From patchwork Thu Aug 5 08:29:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12420639 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB743C432BE for ; Thu, 5 Aug 2021 08:32:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B3E0B60F38 for ; Thu, 5 Aug 2021 08:32:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239595AbhHEIcN (ORCPT ); Thu, 5 Aug 2021 04:32:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44534 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234796AbhHEIcM (ORCPT ); Thu, 5 Aug 2021 04:32:12 -0400 Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D77AFC0613C1 for ; Thu, 5 Aug 2021 01:31:57 -0700 (PDT) Received: by mail-ed1-x535.google.com with SMTP id d6so7190429edt.7 for ; Thu, 05 Aug 2021 01:31:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=lVLHJ/rUmIwH9d0tsdHnyim0dUDtw7h/R/oKAOMcOow=; b=HGgzHK/h8rwIMMCGNhJLnbHrTLp+DPUIPwB2Se2+Id4KuCpvSM91lRJFhQgqId8dVx wuyELm8tj3UoJCkzsmorfzwOSgjQcU7JWvz3Ulk9ThzrO1nK61BLkmnRGiDB02bjIQTx pY+nSbI+YXnM/2KGZhKsD5iufQ/Y61EBrLNXqXIl19W1o5h8fzI5PAddkvYNuQKLVr0W jBcFAbOf5cTDlxBwvC4cawXxDg3/j/xGwoYzHz5lKzmG3+s9t3n6skdnI8ozAg0MRu4K 76KeSv+9YqDgcq/GF3B4TxeTVYujaqyzhZmZo6+ttBa0Z1/atIJsFisRd3uNwYtq024T w0vQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=lVLHJ/rUmIwH9d0tsdHnyim0dUDtw7h/R/oKAOMcOow=; b=tRjDVlau3wjtiqZ32jKBIQu/X7dov+C2e24XPUMwsfQRjpGsE+V2xx0fpe+13hylLq CEkmarfuribfYxuX1Z/h8Tp+C5uAv5EUrWRCqGf7ORRFkZ7tdjC7S1yqDBdLcX5/mpCJ 12+NzLIWDelHsEu3zZA62b2DzZkgvAXqaCq6aOFSu/T0gwiaFWW1GuiUseLmDEjNqTb7 tGo93Bn2iP+t5fI302MZB8UBPmJ8weRrd6I0RCecjvFEl7rs1+Mu2906JzEbEKL2Fv9Q /iBYab6GosR4lmF8N6pkXO9S87SOQ0MFwjcRgC9Eor7l4gZLrvbKv6bgfpm8ava34yXe A+5w== X-Gm-Message-State: AOAM531qBW6IedqjIl8Vu7QZudWUZuFoNhHDO5Bex2Tw16aNBofVe7dP mmwJXW6VWsRRb9U2mJsyMAZfpCPdB7C3L852 X-Google-Smtp-Source: ABdhPJxpQ3i9QP52/FVVh+sijD2Vj4NoGMg7taH8QPbhPq6Ynz137BAsZZwhd6DJd8jinwueXW0/Mw== X-Received: by 2002:a05:6402:1202:: with SMTP id c2mr4981398edw.216.1628152316233; Thu, 05 Aug 2021 01:31:56 -0700 (PDT) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id bm1sm1471611ejb.38.2021.08.05.01.31.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Aug 2021 01:31:55 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@nvidia.com, arnd@arndb.de, bridge@lists.linux-foundation.org, Nikolay Aleksandrov , syzbot+34fe5894623c4ab1b379@syzkaller.appspotmail.com Subject: [PATCH net-next 1/3] net: bridge: fix ioctl locking Date: Thu, 5 Aug 2021 11:29:01 +0300 Message-Id: <20210805082903.711396-2-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210805082903.711396-1-razor@blackwall.org> References: <20210805082903.711396-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov Before commit ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") the bridge ioctl calls were divided in two parts: one was deviceless called by sock_ioctl and didn't expect rtnl to be held, the other was with a device called by dev_ifsioc() and expected rtnl to be held. After the commit above they were united in a single ioctl stub, but it didn't take care of the locking expectations. For sock_ioctl now we acquire (1) br_ioctl_mutex, (2) rtnl and for dev_ifsioc we acquire (1) rtnl, (2) br_ioctl_mutex The fix is to get a refcnt on the netdev for dev_ifsioc calls and drop rtnl then to reacquire it in the bridge ioctl stub after br_ioctl_mutex has been acquired. That will avoid playing locking games and make the rules straight-forward: we always take br_ioctl_mutex first, and then rtnl. Reported-by: syzbot+34fe5894623c4ab1b379@syzkaller.appspotmail.com Fixes: ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") Signed-off-by: Nikolay Aleksandrov --- net/bridge/br_if.c | 4 +--- net/bridge/br_ioctl.c | 37 ++++++++++++++++++++++++------------- net/core/dev_ioctl.c | 7 ++++++- 3 files changed, 31 insertions(+), 17 deletions(-) diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index 86f6d7e93ea8..67c60240b713 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -456,7 +456,7 @@ int br_add_bridge(struct net *net, const char *name) dev_net_set(dev, net); dev->rtnl_link_ops = &br_link_ops; - res = register_netdev(dev); + res = register_netdevice(dev); if (res) free_netdev(dev); return res; @@ -467,7 +467,6 @@ int br_del_bridge(struct net *net, const char *name) struct net_device *dev; int ret = 0; - rtnl_lock(); dev = __dev_get_by_name(net, name); if (dev == NULL) ret = -ENXIO; /* Could not find device */ @@ -485,7 +484,6 @@ int br_del_bridge(struct net *net, const char *name) else br_dev_delete(dev, NULL); - rtnl_unlock(); return ret; } diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c index 46a24c20e405..2f848de3e755 100644 --- a/net/bridge/br_ioctl.c +++ b/net/bridge/br_ioctl.c @@ -369,33 +369,44 @@ static int old_deviceless(struct net *net, void __user *uarg) int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd, struct ifreq *ifr, void __user *uarg) { + int ret = -EOPNOTSUPP; + + rtnl_lock(); + switch (cmd) { case SIOCGIFBR: case SIOCSIFBR: - return old_deviceless(net, uarg); - + ret = old_deviceless(net, uarg); + break; case SIOCBRADDBR: case SIOCBRDELBR: { char buf[IFNAMSIZ]; - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) - return -EPERM; + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { + ret = -EPERM; + break; + } - if (copy_from_user(buf, uarg, IFNAMSIZ)) - return -EFAULT; + if (copy_from_user(buf, uarg, IFNAMSIZ)) { + ret = -EFAULT; + break; + } buf[IFNAMSIZ-1] = 0; if (cmd == SIOCBRADDBR) - return br_add_bridge(net, buf); - - return br_del_bridge(net, buf); + ret = br_add_bridge(net, buf); + else + ret = br_del_bridge(net, buf); } - + break; case SIOCBRADDIF: case SIOCBRDELIF: - return add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF); - + ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF); + break; } - return -EOPNOTSUPP; + + rtnl_unlock(); + + return ret; } diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c index 4035bce06bf8..ff16326f5903 100644 --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -379,7 +379,12 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data, case SIOCBRDELIF: if (!netif_device_present(dev)) return -ENODEV; - return br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL); + dev_hold(dev); + rtnl_unlock(); + err = br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL); + dev_put(dev); + rtnl_lock(); + return err; case SIOCSHWTSTAMP: err = net_hwtstamp_validate(ifr); From patchwork Thu Aug 5 08:29:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12420641 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB15FC4320A for ; Thu, 5 Aug 2021 08:32:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C269D60F43 for ; Thu, 5 Aug 2021 08:32:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239634AbhHEIcO (ORCPT ); Thu, 5 Aug 2021 04:32:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239572AbhHEIcM (ORCPT ); Thu, 5 Aug 2021 04:32:12 -0400 Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7B46C061765 for ; Thu, 5 Aug 2021 01:31:58 -0700 (PDT) Received: by mail-ed1-x52d.google.com with SMTP id z11so7180629edb.11 for ; Thu, 05 Aug 2021 01:31:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ZmHPk02ecFhhLFxeJX7p5e9amiKU0ZRM+eqQQmDy/pE=; b=kguRDLeRsmg0kGdl+ZWTy6seL2aHvT9ZWRaF10F/WQW6w78MYeuwO2vWlGwuAsZada BKELLtfd7IiQc+DGwQ8JXXC8saSwI8VTE21x7oWzC+43a30Z2qhUOJRV6BfeGeneW030 +TPgvGfU2tNNwn9L7ut91IIZAt/Em8ZTS/U8sX9AGk2CpHXNclZg0XE4I4e5ys6BP9Iy /Hj9AyeJLAw5gzkf2hqz2XmafU9jN2eOtH87ODe184FGyLBDPffxREJMt1MO4Lui7tTf ZX+/+2jebvLsIcOCLtyHF55ypFsS0cD3VJ2Ia1D9/ew0a4TBAlO6g2QNi9j/45N2qpM6 o34w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ZmHPk02ecFhhLFxeJX7p5e9amiKU0ZRM+eqQQmDy/pE=; b=jwa2SCAxROb2bne8xCpqmpGSrnnUrQCeuMMj4Nfp1OwA+VI/9Zbh6i/aWWln3sRc1z +3O/xrnSl+k2pwJEz6dqi0Wn511S3SU0yi24xSQS9pcJdLET89tnHYSLv0DEfLFITBHZ Iwe+D7gI690mlTj8zLs4LAEwrIk32mkYGgXfy0aLP8LZvtHio9ZpB1B7SY1cqOUNhEsM eqngVLjV4QnQKr9u7lJCfL0Ktoxlxh3yy+nYyb+2H01vn/BzWJm2TET04cdEqNwF4ygv J13NGWjVGWXPUc7IAtZtpPbM2q3EyZPkK0Q7daJ6wT5sdZ245To4/7Xg2pdBLLy7NSnR GYyw== X-Gm-Message-State: AOAM532vBZjeX3IBz1hhoEWvW8j0EatmCDevUdTWxEjU62qAxEUOsCuw sbRgyI2LrxjkNjFeAhHAln3RlbCowD+Mxi2f X-Google-Smtp-Source: ABdhPJyz5M3ujufHhNf1vUJAjHsCKvV8fK+Q3UjRQVGf/0qcyzy7/iZWa0TVm324nQyAof78TVNcfA== X-Received: by 2002:a50:ff19:: with SMTP id a25mr4859173edu.311.1628152317234; Thu, 05 Aug 2021 01:31:57 -0700 (PDT) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id bm1sm1471611ejb.38.2021.08.05.01.31.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Aug 2021 01:31:56 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@nvidia.com, arnd@arndb.de, bridge@lists.linux-foundation.org, Nikolay Aleksandrov Subject: [PATCH net-next 2/3] net: bridge: fix ioctl old_deviceless bridge argument Date: Thu, 5 Aug 2021 11:29:02 +0300 Message-Id: <20210805082903.711396-3-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210805082903.711396-1-razor@blackwall.org> References: <20210805082903.711396-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov Commit ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") changed the source of the argument copy in bridge's old_deviceless() from args[1] (user ptr to device name) to uarg (ptr to ioctl arguments) causing wrong device name to be used. Example (broken, bridge exists but is up): $ brctl delbr bridge bridge bridge doesn't exist; can't delete it Example (working): $ brctl delbr bridge bridge bridge is still up; can't delete it Fixes: ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") Signed-off-by: Nikolay Aleksandrov --- net/bridge/br_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c index 2f848de3e755..793b0db9d9a3 100644 --- a/net/bridge/br_ioctl.c +++ b/net/bridge/br_ioctl.c @@ -351,7 +351,7 @@ static int old_deviceless(struct net *net, void __user *uarg) if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; - if (copy_from_user(buf, uarg, IFNAMSIZ)) + if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ)) return -EFAULT; buf[IFNAMSIZ-1] = 0; From patchwork Thu Aug 5 08:29:03 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12420643 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D939CC4338F for ; Thu, 5 Aug 2021 08:32:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B425A60F43 for ; Thu, 5 Aug 2021 08:32:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239660AbhHEIcP (ORCPT ); Thu, 5 Aug 2021 04:32:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239597AbhHEIcN (ORCPT ); Thu, 5 Aug 2021 04:32:13 -0400 Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACEE4C061765 for ; Thu, 5 Aug 2021 01:31:59 -0700 (PDT) Received: by mail-ej1-x62e.google.com with SMTP id hs10so8319034ejc.0 for ; Thu, 05 Aug 2021 01:31:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ASFi6LmvPfUEVAfYOyV6LdzH3i0EWd4CXmN64mzKTmI=; b=FDd/+X33tYFBuRoA72xCxLV9ETIza+Osqha0JMbpo3+srdWGFrOIoW/0Beh+QHi9Kk HAXhay+TdAxUITsr0To4mEhM5/9MwyP/denNRgi64IIq7k8dVBsvjHtJW4hlWSpT6r03 uWHTMEBm9WLb4yjVENLJfYqDPItPtXhF0/xovtJCmxw2qxqDHh62sXN4dDp9fdpufo+h 14thAclH380lVzJhsQYPcNjN26sb3wBH0GiU3kwlLZTR70jH5EWUdywgDVep1K/iFad6 cjggBcIjBqeli4HnnzC8mctBi1OK/F+/rIwkR6ii1Rv887XYWn54IpGp2mq2V/UTVuSN zhQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ASFi6LmvPfUEVAfYOyV6LdzH3i0EWd4CXmN64mzKTmI=; b=WGlGI+5T5ziydNKNHiECbpWxkNwOvea0FjTvCL5NSNDgIhLYmJFCRKQ7vrHOyhlfS9 LyyIibT/yGFqF86KRZBKoIP1tCiAgH/OFP4ktxl47JyPlon36QBIkaV/eAZTGFj1qqpE EbsoM4Oqh9aUXXRtgE8jKsi2QgV/xZH+NCyzLAD/cRtYYOFX0zv5UDgU/bvI2uYsm+QI wSj2i7TqdMY65yZnFf7beSGN6EAxa+T9ISaZlsV3VLnjstYdI4ZW0BWBzRSuXREjAlxP jHsQz2wcP2rQRMtdAEtKg5WFKTLueml17MOMeEhwi/H1xu+ImfX44/3ra+rU1BYUaH40 NHHg== X-Gm-Message-State: AOAM533uiBrOYhq6iQCzZDAuCOOXqEidr4C4L3iXD0NPeKMtKDOcZSjs T61wAP+kvHgZaTfVIaghDyDsSegsypCcJKAG X-Google-Smtp-Source: ABdhPJzIyGJFIa85z0iCIbObKWZpcRLES+Xw4IAn3zOfcYjpksW0s4ScXh4qFPs3SFrgmHhAfCEyOA== X-Received: by 2002:a17:906:c834:: with SMTP id dd20mr3676730ejb.371.1628152318096; Thu, 05 Aug 2021 01:31:58 -0700 (PDT) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id bm1sm1471611ejb.38.2021.08.05.01.31.