From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC26FC4332B for ; Wed, 3 Mar 2021 03:01:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B8AEB64EC3 for ; Wed, 3 Mar 2021 03:01:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344483AbhCCCzl (ORCPT ); Tue, 2 Mar 2021 21:55:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231238AbhCCAOZ (ORCPT ); Tue, 2 Mar 2021 19:14:25 -0500 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94255C06178B for ; Tue, 2 Mar 2021 16:13:35 -0800 (PST) Received: by mail-ej1-x631.google.com with SMTP id hs11so38776477ejc.1 for ; Tue, 02 Mar 2021 16:13:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=dm4OZHUwldy8T/Eg62HwAPhGG9sTbN3pRz7euTlh8Xg=; b=idsUmG0LIP09zX7WRWPg65tC02nS35rxQSinYjxTNFOP3OFFCd3wG0O5J1s/AFMvTf xZfYE9nyYjaWn9xuYKrhuau8oIzUz+t4PwWiCh9g6hLRJwzYxGjJD4R8pDPf14TDvl65 A6eaOukS5dk41ALi3SV0+KwAjYF1k0IGq4g8NPKAiOSgY+LVtsVVZhaQEWCl/FhHhQDX Hdl8UFuy2UqUcLsyTiB4vP2BSYkilSc+WX26S8W3ouQnTfo3Ipy4e3CibG1ZiIt5hrIc fNbxuPCHKzPOx886diHh3RRE4DKelaaemONDngSSLJtcKXgJ/9KlvdOxWIrEYAbOKtWM 8xhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=dm4OZHUwldy8T/Eg62HwAPhGG9sTbN3pRz7euTlh8Xg=; b=OSGOMEoifm1StPqelGUFxjyxVLqiera7Ph9W/+NnTCDXNMuvqX6S6QEAOoI4WtTIeE RAbB12tJrAfMY8JlrbtDkIapzNEvtGf0I8ClVskvxYziu+tOdy5PngZXqjUa8Rf5EeeZ cqGM85VccUtu0PdBxMLvHRCMvZAl8bekGoGqSGbXrW80etbVLBQT4VquCSb9ErzQYvv0 N9cr3twpcV958gRDZKH4G98zTI2+RZqPCzqAT2i8HCCOcAwPRJ+QZ65TKnjtfkahv1j+ aLv0NbYdFkSnlkncEtNZtrN9dcVo3566cTR2H5FqpymYT1ROHMRBHb1feeMMb/iY6jYj ySRg== X-Gm-Message-State: AOAM533A93lFtR7eQAreytiF2Tdxn2hJbI3w8Dpq8mN/3Wwm7BTsmLDS RxLuOfi2KCL/hrXhekG59/cMmqcyBSekiudRcl3f X-Google-Smtp-Source: ABdhPJwoo90TZ45+GiPaXd4NJ2owiENOf090X38l/SOu8BNqL4A9a6rpKuuMBRaVk99+xqjhEClWf992ASiAIRB+Lg4= X-Received: by 2002:a17:906:e116:: with SMTP id gj22mr22774244ejb.398.1614730414067; Tue, 02 Mar 2021 16:13:34 -0800 (PST) MIME-Version: 1.0 References: <0000000000006305c005bc8ba7f0@google.com> In-Reply-To: From: Paul Moore Date: Tue, 2 Mar 2021 19:13:23 -0500 Message-ID: Subject: Re: KASAN: use-after-free Read in cipso_v4_genopt To: Dmitry Vyukov Cc: syzbot , David Miller , dsahern@kernel.org, Jakub Kicinski , LKML , linux-security-module , netdev , syzkaller-bugs , Hideaki YOSHIFUJI Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: On Tue, Mar 2, 2021 at 2:15 PM Dmitry Vyukov wrote: ... > Not sure if it's the root cause or not, but I am looking at this > reference drop in cipso_v4_doi_remove: > https://elixir.bootlin.com/linux/v5.12-rc1/source/net/ipv4/cipso_ipv4.c#L522 > The thing is that it does not remove from the list if reference is not > 0, right? So what if I send 1000 of netlink remove messages? Will it > drain refcount to 0? > I did not read all involved code, but the typical pattern is to drop > refcount and always remove from the list. Then the last use will > delete the object. > Does it make any sense? Looking at it quickly, the logic above seems sane. I wrote this code a *long* time ago, so let me get my head back into it and make sure that still holds. -- paul moore www.paul-moore.com