Kuniyuki Iwashima
0a78cf7264
raw: Fix NULL deref in raw_get_next().
Dae R. Jeong reported a NULL deref in raw_get_next() [0].
It seems that the repro was running these sequences in parallel so
that one thread was iterating on a socket that was being freed in
another netns.
unshare(0x40060200)
r0 = syz_open_procfs(0x0, &(0x7f0000002080)='net/raw\x00')
socket$inet_icmp_raw(0x2, 0x3, 0x1)
pread64(r0, &(0x7f0000000000)=""/10, 0xa, 0x10000000007f)
After commit 0daf07e527 ("raw: convert raw sockets to RCU"), we
use RCU and hlist_nulls_for_each_entry() to iterate over SOCK_RAW
sockets. However, we should use spinlock for slow paths to avoid
the NULL deref.
Also, SOCK_RAW does not use SLAB_TYPESAFE_BY_RCU, and the slab object
is not reused during iteration in the grace period. In fact, the
lockless readers do not check the nulls marker with get_nulls_value().
So, SOCK_RAW should use hlist instead of hlist_nulls.
Instead of adding an unnecessary barrier by sk_nulls_for_each_rcu(),
let's convert hlist_nulls to hlist and use sk_for_each_rcu() for
fast paths and sk_for_each() and spinlock for /proc/net/raw.
[0]:
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 2 PID: 20952 Comm: syz-executor.0 Not tainted 6.2.0-g048ec869bafd-dirty #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline]
RIP: 0010:sock_net include/net/sock.h:649 [inline]
RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline]
RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline]
RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995
Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef
RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000
RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338
RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9
R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78
R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030
FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bb9614b35f CR3: 000000003c672000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
seq_read_iter+0x4c6/0x10f0 fs/seq_file.c:225
seq_read+0x224/0x320 fs/seq_file.c:162
pde_read fs/proc/inode.c:316 [inline]
proc_reg_read+0x23f/0x330 fs/proc/inode.c:328
vfs_read+0x31e/0xd30 fs/read_write.c:468
ksys_pread64 fs/read_write.c:665 [inline]
__do_sys_pread64 fs/read_write.c:675 [inline]
__se_sys_pread64 fs/read_write.c:672 [inline]
__x64_sys_pread64+0x1e9/0x280 fs/read_write.c:672
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x478d29
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f843ae8dbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
RAX: ffffffffffffffda RBX: 0000000000791408 RCX: 0000000000478d29
RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00000000f477909a R08: 0000000000000000 R09: 0000000000000000
R10: 000010000000007f R11: 0000000000000246 R12: 0000000000791740
R13: 0000000000791414 R14: 0000000000791408 R15: 00007ffc2eb48a50
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline]
RIP: 0010:sock_net include/net/sock.h:649 [inline]
RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline]
RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline]
RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995
Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef
RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000
RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338
RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9
R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78
R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030
FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f92ff166000 CR3: 000000003c672000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Fixes: 0daf07e527 ("raw: convert raw sockets to RCU")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Dae R. Jeong <threeearcat@gmail.com>
Link: https://lore.kernel.org/netdev/ZCA2mGV_cmq7lIfV@dragonet/
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-04-04 18:56:58 -07:00
..
2022-12-06 07:30:55 +09:00
2023-03-22 16:05:55 -07:00
2021-07-01 13:19:48 -07:00
2021-11-19 11:52:25 +00:00
2023-01-20 18:17:17 -08:00
2023-03-06 12:09:48 +01:00
2023-02-22 21:25:23 -08:00
2021-11-17 20:17:05 -08:00
2022-07-22 12:53:22 +01:00
2023-02-23 12:59:40 -08:00
2023-02-16 10:39:28 +01:00
2023-02-20 16:46:10 -08:00
2022-07-28 10:42:44 -07:00
2023-01-06 09:43:32 +00:00
2022-06-22 12:59:43 +01:00
2022-08-23 10:43:11 +02:00
2022-07-22 12:53:22 +01:00
2022-02-21 11:44:30 +00:00
2022-07-28 22:06:15 -07:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2022-09-16 14:34:01 +01:00
2022-11-02 20:38:13 -07:00
2022-07-22 12:53:22 +01:00
2022-10-27 12:45:38 +02:00
2021-03-26 17:43:55 +01:00
2022-08-24 13:46:58 +01:00
2022-11-16 11:31:47 +02:00
2023-02-15 18:28:52 +01:00
2023-01-28 13:51:22 +01:00
2023-01-27 11:19:46 +00:00
2021-12-22 15:03:47 -08:00
2022-07-22 12:53:22 +01:00
2021-12-22 15:03:51 -08:00
2022-07-24 18:39:17 -06:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2023-02-13 09:49:14 +00:00
2023-02-20 08:54:23 +00:00
2023-01-23 12:44:18 +00:00
2021-11-29 19:50:45 -08:00
2022-12-05 21:58:27 -08:00
2023-01-13 20:59:14 -08:00
2022-11-16 12:48:44 +00:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2021-12-16 07:18:35 -08:00
2022-07-28 22:21:54 -07:00
2022-09-20 09:13:38 +02:00
2023-02-20 16:46:10 -08:00
2023-01-27 11:19:46 +00:00
2022-12-01 15:09:10 +01:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2022-11-21 13:09:07 +00:00
2022-10-31 10:43:04 +00:00
2021-01-29 20:39:14 -08:00
2022-08-25 16:07:42 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2021-06-28 14:29:45 -07:00
2022-02-04 16:25:21 +01:00
2023-01-28 13:55:10 +01:00
2022-04-06 22:09:39 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-29 11:58:54 +01:00
2022-07-22 12:53:22 +01:00
2022-08-24 19:30:07 -07:00
2022-02-07 20:12:45 -08:00
2021-10-15 11:33:08 +01:00
2022-10-31 20:14:27 -07:00
2022-12-30 07:25:52 +00:00
2023-01-25 22:45:00 -08:00
2022-12-30 07:25:52 +00:00
2022-02-17 07:00:39 -06:00
2021-11-16 13:16:54 +00:00
2022-02-17 11:44:20 -08:00
2023-01-24 18:12:52 -08:00
2022-04-25 11:40:45 +01:00
2022-04-11 17:37:50 -07:00
2022-10-03 07:59:06 +01:00
2023-02-02 14:02:01 +01:00
2023-01-25 22:45:00 -08:00
2022-09-29 07:18:00 +02:00
2022-07-22 12:53:22 +01:00
2022-10-31 20:14:27 -07:00
2022-09-02 20:34:32 -07:00
2023-02-13 19:55:32 -08:00
2021-03-23 14:14:50 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2021-12-07 20:44:59 -08:00
2021-10-13 09:40:46 -07:00
2021-07-27 13:05:56 +01:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-28 11:29:36 +02:00
2021-11-07 19:25:29 +00:00
2021-08-30 01:51:36 +02:00
2023-02-14 12:17:22 +01:00
2022-10-12 12:57:19 +02:00
2022-09-23 06:56:08 -07:00
2022-04-01 12:04:15 +01:00
2021-10-29 13:23:51 +01:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2022-12-12 13:11:24 -08:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2023-02-13 19:55:32 -08:00
2022-11-18 10:29:50 +00:00
2022-05-11 12:43:10 +01:00
2022-10-24 11:04:43 +01:00
2021-12-10 06:38:26 -08:00
2022-07-22 12:53:22 +01:00
2023-01-28 00:33:51 -08:00
2022-07-22 12:53:22 +01:00
2021-09-24 14:07:10 +01:00
2023-01-28 13:51:22 +01:00
2022-07-22 12:53:22 +01:00
2023-02-21 09:15:39 -08:00
2022-12-01 12:42:46 +01:00
2023-02-20 16:46:10 -08:00
2023-02-08 09:48:52 +00:00
2022-07-22 12:53:22 +01:00
2022-07-15 18:50:35 -07:00
2021-08-09 15:34:21 -07:00
2022-07-22 12:53:22 +01:00
2023-04-04 18:56:58 -07:00
2022-06-19 10:00:02 +01:00
2022-10-11 17:42:58 -06:00
2022-07-22 12:53:22 +01:00
2022-02-02 14:45:18 +00:00
2022-08-01 11:59:23 -07:00
2023-02-01 20:54:27 -08:00
2022-10-31 18:10:21 -07:00
2023-02-20 16:46:10 -08:00
2022-07-22 12:53:22 +01:00
2022-01-04 12:17:35 +00:00
2021-04-28 14:06:45 -07:00
2023-01-25 09:46:49 +00:00
2022-10-25 11:35:16 +02:00
2023-02-17 11:06:39 +00:00
2021-08-03 13:05:26 +01:00
2022-07-22 12:53:22 +01:00
2022-07-18 11:24:10 +01:00
2022-11-09 19:06:13 -08:00
2023-02-16 09:27:07 +01:00
2022-12-12 11:27:42 -08:00
2022-09-22 17:27:41 -07:00
2022-10-24 09:40:39 +01:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2022-11-08 16:42:28 +00:00
2022-10-24 10:52:50 +01:00
2022-10-12 17:50:37 -07:00
2022-03-01 08:38:02 +00:00
2022-07-22 12:53:22 +01:00
2022-09-30 07:55:46 -07:00
2021-12-29 08:48:14 -08:00
2023-03-10 21:33:47 -08:00
2022-12-12 11:27:42 -08:00
2023-01-23 09:58:23 -08:00