215.109078] IPv6: ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready
[26219.157349] NET: Registered PF_ROSE protocol family
[26226.215278] mkiss: ax0: Trying crc-smack
[26226.215429] mkiss: ax0: Trying crc-flexnet
[26442.283263] ------------[ cut here ]------------
[26442.283282] refcount_t: decrement hit 0; leaking memory.
[26442.283309] WARNING: CPU: 3 PID: 5541 at lib/refcount.c:31
refcount_warn_saturate+0x4c/0x150
[26442.283333] Modules linked in: rose mkiss ax25 rfcomm
snd_hda_codec_hdmi cmac algif_hash algif_skcipher af_alg bnep i915
nls_iso8859_1 x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel
snd_hda_codec_realtek snd_hda_codec_generic rtw88_8821ce ledtrig_audio
kvm i2c_algo_bit rtw88_8821c drm_buddy snd_hda_intel rtw88_pci btusb
drm_display_helper snd_intel_dspcfg btrtl rtw88_core snd_hda_codec
crct10dif_pclmul snd_hwdep crc32_pclmul snd_hda_core ghash_clmulni_intel
btbcm aesni_intel drm_kms_helper btintel snd_pcm mei_hdcp btmtk
crypto_simd intel_rapl_msr mac80211 syscopyarea snd_seq cryptd
sysfillrect bluetooth sysimgblt fb_sys_fops cec
processor_thermal_device_pci_legacy rapl snd_timer intel_soc_dts_iosf
libarc4 rc_core at24 input_leds joydev processor_thermal_device
intel_cstate cfg80211 snd_seq_device processor_thermal_rfim ecdh_generic
ttm snd processor_thermal_mbox processor_thermal_rapl mei_me
intel_pch_thermal ecc mei intel_rapl_common soundcore
[26442.283525] int340x_thermal_zone acpi_pad video mac_hid ipmi_devintf
ipmi_msghandler drm msr parport_pc ppdev lp ramoops parport pstore_blk
reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs
blake2b_generic libcrc32c xor raid6_pq zstd_compress dm_mirror
dm_region_hash dm_log hid_generic usbhid hid i2c_i801 ahci r8169
i2c_smbus libahci lpc_ich xhci_pci realtek xhci_pci_renesas
[26442.283644] CPU: 3 PID: 5541 Comm: kworker/u8:2 Not tainted
6.0.0-rc3-DEBUG+ #5
[26442.283655] Hardware name: To be filled by O.E.M. To be filled by
O.E.M./CK3, BIOS 5.011 09/16/2020
[26442.283663] Workqueue: events_unbound flush_to_ldisc
[26442.283686] RIP: 0010:refcount_warn_saturate+0x4c/0x150
[26442.283711] Code: 00 00 0f b6 1d 6c 10 52 01 80 fb 01 0f 87 3a 04 6c
00 83 e3 01 75 34 48 c7 c7 70 bc 21 bb c6 05 50 10 52 01 01 e8 59 0c 68
00 <0f> 0b eb 1d 85 f6 74 4f 0f b6 1d 3f 10 52 01 80 fb 01 0f 87 f6 03
[26442.283723] RSP: 0018:ffffa20940174ad8 EFLAGS: 00010286
[26442.283734] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[26442.283742] RDX: 0000000000000504 RSI: ffffffffbb1cdaf1 RDI:
00000000ffffffff
[26442.283750] RBP: ffffa20940174ae0 R08: 0000000000000003 R09:
3b30207469682074
[26442.283758] R10: 203a745f746e756f R11: 746e756f63666572 R12:
ffff92316c140490
[26442.283766] R13: 0000000000000000 R14: 0000000000000001 R15:
ffff92316b561800
[26442.283774] FS: 0000000000000000(0000) GS:ffff92328f380000(0000)
knlGS:0000000000000000
[26442.283783] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[26442.283791] CR2: 00005634bae01a08 CR3: 0000000166410006 CR4:
00000000001706e0
[26442.283801] Call Trace:
[26442.283807] <IRQ>
[26442.283816] ref_tracker_free+0x181/0x1c0
[26442.283836] rose_route_frame+0x298/0x740 [rose]
[26442.283856] ? pollwake+0x72/0x90
[26442.283869] ? wake_up_q+0x90/0x90
[26442.283884] ? __wake_up_common+0x7d/0x140
[26442.283896] ? rose_link_device_down+0x50/0x50 [rose]
[26442.283916] ax25_rx_iframe.part.0+0x8a/0x340 [ax25]