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Aug 2021 01:31:57 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@nvidia.com, arnd@arndb.de, bridge@lists.linux-foundation.org, Nikolay Aleksandrov , syzbot+79f4a8692e267bdb7227@syzkaller.appspotmail.com Subject: [PATCH net-next 3/3] net: core: don't call SIOCBRADD/DELIF for non-bridge devices Date: Thu, 5 Aug 2021 11:29:03 +0300 Message-Id: <20210805082903.711396-4-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210805082903.711396-1-razor@blackwall.org> References: <20210805082903.711396-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov Commit ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") changed SIOCBRADD/DELIF to use bridge's ioctl hook (br_ioctl_hook) without checking if the target netdevice is actually a bridge which can cause crashes and generally interpreting other devices' private pointers as net_bridge pointers. Crash example (lo - loopback): $ brctl addif lo ens16 BUG: kernel NULL pointer dereference, address: 000000000000059898 #PF: supervisor read access in kernel modede #PF: error_code(0x0000) - not-present pagege PGD 0 P4D 0 ^Ac Oops: 0000 [#1] SMP NOPTI CPU: 2 PID: 1376 Comm: brctl Kdump: loaded Tainted: G W 5.14.0-rc3+ #405 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:add_del_if+0x1f/0x7c [bridge] Code: 80 bf 1b a0 41 5c e9 c0 3c 03 e1 0f 1f 44 00 00 41 55 41 54 41 89 f4 be 0c 00 00 00 55 48 89 fd 53 48 8b 87 88 00 00 00 89 d3 <4c> 8b a8 98 05 00 00 49 8b bd d0 00 00 00 e8 17 d7 f3 e0 84 c0 74 RSP: 0018:ffff888109d97cb0 EFLAGS: 00010202^Ac RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000c RDI: ffff888101239bc0 RBP: ffff888101239bc0 R08: 0000000000000001 R09: 0000000000000000 R10: ffff888109d97cd8 R11: 00000000000000a3 R12: 0000000000000012 R13: 0000000000000000 R14: ffff888101239bc0 R15: ffff888109d97e10 FS: 00007fc1e365b540(0000) GS:ffff88822be80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000598 CR3: 0000000106506000 CR4: 00000000000006e0 Call Trace: br_ioctl_stub+0x7c/0x441 [bridge] br_ioctl_call+0x6d/0x8a dev_ifsioc+0x325/0x4e8 dev_ioctl+0x46b/0x4e1 sock_do_ioctl+0x7b/0xad sock_ioctl+0x2de/0x2f2 vfs_ioctl+0x1e/0x2b __do_sys_ioctl+0x63/0x86 do_syscall_64+0xcb/0xf2 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1e3589427 Code: 00 00 90 48 8b 05 69 aa 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 39 aa 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc8d501d38 EFLAGS: 00000202 ORIG_RAX: 000000000000001010 RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 00007fc1e3589427 RDX: 00007ffc8d501d60 RSI: 00000000000089a3 RDI: 0000000000000003 RBP: 00007ffc8d501d60 R08: 0000000000000000 R09: fefefeff77686d74 R10: fffffffffffff8f9 R11: 0000000000000202 R12: 00007ffc8d502e06 R13: 00007ffc8d502e06 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: bridge stp llc bonding ipv6 virtio_net [last unloaded: llc]^Ac CR2: 0000000000000598 Reported-by: syzbot+79f4a8692e267bdb7227@syzkaller.appspotmail.com Fixes: ad2f99aedf8f ("net: bridge: move bridge ioctls out of .ndo_do_ioctl") Signed-off-by: Nikolay Aleksandrov --- net/core/dev_ioctl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c index ff16326f5903..0e87237fd871 100644 --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -379,6 +379,8 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data, case SIOCBRDELIF: if (!netif_device_present(dev)) return -ENODEV; + if (!netif_is_bridge_master(dev)) + return -EOPNOTSUPP; dev_hold(dev); rtnl_unlock(); err = br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL);