| Message ID | 20230530113941.1674072-1-VEfanov@ispras.ru (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 448a5ce1120c5bdbce1f1ccdabcd31c7d029f328 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] udp6: Fix race condition in udp6_sendmsg & connect | expand |
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Tue, 30 May 2023 14:39:41 +0300 you wrote: > Syzkaller got the following report: > BUG: KASAN: use-after-free in sk_setup_caps+0x621/0x690 net/core/sock.c:2018 > Read of size 8 at addr ffff888027f82780 by task syz-executor276/3255 > > The function sk_setup_caps (called by ip6_sk_dst_store_flow-> > ip6_dst_store) referenced already freed memory as this memory was > freed by parallel task in udpv6_sendmsg->ip6_sk_dst_lookup_flow-> > sk_dst_check. > > [...] Here is the summary with links: - [v2] udp6: Fix race condition in udp6_sendmsg & connect https://git.kernel.org/netdev/net/c/448a5ce1120c You are awesome, thank you!
diff --git a/net/core/sock.c b/net/core/sock.c index 5440e67bcfe3..24f2761bdb1d 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2381,7 +2381,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) { u32 max_segs = 1; - sk_dst_set(sk, dst); sk->sk_route_caps = dst->dev->features; if (sk_is_tcp(sk)) sk->sk_route_caps |= NETIF_F_GSO; @@ -2400,6 +2399,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) } } sk->sk_gso_max_segs = max_segs; + sk_dst_set(sk, dst); } EXPORT_SYMBOL_GPL(sk_setup_caps);
Syzkaller got the following report: BUG: KASAN: use-after-free in sk_setup_caps+0x621/0x690 net/core/sock.c:2018 Read of size 8 at addr ffff888027f82780 by task syz-executor276/3255 The function sk_setup_caps (called by ip6_sk_dst_store_flow-> ip6_dst_store) referenced already freed memory as this memory was freed by parallel task in udpv6_sendmsg->ip6_sk_dst_lookup_flow-> sk_dst_check. task1 (connect) task2 (udp6_sendmsg) sk_setup_caps->sk_dst_set | | sk_dst_check-> | sk_dst_set | dst_release sk_setup_caps references | to already freed dst_entry| The reason for this race condition is: sk_setup_caps() keeps using the dst after transferring the ownership to the dst cache. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru> Signed-off-by: Paolo Abeni <pabeni@redhat.com> --- v2: Move sk_dst_set() call in sk_setup_caps() as Paolo Abeni <pabeni@redhat.com> suggested. net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)