hwsim_hw_xmit fails to deallocate the newskb copied by pskb_copy. Fix
this by adding kfree_skb after ieee802154_rx_irqsafe.
[<ffffffff836433fb>] __alloc_skb+0x22b/0x250 net/core/skbuff.c:414
[<ffffffff8364ad95>] __pskb_copy_fclone+0x75/0x360 net/core/skbuff.c:1609
[<ffffffff82ae65e3>] __pskb_copy include/linux/skbuff.h:1176 [inline]
[<ffffffff82ae65e3>] pskb_copy include/linux/skbuff.h:3207 [inline]
[<ffffffff82ae65e3>] hwsim_hw_xmit+0xd3/0x140 drivers/net/ieee802154/mac802154_hwsim.c:132
[<ffffffff83ff8f47>] drv_xmit_async net/mac802154/driver-ops.h:16 [inline]
[<ffffffff83ff8f47>] ieee802154_tx+0xc7/0x190 net/mac802154/tx.c:83
[<ffffffff83ff9138>] ieee802154_subif_start_xmit+0x58/0x70 net/mac802154/tx.c:132
[<ffffffff83670b82>] __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
[<ffffffff83670b82>] netdev_start_xmit include/linux/netdevice.h:4958 [inline]
[<ffffffff83670b82>] xmit_one net/core/dev.c:3658 [inline]
[<ffffffff83670b82>] dev_hard_start_xmit+0xe2/0x330 net/core/dev.c:3674
[<ffffffff83718028>] sch_direct_xmit+0xf8/0x520 net/sched/sch_generic.c:342
[<ffffffff8367193b>] __dev_xmit_skb net/core/dev.c:3874 [inline]
[<ffffffff8367193b>] __dev_queue_xmit+0xa3b/0x1360 net/core/dev.c:4241
[<ffffffff83ff5437>] dgram_sendmsg+0x437/0x570 net/ieee802154/socket.c:682
[<ffffffff836345b6>] sock_sendmsg_nosec net/socket.c:702 [inline]
[<ffffffff836345b6>] sock_sendmsg+0x56/0x80 net/socket.c:722
Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
Signed-off-by: Dongliang Mu <redacted>
---
drivers/net/ieee802154/mac802154_hwsim.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
index ebc976b7fcc2..d97ed033ac77 100644
--- a/drivers/net/ieee802154/mac802154_hwsim.c
+++ b/drivers/net/ieee802154/mac802154_hwsim.c
@@ -132,9 +132,11 @@ static int hwsim_hw_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
struct sk_buff *newskb = pskb_copy(skb, GFP_ATOMIC);
einfo = rcu_dereference(e->info);
- if (newskb)
+ if (newskb) {
ieee802154_rx_irqsafe(e->endpoint->hw, newskb,
einfo->lqi);
+ kfree_skb(newskb);
+ }
}
}
rcu_read_unlock();--
2.25.1
Hi,
On Tue, 13 Jul 2021 at 01:40, Dongliang Mu [off-list ref] wrote:
hwsim_hw_xmit fails to deallocate the newskb copied by pskb_copy. Fix
this by adding kfree_skb after ieee802154_rx_irqsafe.
[<ffffffff836433fb>] __alloc_skb+0x22b/0x250 net/core/skbuff.c:414
[<ffffffff8364ad95>] __pskb_copy_fclone+0x75/0x360 net/core/skbuff.c:1609
[<ffffffff82ae65e3>] __pskb_copy include/linux/skbuff.h:1176 [inline]
[<ffffffff82ae65e3>] pskb_copy include/linux/skbuff.h:3207 [inline]
[<ffffffff82ae65e3>] hwsim_hw_xmit+0xd3/0x140 drivers/net/ieee802154/mac802154_hwsim.c:132
[<ffffffff83ff8f47>] drv_xmit_async net/mac802154/driver-ops.h:16 [inline]
[<ffffffff83ff8f47>] ieee802154_tx+0xc7/0x190 net/mac802154/tx.c:83
[<ffffffff83ff9138>] ieee802154_subif_start_xmit+0x58/0x70 net/mac802154/tx.c:132
[<ffffffff83670b82>] __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
[<ffffffff83670b82>] netdev_start_xmit include/linux/netdevice.h:4958 [inline]
[<ffffffff83670b82>] xmit_one net/core/dev.c:3658 [inline]
[<ffffffff83670b82>] dev_hard_start_xmit+0xe2/0x330 net/core/dev.c:3674
[<ffffffff83718028>] sch_direct_xmit+0xf8/0x520 net/sched/sch_generic.c:342
[<ffffffff8367193b>] __dev_xmit_skb net/core/dev.c:3874 [inline]
[<ffffffff8367193b>] __dev_queue_xmit+0xa3b/0x1360 net/core/dev.c:4241
[<ffffffff83ff5437>] dgram_sendmsg+0x437/0x570 net/ieee802154/socket.c:682
[<ffffffff836345b6>] sock_sendmsg_nosec net/socket.c:702 [inline]
[<ffffffff836345b6>] sock_sendmsg+0x56/0x80 net/socket.c:722
Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
Signed-off-by: Dongliang Mu <redacted>
sorry, I don't get the fix. Is this a memory leak? I remember there
was something reported by syzkaller [0] but I wasn't able yet to get
into it. Is it what you referring to?