[26442.283937] ax25_rx_iframe+0x13/0x20 [ax25]
[26442.283957] ax25_std_frame_in+0x7ae/0x810 [ax25]
[26442.283979] ax25_rcv.constprop.0+0x5ee/0x880 [ax25]
[26442.284002] ? __netif_receive_skb_core.constprop.0+0x725/0x10b0
[26442.284021] ax25_kiss_rcv+0x6c/0x90 [ax25]
[26442.284041] __netif_receive_skb_one_core+0x91/0xa0
[26442.284054] __netif_receive_skb+0x15/0x60
[26442.284066] process_backlog+0x96/0x140
[26442.284079] __napi_poll+0x33/0x190
[26442.284091] net_rx_action+0x19f/0x300
[26442.284105] __do_softirq+0x103/0x366
[26442.284123] do_softirq.part.0+0xa4/0xd0
[26442.284138] </IRQ>
[26442.284145] <TASK>
[26442.284152] __local_bh_enable_ip+0x87/0x90
[26442.284166] _raw_spin_unlock_bh+0x1d/0x30
[26442.284178] mkiss_receive_buf+0x330/0x3d0 [mkiss]
[26442.284195] tty_ldisc_receive_buf+0x4b/0x60
[26442.284209] tty_port_default_receive_buf+0x42/0x70
[26442.284225] flush_to_ldisc+0xb8/0x1b0
[26442.284240] process_one_work+0x21f/0x3f0
[26442.284257] worker_thread+0x50/0x3e0
[26442.284271] ? process_one_work+0x3f0/0x3f0
[26442.284326] kthread+0xfd/0x130
[26442.284345] ? kthread_complete_and_exit+0x20/0x20
[26442.284365] ret_from_fork+0x22/0x30
[26442.284393] </TASK>
[26442.284404] ---[ end trace 0000000000000000 ]---
[26442.284494] ------------[ cut here ]------------
[26442.284508] refcount_t: saturated; leaking memory.
[26442.284537] WARNING: CPU: 3 PID: 34 at lib/refcount.c:22
refcount_warn_saturate+0x144/0x150
[26442.284564] Modules linked in: rose mkiss ax25 rfcomm
snd_hda_codec_hdmi cmac algif_hash algif_skcipher af_alg bnep i915
nls_iso8859_1 x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel
snd_hda_codec_realtek snd_hda_codec_generic rtw88_8821ce ledtrig_audio
kvm i2c_algo_bit rtw88_8821c drm_buddy snd_hda_intel rtw88_pci btusb
drm_display_helper snd_intel_dspcfg btrtl rtw88_core snd_hda_codec
crct10dif_pclmul snd_hwdep crc32_pclmul snd_hda_core ghash_clmulni_intel
btbcm aesni_intel drm_kms_helper btintel snd_pcm mei_hdcp btmtk
crypto_simd intel_rapl_msr mac80211 syscopyarea snd_seq cryptd
sysfillrect bluetooth sysimgblt fb_sys_fops cec
processor_thermal_device_pci_legacy rapl snd_timer intel_soc_dts_iosf
libarc4 rc_core at24 input_leds joydev processor_thermal_device
intel_cstate cfg80211 snd_seq_device processor_thermal_rfim ecdh_generic
ttm snd processor_thermal_mbox processor_thermal_rapl mei_me
intel_pch_thermal ecc mei intel_rapl_common soundcore
[26442.284833] int340x_thermal_zone acpi_pad video mac_hid ipmi_devintf
ipmi_msghandler drm msr parport_pc ppdev lp ramoops parport pstore_blk
reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs
blake2b_generic libcrc32c xor raid6_pq zstd_compress dm_mirror
dm_region_hash dm_log hid_generic usbhid hid i2c_i801 ahci r8169
i2c_smbus libahci lpc_ich xhci_pci realtek xhci_pci_renesas
[26442.284958] CPU: 3 PID: 34 Comm: ksoftirqd/3 Tainted: G W
6.0.0-rc3-DEBUG+ #5
[26442.284976] Hardware name: To be filled by O.E.M. To be filled by
O.E.M./CK3, BIOS 5.011 09/16/2020
[26442.284987] RIP: 0010:refcount_warn_saturate+0x144/0x150
[26442.285008] Code: a0 bc 21 bb c6 05 71 0f 52 01 01 e8 7b 0b 68 00 0f
0b e9 3c ff ff ff 48 c7 c7 f0 bb 21 bb c6 05 5b 0f 52 01 01 e8 61 0b 68
00 <0f> 0b e9 22 ff ff ff 0f 1f 44 00 00 8b 07 3d 00 00 00 c0 74 12 83
[26442.285024] RSP: 0018:ffffa2094015f990 EFLAGS: 00010286
