| Message ID | 20230608072903.3404438-1-lee@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 04c55383fa5689357bcdd2c8036725a55ed632bc |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,1/1] net/sched: cls_u32: Fix reference counter leak leading to overflow | expand |
On Thu, Jun 8, 2023 at 9:29 AM Lee Jones <lee@kernel.org> wrote: > > In the event of a failure in tcf_change_indev(), u32_set_parms() will > immediately return without decrementing the recently incremented > reference counter. If this happens enough times, the counter will > rollover and the reference freed, leading to a double free which can be > used to do 'bad things'. > > In order to prevent this, move the point of possible failure above the > point where the reference counter is incremented. Also save any > meaningful return values to be applied to the return data at the > appropriate point in time. > > This issue was caught with KASAN. > > Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") > Suggested-by: Eric Dumazet <edumazet@google.com> > Signed-off-by: Lee Jones <lee@kernel.org> > --- Thanks Lee ! Reviewed-by: Eric Dumazet <edumazet@google.com>
On Thu, 08 Jun 2023, Eric Dumazet wrote: > On Thu, Jun 8, 2023 at 9:29 AM Lee Jones <lee@kernel.org> wrote: > > > > In the event of a failure in tcf_change_indev(), u32_set_parms() will > > immediately return without decrementing the recently incremented > > reference counter. If this happens enough times, the counter will > > rollover and the reference freed, leading to a double free which can be > > used to do 'bad things'. > > > > In order to prevent this, move the point of possible failure above the > > point where the reference counter is incremented. Also save any > > meaningful return values to be applied to the return data at the > > appropriate point in time. > > > > This issue was caught with KASAN. > > > > Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") > > Suggested-by: Eric Dumazet <edumazet@google.com> > > Signed-off-by: Lee Jones <lee@kernel.org> > > --- > > Thanks Lee ! No problem. Thanks for your help. > Reviewed-by: Eric Dumazet <edumazet@google.com>
On Thu, Jun 8, 2023 at 3:47 AM Lee Jones <lee@kernel.org> wrote: > > On Thu, 08 Jun 2023, Eric Dumazet wrote: > > > On Thu, Jun 8, 2023 at 9:29 AM Lee Jones <lee@kernel.org> wrote: > > > > > > In the event of a failure in tcf_change_indev(), u32_set_parms() will > > > immediately return without decrementing the recently incremented > > > reference counter. If this happens enough times, the counter will > > > rollover and the reference freed, leading to a double free which can be > > > used to do 'bad things'. > > > > > > In order to prevent this, move the point of possible failure above the > > > point where the reference counter is incremented. Also save any > > > meaningful return values to be applied to the return data at the > > > appropriate point in time. > > > > > > This issue was caught with KASAN. > > > > > > Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") > > > Suggested-by: Eric Dumazet <edumazet@google.com> > > > Signed-off-by: Lee Jones <lee@kernel.org> > > > --- > > > > Thanks Lee ! > > No problem. Thanks for your help. > > > Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> cheers, jamal > -- > Lee Jones [李琼斯]
On Thu, 08 Jun 2023, Jamal Hadi Salim wrote: > On Thu, Jun 8, 2023 at 3:47 AM Lee Jones <lee@kernel.org> wrote: > > > > On Thu, 08 Jun 2023, Eric Dumazet wrote: > > > > > On Thu, Jun 8, 2023 at 9:29 AM Lee Jones <lee@kernel.org> wrote: > > > > > > > > In the event of a failure in tcf_change_indev(), u32_set_parms() will > > > > immediately return without decrementing the recently incremented > > > > reference counter. If this happens enough times, the counter will > > > > rollover and the reference freed, leading to a double free which can be > > > > used to do 'bad things'. > > > > > > > > In order to prevent this, move the point of possible failure above the > > > > point where the reference counter is incremented. Also save any > > > > meaningful return values to be applied to the return data at the > > > > appropriate point in time. > > > > > > > > This issue was caught with KASAN. > > > > > > > > Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") > > > > Suggested-by: Eric Dumazet <edumazet@google.com> > > > > Signed-off-by: Lee Jones <lee@kernel.org> > > > > --- > > > > > > Thanks Lee ! > > > > No problem. Thanks for your help. > > > > > Reviewed-by: Eric Dumazet <edumazet@google.com> > > Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Thanks Jamal.
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Thu, 8 Jun 2023 08:29:03 +0100 you wrote: > In the event of a failure in tcf_change_indev(), u32_set_parms() will > immediately return without decrementing the recently incremented > reference counter. If this happens enough times, the counter will > rollover and the reference freed, leading to a double free which can be > used to do 'bad things'. > > In order to prevent this, move the point of possible failure above the > point where the reference counter is incremented. Also save any > meaningful return values to be applied to the return data at the > appropriate point in time. > > [...] Here is the summary with links: - [v2,1/1] net/sched: cls_u32: Fix reference counter leak leading to overflow https://git.kernel.org/netdev/net/c/04c55383fa56 You are awesome, thank you!
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 4e2e269f121f8..d15d50de79802 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -718,13 +718,19 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, u32 flags, u32 fl_flags, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate_ex(net, tp, tb, est, &n->exts, flags, fl_flags, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -759,13 +765,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; }
In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Lee Jones <lee@kernel.org> --- v1 -> v2: - Instead of decrementing the refcnt in the error path, move the point of failure up above the section which increments it. net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)