__pskb_copy_fclone() shows "The returned buffer has a reference count
of 1" and ieee802154_rx_irqsafe() will queue the skb for a tasklet.
With your patch it will be immediately freed and a use after free will
occur. I believe there is something wrong in the error path of
802.15.4 frame parsing and that's why we sometimes have a leaks there.
I need to test this patch, but I don't get how this patch is supposed
to fix the issue.
- Alex
[0] https://groups.google.com/g/syzkaller-bugs/c/EoIvZbk3Zfo/m/AlKUiErlAwAJ
On Tue, Jul 13, 2021 at 9:47 PM Alexander Aring [off-list ref] wrote:
Hi,
On Tue, 13 Jul 2021 at 01:40, Dongliang Mu [off-list ref] wrote:
quoted
hwsim_hw_xmit fails to deallocate the newskb copied by pskb_copy. Fix
this by adding kfree_skb after ieee802154_rx_irqsafe.
[<ffffffff836433fb>] __alloc_skb+0x22b/0x250 net/core/skbuff.c:414
[<ffffffff8364ad95>] __pskb_copy_fclone+0x75/0x360 net/core/skbuff.c:1609
[<ffffffff82ae65e3>] __pskb_copy include/linux/skbuff.h:1176 [inline]
[<ffffffff82ae65e3>] pskb_copy include/linux/skbuff.h:3207 [inline]
[<ffffffff82ae65e3>] hwsim_hw_xmit+0xd3/0x140 drivers/net/ieee802154/mac802154_hwsim.c:132
[<ffffffff83ff8f47>] drv_xmit_async net/mac802154/driver-ops.h:16 [inline]
[<ffffffff83ff8f47>] ieee802154_tx+0xc7/0x190 net/mac802154/tx.c:83
[<ffffffff83ff9138>] ieee802154_subif_start_xmit+0x58/0x70 net/mac802154/tx.c:132
[<ffffffff83670b82>] __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
[<ffffffff83670b82>] netdev_start_xmit include/linux/netdevice.h:4958 [inline]
[<ffffffff83670b82>] xmit_one net/core/dev.c:3658 [inline]
[<ffffffff83670b82>] dev_hard_start_xmit+0xe2/0x330 net/core/dev.c:3674
[<ffffffff83718028>] sch_direct_xmit+0xf8/0x520 net/sched/sch_generic.c:342
[<ffffffff8367193b>] __dev_xmit_skb net/core/dev.c:3874 [inline]
[<ffffffff8367193b>] __dev_queue_xmit+0xa3b/0x1360 net/core/dev.c:4241
[<ffffffff83ff5437>] dgram_sendmsg+0x437/0x570 net/ieee802154/socket.c:682
[<ffffffff836345b6>] sock_sendmsg_nosec net/socket.c:702 [inline]
[<ffffffff836345b6>] sock_sendmsg+0x56/0x80 net/socket.c:722
Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
Signed-off-by: Dongliang Mu <redacted>
sorry, I don't get the fix. Is this a memory leak? I remember there
was something reported by syzkaller [0] but I wasn't able yet to get
into it. Is it what you referring to?
Yes, you're right.
I get this memory leak many times in my local syzkaller instance but
do not recognize there is already a bug report in the syzbot
dashboard.
__pskb_copy_fclone() shows "The returned buffer has a reference count
of 1" and ieee802154_rx_irqsafe() will queue the skb for a tasklet.
With your patch it will be immediately freed and a use after free will
occur.
Thanks for your feedback. I am sorry about this fix since I did not
observe UAF in my testing.
I will keep learning more materials about socket in Linux kernel. :)
I believe there is something wrong in the error path of
802.15.4 frame parsing and that's why we sometimes have a leaks there.
Should be yes, it occurs many times in my local syzkaller instance.
I need to test this patch, but I don't get how this patch is supposed
to fix the issue.
This patch should be incorrect. Please directly focus on bug reports
on the syzbot dashboard. If possible, please cc me your final patch
about this bug. I can learn something from this bug.
Best regards
Dongliang Mu
- Alex
[0] https://groups.google.com/g/syzkaller-bugs/c/EoIvZbk3Zfo/m/AlKUiErlAwAJ