| Message ID | 20230715092543.15548-1-yuehaibing@huawei.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | can: bcm: Fix UAF in bcm_proc_show() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Series ignored based on subject |
Hello YueHaibing, thanks for the patch! Indeed the proc entry can be removed as first action after lock_sock(). Good catch! On 2023-07-15 11:25, YueHaibing wrote: > BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 > Read of size 8 at addr ffff888155846230 by task cat/7862 > > CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl+0xd5/0x150 > print_report+0xc1/0x5e0 > kasan_report+0xba/0xf0 > bcm_proc_show+0x969/0xa80 > seq_read_iter+0x4f6/0x1260 > seq_read+0x165/0x210 > proc_reg_read+0x227/0x300 > vfs_read+0x1d5/0x8d0 > ksys_read+0x11e/0x240 > do_syscall_64+0x35/0xb0 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > Allocated by task 7846: > kasan_save_stack+0x1e/0x40 > kasan_set_track+0x21/0x30 > __kasan_kmalloc+0x9e/0xa0 > bcm_sendmsg+0x264b/0x44e0 > sock_sendmsg+0xda/0x180 > ____sys_sendmsg+0x735/0x920 > ___sys_sendmsg+0x11d/0x1b0 > __sys_sendmsg+0xfa/0x1d0 > do_syscall_64+0x35/0xb0 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > Freed by task 7846: > kasan_save_stack+0x1e/0x40 > kasan_set_track+0x21/0x30 > kasan_save_free_info+0x27/0x40 > ____kasan_slab_free+0x161/0x1c0 > slab_free_freelist_hook+0x119/0x220 > __kmem_cache_free+0xb4/0x2e0 > rcu_core+0x809/0x1bd0 > > bcm_op is freed before procfs entry be removed in bcm_release(), > this lead to bcm_proc_show() may read the freed bcm_op. > > Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Many thanks! Oliver > --- > net/can/bcm.c | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > > diff --git a/net/can/bcm.c b/net/can/bcm.c > index 9ba35685b043..9168114fc87f 100644 > --- a/net/can/bcm.c > +++ b/net/can/bcm.c > @@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *sock) > > lock_sock(sk); > > +#if IS_ENABLED(CONFIG_PROC_FS) > + /* remove procfs entry */ > + if (net->can.bcmproc_dir && bo->bcm_proc_read) > + remove_proc_entry(bo->procname, net->can.bcmproc_dir); > +#endif /* CONFIG_PROC_FS */ > + > list_for_each_entry_safe(op, next, &bo->tx_ops, list) > bcm_remove_op(op); > > @@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *sock) > list_for_each_entry_safe(op, next, &bo->rx_ops, list) > bcm_remove_op(op); > > -#if IS_ENABLED(CONFIG_PROC_FS) > - /* remove procfs entry */ > - if (net->can.bcmproc_dir && bo->bcm_proc_read) > - remove_proc_entry(bo->procname, net->can.bcmproc_dir); > -#endif /* CONFIG_PROC_FS */ > - > /* remove device reference */ > if (bo->bound) { > bo->bound = 0;
On 15.07.2023 17:25:43, YueHaibing wrote: > BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 > Read of size 8 at addr ffff888155846230 by task cat/7862 > > CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl+0xd5/0x150 > print_report+0xc1/0x5e0 > kasan_report+0xba/0xf0 > bcm_proc_show+0x969/0xa80 > seq_read_iter+0x4f6/0x1260 > seq_read+0x165/0x210 > proc_reg_read+0x227/0x300 > vfs_read+0x1d5/0x8d0 > ksys_read+0x11e/0x240 > do_syscall_64+0x35/0xb0 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > Allocated by task 7846: > kasan_save_stack+0x1e/0x40 > kasan_set_track+0x21/0x30 > __kasan_kmalloc+0x9e/0xa0 > bcm_sendmsg+0x264b/0x44e0 > sock_sendmsg+0xda/0x180 > ____sys_sendmsg+0x735/0x920 > ___sys_sendmsg+0x11d/0x1b0 > __sys_sendmsg+0xfa/0x1d0 > do_syscall_64+0x35/0xb0 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > Freed by task 7846: > kasan_save_stack+0x1e/0x40 > kasan_set_track+0x21/0x30 > kasan_save_free_info+0x27/0x40 > ____kasan_slab_free+0x161/0x1c0 > slab_free_freelist_hook+0x119/0x220 > __kmem_cache_free+0xb4/0x2e0 > rcu_core+0x809/0x1bd0 > > bcm_op is freed before procfs entry be removed in bcm_release(), > this lead to bcm_proc_show() may read the freed bcm_op. > > Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> Added to linux-can/testing. Thanks, Marc
diff --git a/net/can/bcm.c b/net/can/bcm.c index 9ba35685b043..9168114fc87f 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *sock) lock_sock(sk); +#if IS_ENABLED(CONFIG_PROC_FS) + /* remove procfs entry */ + if (net->can.bcmproc_dir && bo->bcm_proc_read) + remove_proc_entry(bo->procname, net->can.bcmproc_dir); +#endif /* CONFIG_PROC_FS */ + list_for_each_entry_safe(op, next, &bo->tx_ops, list) bcm_remove_op(op); @@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *sock) list_for_each_entry_safe(op, next, &bo->rx_ops, list) bcm_remove_op(op); -#if IS_ENABLED(CONFIG_PROC_FS) - /* remove procfs entry */ - if (net->can.bcmproc_dir && bo->bcm_proc_read) - remove_proc_entry(bo->procname, net->can.bcmproc_dir); -#endif /* CONFIG_PROC_FS */ - /* remove device reference */ if (bo->bound) { bo->bound = 0;
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0 bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op. Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") Signed-off-by: YueHaibing <yuehaibing@huawei.com> --- net/can/bcm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)