From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>,
Jakub Kicinski <jakub.kicinski@netronome.com>
Subject: [PATCH 4.14 90/91] gtp: fix an use-after-free in ipv4_pdp_find()
Date: Thu, 2 Jan 2020 23:08:12 +0100 [thread overview]
Message-ID: <20200102220453.369797268@linuxfoundation.org> (raw)
In-Reply-To: <20200102220356.856162165@linuxfoundation.org>
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 94dc550a5062030569d4aa76e10e50c8fc001930 ]
ipv4_pdp_find() is called in TX packet path of GTP.
ipv4_pdp_find() internally uses gtp->tid_hash to lookup pdp context.
In the current code, gtp->tid_hash and gtp->addr_hash are freed by
->dellink(), which is gtp_dellink().
But gtp_dellink() would be called while packets are processing.
So, gtp_dellink() should not free gtp->tid_hash and gtp->addr_hash.
Instead, dev->priv_destructor() would be used because this callback
is called after all packet processing safely.
Test commands:
ip link add veth1 type veth peer name veth2
ip a a 172.0.0.1/24 dev veth1
ip link set veth1 up
ip a a 172.99.0.1/32 dev lo
gtp-link add gtp1 &
gtp-tunnel add gtp1 v1 200 100 172.99.0.2 172.0.0.2
ip r a 172.99.0.2/32 dev gtp1
ip link set gtp1 mtu 1500
ip netns add ns2
ip link set veth2 netns ns2
ip netns exec ns2 ip a a 172.0.0.2/24 dev veth2
ip netns exec ns2 ip link set veth2 up
ip netns exec ns2 ip a a 172.99.0.2/32 dev lo
ip netns exec ns2 ip link set lo up
ip netns exec ns2 gtp-link add gtp2 &
ip netns exec ns2 gtp-tunnel add gtp2 v1 100 200 172.99.0.1 172.0.0.1
ip netns exec ns2 ip r a 172.99.0.1/32 dev gtp2
ip netns exec ns2 ip link set gtp2 mtu 1500
hping3 172.99.0.2 -2 --flood &
ip link del gtp1
Splat looks like:
[ 72.568081][ T1195] BUG: KASAN: use-after-free in ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.568916][ T1195] Read of size 8 at addr ffff8880b9a35d28 by task hping3/1195
[ 72.569631][ T1195]
[ 72.569861][ T1195] CPU: 2 PID: 1195 Comm: hping3 Not tainted 5.5.0-rc1 #199
[ 72.570547][ T1195] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 72.571438][ T1195] Call Trace:
[ 72.571764][ T1195] dump_stack+0x96/0xdb
[ 72.572171][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.572761][ T1195] print_address_description.constprop.5+0x1be/0x360
[ 72.573400][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.573971][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.574544][ T1195] __kasan_report+0x12a/0x16f
[ 72.575014][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.575593][ T1195] kasan_report+0xe/0x20
[ 72.576004][ T1195] ipv4_pdp_find.isra.12+0x130/0x170 [gtp]
[ 72.576577][ T1195] gtp_build_skb_ip4+0x199/0x1420 [gtp]
[ ... ]
[ 72.647671][ T1195] BUG: unable to handle page fault for address: ffff8880b9a35d28
[ 72.648512][ T1195] #PF: supervisor read access in kernel mode
[ 72.649158][ T1195] #PF: error_code(0x0000) - not-present page
[ 72.649849][ T1195] PGD a6c01067 P4D a6c01067 PUD 11fb07067 PMD 11f939067 PTE 800fffff465ca060
[ 72.652958][ T1195] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 72.653834][ T1195] CPU: 2 PID: 1195 Comm: hping3 Tainted: G B 5.5.0-rc1 #199
[ 72.668062][ T1195] RIP: 0010:ipv4_pdp_find.isra.12+0x86/0x170 [gtp]
[ ... ]
[ 72.679168][ T1195] Call Trace:
[ 72.679603][ T1195] gtp_build_skb_ip4+0x199/0x1420 [gtp]
[ 72.681915][ T1195] ? ipv4_pdp_find.isra.12+0x170/0x170 [gtp]
[ 72.682513][ T1195] ? lock_acquire+0x164/0x3b0
[ 72.682966][ T1195] ? gtp_dev_xmit+0x35e/0x890 [gtp]
[ 72.683481][ T1195] gtp_dev_xmit+0x3c2/0x890 [gtp]
[ ... ]
Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/gtp.c | 34 +++++++++++++++++-----------------
1 file changed, 17 insertions(+), 17 deletions(-)
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -644,9 +644,16 @@ static void gtp_link_setup(struct net_de
}
static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
-static void gtp_hashtable_free(struct gtp_dev *gtp);
static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
+static void gtp_destructor(struct net_device *dev)
+{
+ struct gtp_dev *gtp = netdev_priv(dev);
+
+ kfree(gtp->addr_hash);
+ kfree(gtp->tid_hash);
+}
+
static int gtp_newlink(struct net *src_net, struct net_device *dev,
struct nlattr *tb[], struct nlattr *data[],
struct netlink_ext_ack *extack)
@@ -681,13 +688,15 @@ static int gtp_newlink(struct net *src_n
gn = net_generic(dev_net(dev), gtp_net_id);
list_add_rcu(>p->list, &gn->gtp_dev_list);
+ dev->priv_destructor = gtp_destructor;
netdev_dbg(dev, "registered new GTP interface\n");
return 0;
out_hashtable:
- gtp_hashtable_free(gtp);
+ kfree(gtp->addr_hash);
+ kfree(gtp->tid_hash);
out_encap:
gtp_encap_disable(gtp);
return err;
@@ -696,9 +705,14 @@ out_encap:
static void gtp_dellink(struct net_device *dev, struct list_head *head)
{
struct gtp_dev *gtp = netdev_priv(dev);
+ struct pdp_ctx *pctx;
+ int i;
+
+ for (i = 0; i < gtp->hash_size; i++)
+ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid)
+ pdp_context_delete(pctx);
gtp_encap_disable(gtp);
- gtp_hashtable_free(gtp);
list_del_rcu(>p->list);
unregister_netdevice_queue(dev, head);
}
@@ -774,20 +788,6 @@ err1:
return -ENOMEM;
}
-static void gtp_hashtable_free(struct gtp_dev *gtp)
-{
- struct pdp_ctx *pctx;
- int i;
-
- for (i = 0; i < gtp->hash_size; i++)
- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid)
- pdp_context_delete(pctx);
-
- synchronize_rcu();
- kfree(gtp->addr_hash);
- kfree(gtp->tid_hash);
-}
-
static struct sock *gtp_encap_enable_socket(int fd, int type,
struct gtp_dev *gtp)
{
next prev parent reply other threads:[~2020-01-02 22:27 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-02 22:06 [PATCH 4.14 00/91] 4.14.162-stable review Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 01/91] scsi: lpfc: Fix discovery failures when target device connectivity bounces Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 02/91] scsi: mpt3sas: Fix clear pending bit in ioctl status Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 03/91] scsi: lpfc: Fix locking on mailbox command completion Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 04/91] Input: atmel_mxt_ts - disable IRQ across suspend Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 05/91] iommu/tegra-smmu: Fix page tables in > 4 GiB memory Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 06/91] scsi: target: compare full CHAP_A Algorithm strings Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 07/91] scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 08/91] scsi: csiostor: Dont enable IRQs too early Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 09/91] powerpc/pseries: Mark accumulate_stolen_time() as notrace Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 10/91] powerpc/pseries: Dont fail hash page table insert for bolted mapping Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 11/91] powerpc/tools: Dont quote $objdump in scripts Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 12/91] dma-debug: add a schedule point in debug_dma_dump_mappings() Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 13/91] clocksource/drivers/asm9260: Add a check for of_clk_get Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 14/91] powerpc/security/book3s64: Report L1TF status in sysfs Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 15/91] powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 16/91] ext4: update direct I/O read lock pattern for IOCB_NOWAIT Greg Kroah-Hartman
2020-01-02 22:06 ` [PATCH 4.14 17/91] jbd2: Fix statistics for the number of logged blocks Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 18/91] scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 19/91] scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 20/91] f2fs: fix to update dirs i_pino during cross_rename Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 21/91] clk: qcom: Allow constant ratio freq tables for rcg Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 22/91] irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 23/91] irqchip: ingenic: Error out if IRQ domain creation failed Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 24/91] mfd: mfd-core: Honour Device Trees request to disable a child-device Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 25/91] fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 26/91] scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 27/91] scsi: ufs: fix potential bug which ends in system hang Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 28/91] powerpc/pseries/cmm: Implement release() function for sysfs device Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 29/91] powerpc/security: Fix wrong message when RFI Flush is disable Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 30/91] scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 31/91] clk: pxa: fix one of the pxa RTC clocks Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 32/91] bcache: at least try to shrink 1 node in bch_mca_scan() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 33/91] HID: logitech-hidpp: Silence intermittent get_battery_capacity errors Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 34/91] libnvdimm/btt: fix variable rc set but not used Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 35/91] HID: Improve Windows Precision Touchpad detection Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 36/91] scsi: pm80xx: Fix for SATA device discovery Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 37/91] scsi: ufs: Fix error handing during hibern8 enter Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 38/91] scsi: scsi_debug: num_tgts must be >= 0 Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 39/91] scsi: NCR5380: Add disconnect_mask module parameter Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 40/91] scsi: iscsi: Dont send data to unbound connection Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 41/91] scsi: target: iscsi: Wait for all commands to finish before freeing a session Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 42/91] gpio: mpc8xxx: Dont overwrite default irq_set_type callback Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 43/91] apparmor: fix unsigned len comparison with less than zero Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 44/91] scripts/kallsyms: fix definitely-lost memory leak Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 45/91] f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 46/91] cdrom: respect device capabilities