From: kovalev@altlinux.org
To: pablo@netfilter.org, laforge@gnumonks.org, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: kovalev@altlinux.org, nickel@altlinux.org,
oficerovas@altlinux.org, dutyrok@altlinux.org
Subject: [PATCH 1/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
Date: Wed, 24 Jan 2024 13:14:04 +0300 [thread overview]
Message-ID: <20240124101404.161655-2-kovalev@altlinux.org> (raw)
In-Reply-To: <20240124101404.161655-1-kovalev@altlinux.org>
From: Vasiliy Kovalev <kovalev@altlinux.org>
After unloading the module, an instance continues to exist that accesses
outdated memory addresses.
To prevent this, the dump_pdp_en flag has been added, which blocks the
dump of pdp contexts by a false value. And only after these checks can
the net_generic() function be called.
These errors were found using the syzkaller program:
Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug.
gtp: GTP module loaded (pdp ctx size 104 bytes)
gtp: GTP module unloaded
general protection fault, probably for non-canonical address
0xdffffc0000000001:0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 2782 Comm: syz-executor139 Not tainted 5.10.200-std-def-alt1 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-alt1
RIP: 0010:gtp_genl_dump_pdp+0x1b1/0x790 [gtp]
...
Call Trace:
genl_lock_dumpit+0x6b/0xa0 net/netlink/genetlink.c:623
netlink_dump+0x575/0xc70 net/netlink/af_netlink.c:2271
__netlink_dump_start+0x64e/0x910 net/netlink/af_netlink.c:2376
genl_family_rcv_msg_dumpit+0x2b8/0x310 net/netlink/genetlink.c:686
genl_family_rcv_msg net/netlink/genetlink.c:780 [inline]
genl_rcv_msg+0x450/0x5a0 net/netlink/genetlink.c:800
netlink_rcv_skb+0x150/0x440 net/netlink/af_netlink.c:2497
genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1348
netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x159/0x190 net/socket.c:663
____sys_sendmsg+0x712/0x870 net/socket.c:2376
___sys_sendmsg+0xf8/0x170 net/socket.c:2430
__sys_sendmsg+0xea/0x1b0 net/socket.c:2459
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f2ea16c2d49
Fixes: 94a6d9fb88df ("gtp: fix wrong condition in gtp_genl_dump_pdp()")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
---
drivers/net/gtp.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 477b4d4f860bd3..3fc4639711cd83 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1675,6 +1675,8 @@ static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
return err;
}
+static bool dump_pdp_en;
+
static int gtp_genl_dump_pdp(struct sk_buff *skb,
struct netlink_callback *cb)
{
@@ -1684,12 +1686,19 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
struct pdp_ctx *pctx;
struct gtp_net *gn;
- gn = net_generic(net, gtp_net_id);
-
- if (cb->args[4])
+ /* Do not allow further operations if the module is
+ * unloaded before or after the process is blocked.
+ */
+ if (!dump_pdp_en)
return 0;
rcu_read_lock();
+ if (!dump_pdp_en || cb->args[4]) {
+ rcu_read_unlock();
+ return 0;
+ }
+ gn = net_generic(net, gtp_net_id);
+
list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
if (last_gtp && last_gtp != gtp)
continue;
@@ -1914,6 +1923,8 @@ static int __init gtp_init(void)
if (err < 0)
goto unreg_genl_family;
+ dump_pdp_en = true;
+
pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
sizeof(struct pdp_ctx));
return 0;
@@ -1930,6 +1941,7 @@ late_initcall(gtp_init);
static void __exit gtp_fini(void)
{
+ dump_pdp_en = false;
genl_unregister_family(>p_genl_family);
rtnl_link_unregister(>p_link_ops);
unregister_pernet_subsys(>p_net_ops);
--
2.33.8
next prev parent reply other threads:[~2024-01-24 10:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-24 10:14 [PATCH 0/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() kovalev
2024-01-24 10:14 ` kovalev [this message]
2024-01-24 10:42 ` [PATCH 1/1] " Eric Dumazet
2024-01-24 10:57 ` Eric Dumazet
2024-01-24 11:20 ` kovalev
2024-01-24 11:52 ` Eric Dumazet
2024-02-09 18:16 ` kovalev
2024-02-09 19:21 ` Eric Dumazet
2024-02-14 16:50 ` kovalev
2024-02-15 20:32 ` Eric Dumazet
2024-01-29 12:02 ` Pablo Neira Ayuso
2024-01-29 16:53 ` kovalev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240124101404.161655-2-kovalev@altlinux.org \
--to=kovalev@altlinux.org \
--cc=davem@davemloft.net \
--cc=dutyrok@altlinux.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=laforge@gnumonks.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nickel@altlinux.org \
--cc=oficerovas@altlinux.org \
--cc=osmocom-net-gprs@lists.osmocom.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).