Kuniyuki Iwashima 0a78cf7264 raw: Fix NULL deref in raw_get_next(). ... Dae R. Jeong reported a NULL deref in raw_get_next() [0]. It seems that the repro was running these sequences in parallel so that one thread was iterating on a socket that was being freed in another netns. unshare(0x40060200) r0 = syz_open_procfs(0x0, &(0x7f0000002080)='net/raw\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) pread64(r0, &(0x7f0000000000)=""/10, 0xa, 0x10000000007f) After commit 0daf07e527 ("raw: convert raw sockets to RCU"), we use RCU and hlist_nulls_for_each_entry() to iterate over SOCK_RAW sockets. However, we should use spinlock for slow paths to avoid the NULL deref. Also, SOCK_RAW does not use SLAB_TYPESAFE_BY_RCU, and the slab object is not reused during iteration in the grace period. In fact, the lockless readers do not check the nulls marker with get_nulls_value(). So, SOCK_RAW should use hlist instead of hlist_nulls. Instead of adding an unnecessary barrier by sk_nulls_for_each_rcu(), let's convert hlist_nulls to hlist and use sk_for_each_rcu() for fast paths and sk_for_each() and spinlock for /proc/net/raw. [0]: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 2 PID: 20952 Comm: syz-executor.0 Not tainted 6.2.0-g048ec869bafd-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] RIP: 0010:sock_net include/net/sock.h:649 [inline] RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055bb9614b35f CR3: 000000003c672000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> seq_read_iter+0x4c6/0x10f0 fs/seq_file.c:225 seq_read+0x224/0x320 fs/seq_file.c:162 pde_read fs/proc/inode.c:316 [inline] proc_reg_read+0x23f/0x330 fs/proc/inode.c:328 vfs_read+0x31e/0xd30 fs/read_write.c:468 ksys_pread64 fs/read_write.c:665 [inline] __do_sys_pread64 fs/read_write.c:675 [inline] __se_sys_pread64 fs/read_write.c:672 [inline] __x64_sys_pread64+0x1e9/0x280 fs/read_write.c:672 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x478d29 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f843ae8dbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 0000000000791408 RCX: 0000000000478d29 RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000f477909a R08: 0000000000000000 R09: 0000000000000000 R10: 000010000000007f R11: 0000000000000246 R12: 0000000000791740 R13: 0000000000791414 R14: 0000000000791408 R15: 00007ffc2eb48a50 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] RIP: 0010:sock_net include/net/sock.h:649 [inline] RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f92ff166000 CR3: 000000003c672000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 0daf07e527 ("raw: convert raw sockets to RCU") Reported-by: syzbot <syzkaller@googlegroups.com> Reported-by: Dae R. Jeong <threeearcat@gmail.com> Link: https://lore.kernel.org/netdev/ZCA2mGV_cmq7lIfV@dragonet/ Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-04-04 18:56:58 -07:00
..
9p	net/9p: distinguish zero-copy requests	2022-12-06 07:30:55 +09:00
bluetooth	Bluetooth: btintel: Iterate only bluetooth device ACPI entries	2023-03-22 16:05:55 -07:00
caif	…
iucv	…
mana	net: mana: Fix IRQ name - add PCI and queue number	2023-01-20 18:17:17 -08:00
netfilter	netfilter: tproxy: fix deadlock due to missing BH disable	2023-03-06 12:09:48 +01:00
netns	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf	2023-02-22 21:25:23 -08:00
nfc	…
phonet	…
sctp	sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop	2023-02-23 12:59:40 -08:00
tc_act	net/sched: act_connmark: transition to percpu stats and rcu	2023-02-16 10:39:28 +01:00
6lowpan.h	…
Space.h	…
act_api.h	net/sched: Rename user cookie and act cookie	2023-02-20 16:46:10 -08:00
addrconf.h	…
af_ieee802154.h	…
af_rxrpc.h	rxrpc: Tidy up abort generation infrastructure	2023-01-06 09:43:32 +00:00
af_unix.h	…
af_vsock.h	…
ah.h	…
amt.h	…
arp.h	…
atmclip.h	…
ax25.h	…
ax88796.h	…
bareudp.h	…
bond_3ad.h	…
bond_alb.h	bonding (gcc13): synchronize bond_{a,t}lb_xmit() types	2022-11-02 20:38:13 -07:00
bond_options.h	…
bonding.h	bond: Disable TLS features indication	2022-10-27 12:45:38 +02:00
bpf_sk_storage.h	…
busy_poll.h	…
calipso.h	…
cfg80211-wext.h	wifi: cfg80211: Avoid clashing function prototypes	2022-11-16 11:31:47 +02:00
cfg80211.h	wifi: cfg80211: remove gfp parameter from cfg80211_obss_color_collision_notify description	2023-02-15 18:28:52 +01:00
cfg802154.h	ieee802154: Add support for user beaconing requests	2023-01-28 13:51:22 +01:00
checksum.h	net: checksum: drop the linux/uaccess.h include	2023-01-27 11:19:46 +00:00
cipso_ipv4.h	…
cls_cgroup.h	…
codel.h	…
codel_impl.h	…
codel_qdisc.h	…
compat.h	…
datalink.h	…
dcbevent.h	…
dcbnl.h	net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps	2023-01-20 09:33:22 +00:00
devlink.h	devlink: fix the name of value arg of devl_param_driverinit_value_get()	2023-02-13 09:49:14 +00:00
dropreason.h	ipv6: icmp6: add SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST	2023-02-20 08:54:23 +00:00
dsa.h	net: dsa: add plumbing for changing and getting MAC merge layer state	2023-01-23 12:44:18 +00:00
dsfield.h	…
dst.h	net: add atomic_long_t to net_device_stats fields	2022-11-16 12:48:44 +00:00
dst_cache.h	…
dst_metadata.h	xfrm: interface: Add unstable helpers for setting/getting XFRM metadata from TC-BPF	2022-12-05 21:58:27 -08:00
dst_ops.h	ipv6: remove max_size check inline with ipv4	2023-01-13 20:59:14 -08:00
erspan.h	…
esp.h	…
espintcp.h	…
ethoc.h	…
failover.h	…
fib_notifier.h	…
fib_rules.h	…
firewire.h	…
flow.h	net: remove unnecessary includes from net/flow.h	2023-01-27 11:19:46 +00:00
flow_dissector.h	…
flow_offload.h	net/sched: cls_api: Support hardware miss to tc action	2023-02-20 16:46:10 -08:00
fou.h	…
fq.h	…
fq_impl.h	wifi: mac80211: add support for restricting netdev features per vif	2022-12-01 15:09:10 +01:00
garp.h	…
gen_stats.h	…
genetlink.h	mptcp: more detailed error reporting on endpoint creation	2022-11-21 13:09:07 +00:00
geneve.h	net: geneve: fix array of flexible structures warnings	2022-10-31 10:43:04 +00:00
gre.h	…
gro.h	…
gro_cells.h	…
gtp.h	…
gue.h	…
hwbm.h	…
icmp.h	…
ieee80211_radiotap.h	…
ieee802154_netdev.h	mac802154: Handle basic beaconing	2023-01-28 13:55:10 +01:00
if_inet6.h	…
ife.h	…
ila.h	…
inet6_connection_sock.h	…
inet6_hashtables.h	…
inet_common.h	…
inet_connection_sock.h	…
inet_dscp.h	…
inet_ecn.h	…
inet_frag.h	net: dropreason: add SKB_DROP_REASON_FRAG_REASM_TIMEOUT	2022-10-31 20:14:27 -07:00
inet_hashtables.h	tcp: Add TIME_WAIT sockets in bhash2.	2022-12-30 07:25:52 +00:00
inet_sock.h	inet: Add IP_LOCAL_PORT_RANGE socket option	2023-01-25 22:45:00 -08:00
inet_timewait_sock.h	tcp: Add TIME_WAIT sockets in bhash2.	2022-12-30 07:25:52 +00:00
inetpeer.h	…
ioam6.h	…
ip.h	inet: Add IP_LOCAL_PORT_RANGE socket option	2023-01-25 22:45:00 -08:00
ip6_checksum.h	…
ip6_fib.h	…
ip6_route.h	ipv6: Make ip6_route_output_flags_noref() static.	2023-01-24 18:12:52 -08:00
ip6_tunnel.h	…
ip_fib.h	…
ip_tunnels.h	…
ip_vs.h	ipvs: avoid kfree_rcu without 2nd arg	2023-02-02 14:02:01 +01:00
ipcomp.h	…
ipconfig.h	…
ipv6.h	ipv6: icmp6: add drop reason support to icmpv6_notify()	2023-02-13 19:55:32 -08:00
ipv6_frag.h	net: dropreason: add SKB_DROP_REASON_FRAG_REASM_TIMEOUT	2022-10-31 20:14:27 -07:00
ipv6_stubs.h	…
iw_handler.h	…
kcm.h	…
l3mdev.h	…
lag.h	…
lapb.h	…
lib80211.h	…
llc.h	…
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	…
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
lwtunnel.h	…
mac80211.h	wifi: mac80211: configure puncturing bitmap	2023-02-14 12:17:22 +01:00
mac802154.h	mac802154: Drop IEEE802154_HW_RX_DROP_BAD_CKSUM	2022-10-12 12:57:19 +02:00
macsec.h	…
mctp.h	…
mctpdevice.h	…
mip6.h	…
mld.h	…
mpls.h	…
mpls_iptunnel.h	…
mptcp.h	mptcp: remove MPTCP 'ifdef' in TCP SYN cookies	2022-12-12 13:11:24 -08:00
mrp.h	mrp: introduce active flags to prevent UAF when applicant uninit	2022-11-18 12:14:55 +00:00
ncsi.h	…
ndisc.h	ipv6: icmp6: add drop reason support to ndisc_rcv()	2023-02-13 19:55:32 -08:00
neighbour.h	net: neigh: decrement the family specific qlen	2022-11-18 10:29:50 +00:00
net_debug.h	…
net_failover.h	…
net_namespace.h	net: add a refcount tracker for kernel sockets	2022-10-24 11:04:43 +01:00
net_ratelimit.h	…
net_trackers.h	…
netevent.h	…
netlabel.h	…
netlink.h	net: netlink: recommend policy range validation	2023-01-28 00:33:51 -08:00
netprio_cgroup.h	…
netrom.h	…
nexthop.h	…
nl802154.h	ieee802154: Add support for user beaconing requests	2023-01-28 13:51:22 +01:00
nsh.h	…
p8022.h	…
page_pool.h	page_pool: add a comment explaining the fragment counter usage	2023-02-21 09:15:39 -08:00
pie.h	…
ping.h	inet: ping: use hlist_nulls rcu iterator during lookup	2022-12-01 12:42:46 +01:00
pkt_cls.h	net/sched: cls_api: Support hardware miss to tc action	2023-02-20 16:46:10 -08:00
pkt_sched.h	net/sched: taprio: give higher priority to higher TCs in software dequeue mode	2023-02-08 09:48:52 +00:00
pptp.h	…
protocol.h	…
psample.h	…
psnap.h	…
raw.h	raw: Fix NULL deref in raw_get_next().	2023-04-04 18:56:58 -07:00
rawv6.h	…
red.h	…
regulatory.h	…
request_sock.h	…
rose.h	…
route.h	net: add a couple of helpers for iph tot_len	2023-02-01 20:54:27 -08:00
rpl.h	…
rsi_91x.h	…
rtnetlink.h	rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link	2022-10-31 18:10:21 -07:00
rtnh.h	…
sch_generic.h	net/sched: cls_api: Support hardware miss to tc action	2023-02-20 16:46:10 -08:00
scm.h	…
secure_seq.h	…
seg6.h	…
seg6_hmac.h	…
seg6_local.h	…
selftests.h	…
slhc_vj.h	…
smc.h	net/smc: De-tangle ism and smc device initialization	2023-01-25 09:46:49 +00:00
snmp.h	…
sock.h	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2023-02-17 11:06:39 +00:00
sock_reuseport.h	soreuseport: Fix socket selection for SO_INCOMING_CPU.	2022-10-25 11:35:16 +02:00
stp.h	…
strparser.h	…
switchdev.h	bridge: switchdev: Allow device drivers to install locked FDB entries	2022-11-09 19:06:13 -08:00
tc_wrapper.h	net/sched: Retire rsvp classifier	2023-02-16 09:27:07 +01:00
tcp.h	bpf-next-for-netdev	2022-12-12 11:27:42 -08:00
tcp_states.h	…
timewait_sock.h	…
tipc.h	…
tls.h	…
tls_toe.h	…
transp_v6.h	inet6: Remove inet6_destroy_sock().	2022-10-24 09:40:39 +01:00
tso.h	net: tso: inline tso_count_descs()	2022-12-12 15:04:39 -08:00
tun_proto.h	…
udp.h	udp: track the forward memory release threshold in an hot cacheline	2022-10-24 10:52:50 +01:00
udp_tunnel.h	net: Change the udp encap_err_rcv to allow use of {ip,ipv6}_icmp_error()	2022-11-08 16:42:28 +00:00
udplite.h	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().	2022-10-12 17:50:37 -07:00
vsock_addr.h	…
vxlan.h	…
wext.h	…
x25.h	…
x25device.h	…
xdp.h	xdp: add xdp_set_features_flag utility routine	2023-03-10 21:33:47 -08:00
xdp_priv.h	…
xdp_sock.h	…
xdp_sock_drv.h	…
xfrm.h	bpf-next-for-netdev	2022-12-12 11:27:42 -08:00
xsk_buff_pool.h	xsk: Add cb area to struct xdp_buff_xsk	2023-01-23 09:58:23 -08:00