during opening action Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 47/91] perf script: Fix brstackinsn for AUXTRACE Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 48/91] perf regs: Make perf_reg_name() return "unknown" instead of NULL Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 49/91] s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 50/91] libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 51/91] s390/cpum_sf: Check for SDBT and SDB consistency Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 52/91] ocfs2: fix passing zero to PTR_ERR warning Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 53/91] kernel: sysctl: make drop_caches write-only Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 54/91] userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 55/91] x86/mce: Fix possibly incorrect severity calculation on AMD Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 56/91] net, sysctl: Fix compiler warning when only cBPF is present Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 57/91] netfilter: nf_queue: enqueue skbs with NULL dst Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 58/91] ALSA: hda - Downgrade error message for single-cmd fallback Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 59/91] bonding: fix active-backup transition after link failure Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 60/91] perf strbuf: Remove redundant va_end() in strbuf_addv() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 61/91] Make filldir[64]() verify the directory entry filename is valid Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 62/91] filldir[64]: remove WARN_ON_ONCE() for bad directory entries Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 63/91] PCI/switchtec: Read all 64 bits of part_event_bitmap Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 64/91] netfilter: ebtables: compat: reject all padding in matches/watchers Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 65/91] 6pack,mkiss: fix possible deadlock Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 66/91] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 67/91] inetpeer: fix data-race in inet_putpeer / inet_putpeer Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 68/91] net: add a READ_ONCE() in skb_peek_tail() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 69/91] net: icmp: fix data-race in cmp_global_allow() Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 70/91] hrtimer: Annotate lockless access to timer->state Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 71/91] spi: fsl: dont map irq during probe Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 72/91] tty/serial: atmel: fix out of range clock divider handling Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 73/91] pinctrl: baytrail: Really serialize all register accesses Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 74/91] net: ena: fix napi handler misbehavior when the napi budget is zero Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 75/91] net/mlxfw: Fix out-of-memory error in mfa2 flash burning Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 76/91] ptp: fix the race between the release of ptp_clock and cdev Greg Kroah-Hartman
2020-01-02 22:07 ` [PATCH 4.14 77/91] udp: fix integer overflow while computing available space in sk_rcvbuf Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 78/91] vhost/vsock: accept only packets with the right dst_cid Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 79/91] net: add bool confirm_neigh parameter for dst_ops.update_pmtu Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 80/91] ip6_gre: do not confirm neighbor when do pmtu update Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 81/91] gtp: " Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 82/91] net/dst: add new function skb_dst_update_pmtu_no_confirm Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 83/91] tunnel: do not confirm neighbor when do pmtu update Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 84/91] vti: " Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 85/91] sit: " Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 86/91] gtp: do not allow adding duplicate tid and ms_addr pdp context Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 87/91] tcp/dccp: fix possible race __inet_lookup_established() Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 88/91] tcp: do not send empty skb from tcp_write_xmit() Greg Kroah-Hartman
2020-01-02 22:08 ` [PATCH 4.14 89/91] gtp: fix wrong condition in gtp_genl_dump_pdp() Greg Kroah-Hartman
2020-01-02 22:08 ` Greg Kroah-Hartman [this message]
2020-01-02 22:08 ` [PATCH 4.14 91/91] gtp: avoid zero size hashtable Greg Kroah-Hartman
2020-01-02 23:05 ` [PATCH 4.14 00/91] 4.14.162-stable review Guenter Roeck
2020-01-03 0:16 ` Sasha Levin
2020-01-03 8:38 ` Greg Kroah-Hartman
2020-01-03 13:43 ` Naresh Kamboju
2020-01-03 14:29 ` Guenter Roeck
2020-01-03 17:50 ` Jon Hunter
2020-01-03 22:01 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200102220453.369797268@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ap420073@gmail.com \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).