[26442.285042] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[26442.285056] RDX: 0000000000000503 RSI: ffffffffbb1cdaf1 RDI:
00000000ffffffff
[26442.285070] RBP: ffffa2094015f998 R08: 0000000000000003 R09:
3b64657461727574
[26442.285086] R10: 00000000756f6366 R11: 0000000063666572 R12:
ffff92316c140490
[26442.285100] R13: 0000000000000a20 R14: 0000000000000000 R15:
0000000000000000
[26442.285114] FS: 0000000000000000(0000) GS:ffff92328f380000(0000)
knlGS:0000000000000000
[26442.285123] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[26442.285131] CR2: 00005634bae01a08 CR3: 0000000166410006 CR4:
00000000001706e0
[26442.285140] Call Trace:
[26442.285146] <TASK>
[26442.285155] ref_tracker_alloc+0x170/0x220
[26442.285169] ? __smp_call_single_queue+0x59/0x90
[26442.285184] ? ttwu_queue_wakelist+0xff/0x1d0
[26442.285196] ? _raw_spin_unlock_irqrestore+0x27/0x50
[26442.285210] rose_dev_get+0x8a/0xa0 [rose]
[26442.285228] rose_route_frame+0x267/0x740 [rose]
[26442.285245] ? pollwake+0x72/0x90
[26442.285255] ? wake_up_q+0x90/0x90
[26442.285268] ? __wake_up_common+0x7d/0x140
[26442.285279] ? rose_link_device_down+0x50/0x50 [rose]
[26442.285294] ax25_rx_iframe.part.0+0x8a/0x340 [ax25]
[26442.285313] ax25_rx_iframe+0x13/0x20 [ax25]
[26442.285330] ax25_std_frame_in+0x7ae/0x810 [ax25]
[26442.285350] ax25_rcv.constprop.0+0x5ee/0x880 [ax25]
[26442.285369] ? __netif_receive_skb_core.constprop.0+0x725/0x10b0
[26442.285385] ax25_kiss_rcv+0x6c/0x90 [ax25]
[26442.285402] __netif_receive_skb_one_core+0x91/0xa0
[26442.285414] __netif_receive_skb+0x15/0x60
[26442.285424] process_backlog+0x96/0x140
[26442.285436] __napi_poll+0x33/0x190
[26442.285447] net_rx_action+0x19f/0x300
[26442.285460] __do_softirq+0x103/0x366
[26442.285475] run_ksoftirqd+0x39/0x50
[26442.285488] smpboot_thread_fn+0x193/0x230
[26442.285500] ? sort_range+0x30/0x30
[26442.285509] kthread+0xfd/0x130
[26442.285521] ? kthread_complete_and_exit+0x20/0x20
[26442.285534] ret_from_fork+0x22/0x30
[26442.285551] </TASK>
[26442.285557] ---[ end trace 0000000000000000 ]---
[26442.286648] ROSE: unknown 0F in state 3
[26442.287419] ROSE: unknown 17 in state 3
root@bernard-f6bvp:/home/bernard#
diff --git a/include/net/ax25.h b/include/net/ax25.h index a427a05672e2aab158efd44381fe2190d9cb8969..f8cf3629a41934f96f33e5d70ad90cc8ae796d38 100644 --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -236,6 +236,7 @@ typedef struct ax25_cb { ax25_address source_addr, dest_addr; ax25_digi *digipeat; ax25_dev *ax25_dev; + netdevice_tracker dev_tracker; unsigned char iamdigi; unsigned char state, modulus, pidincl; unsigned short vs, vr, va; diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index 4c7030ed8d3319448f6cb158417c650308e341b8..5b5363c99ed50c2b8baad246d3ec1757e0afd0d9 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1065,7 +1065,7 @@ static int ax25_release(struct socket *sock) del_timer_sync(&ax25->t3timer); del_timer_sync(&ax25->idletimer); } - dev_put_track(ax25_dev->dev, &ax25_dev->dev_tracker); + dev_put_track(ax25_dev->dev, &ax25->dev_tracker); ax25_dev_put(ax25_dev); } @@ -1146,7 +1146,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) if (ax25_dev) { ax25_fillin_cb(ax25, ax25_dev); - dev_hold_track(ax25_dev->dev, &ax25_dev->dev_tracker, GFP_ATOMIC); + dev_hold_track(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC); } done: