Re: net/packet: use-after-free in packet_rcv_fanout

On Thu, Feb 9, 2017 at 5:14 AM, Dmitry Vyukov [off-list ref] wrote:

quoted

Hello,

I've got the following use-after-free report in packet_rcv_fanout
while running syzkaller fuzzer on linux-next
e3e6c5f3544c5d05c6b3b309a34f4f2c3537e993. So far it happened once and
is not reproducible, but maybe the stacks will allow you to figure out
what happens.

BUG: KASAN: use-after-free in __lock_acquire+0x3212/0x3430
kernel/locking/lockdep.c:3224 at addr ffff8801d903d538
Read of size 8 by task syz-executor1/10596
CPU: 1 PID: 10596 Comm: syz-executor1 Not tainted 4.10.0-rc7-next-20170208 #1
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011

Call Trace:
 __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:332
 __lock_acquire+0x3212/0x3430 kernel/locking/lockdep.c:3224
 lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3753
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x3a/0x50 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:304 [inline]
 packet_rcv_has_room+0x25/0xb0 net/packet/af_packet.c:1308
 fanout_demux_rollover+0x3bb/0x6b0 net/packet/af_packet.c:1388
 packet_rcv_fanout+0x674/0x800 net/packet/af_packet.c:1490
 dev_queue_xmit_nit+0x73a/0xa90 net/core/dev.c:1898
 xmit_one net/core/dev.c:2870 [inline]
 dev_hard_start_xmit+0x16b/0xab0 net/core/dev.c:2890
 __dev_queue_xmit+0x16d1/0x1e60 net/core/dev.c:3355
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3388
 neigh_hh_output include/net/neighbour.h:468 [inline]
 dst_neigh_output include/net/dst.h:452 [inline]
 ip6_finish_output2+0x1461/0x2380 net/ipv6/ip6_output.c:123
 ip6_finish_output+0x2f9/0x950 net/ipv6/ip6_output.c:149
 NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 ip6_output+0x1cb/0x8c0 net/ipv6/ip6_output.c:163
 ip6_xmit+0xc2f/0x1e80 include/net/dst.h:498
 inet6_csk_xmit+0x320/0x5d0 net/ipv6/inet6_connection_sock.c:139
 tcp_transmit_skb+0x1ab4/0x3460 net/ipv4/tcp_output.c:1054
 tcp_send_syn_data net/ipv4/tcp_output.c:3343 [inline]
 tcp_connect+0x11a7/0x2f50 net/ipv4/tcp_output.c:3375
 tcp_v6_connect+0x1a6e/0x1f70 net/ipv6/tcp_ipv6.c:295
 __inet_stream_connect+0x2d1/0xf80 net/ipv4/af_inet.c:618
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1110 [inline]
 tcp_sendmsg+0x23ac/0x3bd0 net/ipv4/tcp.c:1133
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:761
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 SYSC_sendto+0x660/0x810 net/socket.c:1685
 SyS_sendto+0x40/0x50 net/socket.c:1653
 entry_SYSCALL_64_fastpath+0x1f/0xc2

It seems on-flying packets could still refer the struct sock pointer
via f->arr[i], if so we need a sync before unlinking it:

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d56ee46..8724a98 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c

@@ -2924,6 +2924,8 @@ static int packet_release(struct socket *sock)
        sock_prot_inuse_add(net, sk->sk_prot, -1);
        preempt_enable();

+       synchronize_net();
+
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, false);
        packet_cached_dev_reset(po);