From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751996AbbLIPeZ (ORCPT ); Wed, 9 Dec 2015 10:34:25 -0500 Received: from mail-qg0-f51.google.com ([209.85.192.51]:35954 "EHLO mail-qg0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751445AbbLIPeW (ORCPT ); Wed, 9 Dec 2015 10:34:22 -0500 Subject: Re: [PATCH net] ipv6: sctp: clone options to avoid use after free To: Eric Dumazet , Eric Dumazet References: <20151209145917.GA3884@mrl.redhat.com> <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> Cc: Marcelo Ricardo Leitner , Dmitry Vyukov , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Neil Horman , linux-sctp@vger.kernel.org, syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin From: Vlad Yasevich Message-ID: <566849F9.2090502@gmail.com> Date: Wed, 9 Dec 2015 10:34:17 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/09/2015 10:25 AM, Eric Dumazet wrote: > From: Eric Dumazet > > SCTP is lacking proper np->opt cloning at accept() time. > > TCP and DCCP use ipv6_dup_options() helper, do the same > in SCTP. > > We might later factorize this code in a common helper to avoid > future mistakes. > > Reported-by: Dmitry Vyukov > Signed-off-by: Eric Dumazet Acked-by: Vlad Yasevich This is sufficient for accept() processing, but looks like peeloff is missing a bunch of ipv6 support. I'll see if I can cook something up to fix that part. -vlad > --- > net/sctp/ipv6.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c > index d28c0b4c9128..ec529121f38a 100644 > --- a/net/sctp/ipv6.c > +++ b/net/sctp/ipv6.c > @@ -641,6 +641,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, > struct sock *newsk; > struct ipv6_pinfo *newnp, *np = inet6_sk(sk); > struct sctp6_sock *newsctp6sk; > + struct ipv6_txoptions *opt; > > newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0); > if (!newsk) > @@ -660,6 +661,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, > > memcpy(newnp, np, sizeof(struct ipv6_pinfo)); > > + rcu_read_lock(); > + opt = rcu_dereference(np->opt); > + if (opt) > + opt = ipv6_dup_options(newsk, opt); > + RCU_INIT_POINTER(newnp->opt, opt); > + rcu_read_unlock(); > + > /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname() > * and getpeername(). > */ > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vlad Yasevich Date: Wed, 09 Dec 2015 15:34:17 +0000 Subject: Re: [PATCH net] ipv6: sctp: clone options to avoid use after free Message-Id: <566849F9.2090502@gmail.com> List-Id: References: <20151209145917.GA3884@mrl.redhat.com> <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> In-Reply-To: <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Eric Dumazet , Eric Dumazet Cc: Marcelo Ricardo Leitner , Dmitry Vyukov , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Neil Horman , linux-sctp@vger.kernel.org, syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin On 12/09/2015 10:25 AM, Eric Dumazet wrote: > From: Eric Dumazet > > SCTP is lacking proper np->opt cloning at accept() time. > > TCP and DCCP use ipv6_dup_options() helper, do the same > in SCTP. > > We might later factorize this code in a common helper to avoid > future mistakes. > > Reported-by: Dmitry Vyukov > Signed-off-by: Eric Dumazet Acked-by: Vlad Yasevich This is sufficient for accept() processing, but looks like peeloff is missing a bunch of ipv6 support. I'll see if I can cook something up to fix that part. -vlad > --- > net/sctp/ipv6.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c > index d28c0b4c9128..ec529121f38a 100644 > --- a/net/sctp/ipv6.c > +++ b/net/sctp/ipv6.c > @@ -641,6 +641,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, > struct sock *newsk; > struct ipv6_pinfo *newnp, *np = inet6_sk(sk); > struct sctp6_sock *newsctp6sk; > + struct ipv6_txoptions *opt; > > newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0); > if (!newsk) > @@ -660,6 +661,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, > > memcpy(newnp, np, sizeof(struct ipv6_pinfo)); > > + rcu_read_lock(); > + opt = rcu_dereference(np->opt); > + if (opt) > + opt = ipv6_dup_options(newsk, opt); > + RCU_INIT_POINTER(newnp->opt, opt); > + rcu_read_unlock(); > + > /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname() > * and getpeername(). > */ > >