| Message ID | 20231017083723.1364940-2-steffen.klassert@secunet.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6d41d4fe28724db16ca1016df0713a07e0cc7448 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [1/7] net: xfrm: skip policies marked as dead while reinserting policies | expand |
Hello: This series was applied to netdev/net.git (main) by Steffen Klassert <steffen.klassert@secunet.com>: On Tue, 17 Oct 2023 10:37:17 +0200 you wrote: > From: Dong Chenchen <dongchenchen2@huawei.com> > > BUG: KASAN: slab-use-after-free in xfrm_policy_inexact_list_reinsert+0xb6/0x430 > Read of size 1 at addr ffff8881051f3bf8 by task ip/668 > > CPU: 2 PID: 668 Comm: ip Not tainted 6.5.0-rc5-00182-g25aa0bebba72-dirty #64 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl+0x72/0xa0 > print_report+0xd0/0x620 > kasan_report+0xb6/0xf0 > xfrm_policy_inexact_list_reinsert+0xb6/0x430 > xfrm_policy_inexact_insert_node.constprop.0+0x537/0x800 > xfrm_policy_inexact_alloc_chain+0x23f/0x320 > xfrm_policy_inexact_insert+0x6b/0x590 > xfrm_policy_insert+0x3b1/0x480 > xfrm_add_policy+0x23c/0x3c0 > xfrm_user_rcv_msg+0x2d0/0x510 > netlink_rcv_skb+0x10d/0x2d0 > xfrm_netlink_rcv+0x49/0x60 > netlink_unicast+0x3fe/0x540 > netlink_sendmsg+0x528/0x970 > sock_sendmsg+0x14a/0x160 > ____sys_sendmsg+0x4fc/0x580 > ___sys_sendmsg+0xef/0x160 > __sys_sendmsg+0xf7/0x1b0 > do_syscall_64+0x3f/0x90 > entry_SYSCALL_64_after_hwframe+0x73/0xdd > > [...] Here is the summary with links: - [1/7] net: xfrm: skip policies marked as dead while reinserting policies https://git.kernel.org/netdev/net/c/6d41d4fe2872 - [2/7] xfrm: interface: use DEV_STATS_INC() https://git.kernel.org/netdev/net/c/f7c4e3e5d4f6 - [3/7] xfrm: fix a data-race in xfrm_gen_index() https://git.kernel.org/netdev/net/c/3e4bc23926b8 - [4/7] xfrm6: fix inet6_dev refcount underflow problem https://git.kernel.org/netdev/net/c/cc9b364bb1d5 - [5/7] net: ipv6: fix return value check in esp_remove_trailer https://git.kernel.org/netdev/net/c/dad4e491e30b - [6/7] net: ipv4: fix return value check in esp_remove_trailer https://git.kernel.org/netdev/net/c/513f61e21933 - [7/7] xfrm: fix a data-race in xfrm_lookup_with_ifid() https://git.kernel.org/netdev/net/c/de5724ca38fd You are awesome, thank you!
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index d6b405782b63..113fb7e9cdaf 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -851,7 +851,7 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net, struct hlist_node *newpos = NULL; bool matches_s, matches_d; - if (!policy->bydst_reinsert) + if (policy->walk.dead || !policy->bydst_reinsert) continue; WARN_ON_ONCE(policy->family != family); @@ -1256,8 +1256,11 @@ static void xfrm_hash_rebuild(struct work_struct *work) struct xfrm_pol_inexact_bin *bin; u8 dbits, sbits; + if (policy->walk.dead) + continue; + dir = xfrm_policy_id2dir(policy->index); - if (policy->walk.dead || dir >= XFRM_POLICY_MAX) + if (dir >= XFRM_POLICY_MAX) continue; if ((dir & XFRM_POLICY_MASK) == XFRM_POLICY_OUT) { @@ -1823,9 +1826,11 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid) again: list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) { + if (pol->walk.dead) + continue; + dir = xfrm_policy_id2dir(pol->index); - if (pol->walk.dead || - dir >= XFRM_POLICY_MAX || + if (dir >= XFRM_POLICY_MAX || pol->type != type) continue; @@ -1862,9 +1867,11 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev, again: list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) { + if (pol->walk.dead) + continue; + dir = xfrm_policy_id2dir(pol->index); - if (pol->walk.dead || - dir >= XFRM_POLICY_MAX || + if (dir >= XFRM_POLICY_MAX || pol->xdo.dev != dev) continue;