* [net] vxlan: fix use-after-free on deletion
@ 2017-06-01 8:43 Mark Bloch
2017-06-01 8:53 ` Jiri Benc
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Mark Bloch @ 2017-06-01 8:43 UTC (permalink / raw)
To: jbenc, roopa; +Cc: netdev
Adding a vxlan interface to a socket isn't symmetrical, while adding
is done in vxlan_open() the deletion is done in vxlan_dellink().
This can cause a use-after-free error when we close the vxlan
interface before deleting it.
We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
it from vxlan_stop() to match the call from vxlan_open().
Signed-off-by: Mark Bloch <markb@mellanox.com>
---
drivers/net/vxlan.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b471..f6a4310 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@
static int vxlan_sock_add(struct vxlan_dev *vxlan);
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
/* per-network namespace private data for this module */
struct vxlan_net {
struct list_head vxlan_list;
@@ -1067,6 +1069,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
rcu_assign_pointer(vxlan->vn4_sock, NULL);
synchronize_net();
+ vxlan_vs_del_dev(vxlan);
+
if (__vxlan_sock_release_prep(sock4)) {
udp_tunnel_sock_release(sock4->sock);
kfree(sock4);
@@ -2342,6 +2346,15 @@ static void vxlan_cleanup(unsigned long arg)
mod_timer(&vxlan->age_timer, next_timer);
}
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+ struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+ spin_lock(&vn->sock_lock);
+ hlist_del_init_rcu(&vxlan->hlist);
+ spin_unlock(&vn->sock_lock);
+}
+
static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
{
struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -3286,15 +3299,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
static void vxlan_dellink(struct net_device *dev, struct list_head *head)
{
struct vxlan_dev *vxlan = netdev_priv(dev);
- struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
vxlan_flush(vxlan, true);
- spin_lock(&vn->sock_lock);
- if (!hlist_unhashed(&vxlan->hlist))
- hlist_del_rcu(&vxlan->hlist);
- spin_unlock(&vn->sock_lock);
-
gro_cells_destroy(&vxlan->gro_cells);
list_del(&vxlan->next);
unregister_netdevice_queue(dev, head);
--
1.8.4.3
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [net] vxlan: fix use-after-free on deletion
2017-06-01 8:43 [net] vxlan: fix use-after-free on deletion Mark Bloch
@ 2017-06-01 8:53 ` Jiri Benc
2017-06-01 11:32 ` Roi Dayan
2017-06-01 10:17 ` Or Gerlitz
2017-06-01 15:54 ` David Miller
2 siblings, 1 reply; 5+ messages in thread
From: Jiri Benc @ 2017-06-01 8:53 UTC (permalink / raw)
To: Mark Bloch; +Cc: roopa, netdev
On Thu, 1 Jun 2017 11:43:35 +0300, Mark Bloch wrote:
> Adding a vxlan interface to a socket isn't symmetrical, while adding
> is done in vxlan_open() the deletion is done in vxlan_dellink().
> This can cause a use-after-free error when we close the vxlan
> interface before deleting it.
>
> We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
> it from vxlan_stop() to match the call from vxlan_open().
>
> Signed-off-by: Mark Bloch <markb@mellanox.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [net] vxlan: fix use-after-free on deletion
2017-06-01 8:43 [net] vxlan: fix use-after-free on deletion Mark Bloch
2017-06-01 8:53 ` Jiri Benc
@ 2017-06-01 10:17 ` Or Gerlitz
2017-06-01 15:54 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: Or Gerlitz @ 2017-06-01 10:17 UTC (permalink / raw)
To: Mark Bloch; +Cc: Jiri Benc, Roopa Prabhu, Linux Netdev List
On Thu, Jun 1, 2017 at 11:43 AM, Mark Bloch <markb@mellanox.com> wrote:
> Adding a vxlan interface to a socket isn't symmetrical, while adding
> is done in vxlan_open() the deletion is done in vxlan_dellink().
> This can cause a use-after-free error when we close the vxlan
> interface before deleting it.
>
> We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
> it from vxlan_stop() to match the call from vxlan_open().
>
If you are fixing a specific commit, best to put a proper Fixes that here
> Signed-off-by: Mark Bloch <markb@mellanox.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [net] vxlan: fix use-after-free on deletion
2017-06-01 8:53 ` Jiri Benc
@ 2017-06-01 11:32 ` Roi Dayan
0 siblings, 0 replies; 5+ messages in thread
From: Roi Dayan @ 2017-06-01 11:32 UTC (permalink / raw)
To: Jiri Benc, Mark Bloch; +Cc: roid, roopa, netdev
On 01/06/2017 11:53, Jiri Benc wrote:
> On Thu, 1 Jun 2017 11:43:35 +0300, Mark Bloch wrote:
>> Adding a vxlan interface to a socket isn't symmetrical, while adding
>> is done in vxlan_open() the deletion is done in vxlan_dellink().
>> This can cause a use-after-free error when we close the vxlan
>> interface before deleting it.
>>
>> We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
>> it from vxlan_stop() to match the call from vxlan_open().
>>
>> Signed-off-by: Mark Bloch <markb@mellanox.com>
>
> Acked-by: Jiri Benc <jbenc@redhat.com>
>
Hi, I did some tests and didn't reproduce the original kasan issue
reported.
Tested-by: Roi Dayan <roid@mellanox.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [net] vxlan: fix use-after-free on deletion
2017-06-01 8:43 [net] vxlan: fix use-after-free on deletion Mark Bloch
2017-06-01 8:53 ` Jiri Benc
2017-06-01 10:17 ` Or Gerlitz
@ 2017-06-01 15:54 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2017-06-01 15:54 UTC (permalink / raw)
To: markb; +Cc: jbenc, roopa, netdev
From: Mark Bloch <markb@mellanox.com>
Date: Thu, 1 Jun 2017 11:43:35 +0300
> Adding a vxlan interface to a socket isn't symmetrical, while adding
> is done in vxlan_open() the deletion is done in vxlan_dellink().
> This can cause a use-after-free error when we close the vxlan
> interface before deleting it.
>
> We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
> it from vxlan_stop() to match the call from vxlan_open().
>
> Signed-off-by: Mark Bloch <markb@mellanox.com>
Please add an appropriate Fixes: tag.
Thank you.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-06-01 15:54 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-01 8:43 [net] vxlan: fix use-after-free on deletion Mark Bloch
2017-06-01 8:53 ` Jiri Benc
2017-06-01 11:32 ` Roi Dayan
2017-06-01 10:17 ` Or Gerlitz
2017-06-01 15:54 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.