From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A725AC282C8 for ; Mon, 28 Jan 2019 09:13:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 68B8120881 for ; Mon, 28 Jan 2019 09:13:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="IBGW6V3j" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726668AbfA1JNj (ORCPT ); Mon, 28 Jan 2019 04:13:39 -0500 Received: from mail-lj1-f194.google.com ([209.85.208.194]:38487 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726611AbfA1JNj (ORCPT ); Mon, 28 Jan 2019 04:13:39 -0500 Received: by mail-lj1-f194.google.com with SMTP id c19-v6so13531340lja.5 for ; Mon, 28 Jan 2019 01:13:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=from:to:cc:subject:date:message-id; bh=D+LdPE+opc3xISD8lCMwQGwd8NWdaDkJJBDr0Ll79h4=; b=IBGW6V3jjyRWc72ZmQDqTB9jGhUX22S/ROLJ/uzCqn3a7r0ZJDx3Yk4Z+2cwkj1t7X HetLaocPrD0TTkHE19SQdsRaR2ybm0pufI+AoQqjO6b81hRotK5iL/Yx5vUBo1WIzN+d 675RGuXLQAb8S2gjQKOoYHl64U+0+WDbfsabU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=D+LdPE+opc3xISD8lCMwQGwd8NWdaDkJJBDr0Ll79h4=; b=PXCBAmrZDMPB0OrndndgsMImhhmNdJIMZvVVcmSrkCPsgUCDJoQON7GDpg8aPlwIj1 WEsCYY6f4noPOTuAYnDoMGolLdXPSBHTmKdNlR3zO0SfT05ZkWqEnxP+oqWyLB51NouC Wyb7WwlB7eCFrxveGJHU0qA0EnkpboaYA7Fxc6bEnwrlNoeE8yAwEEnRXIRjgRb0Ehg/ pzWsLJkieq/YV0Fmjaj+qYybpP0gVG14cjFtszcZdO4bJ/WOwhA4SWXW6LKeC5LXf0g+ vbBmhdjTmqB1sSOVXHRBW7QCy1HwW7iakFLvnERIAHXmHdfXIhJB9OfsQBD2wgryk6mh li9g== X-Gm-Message-State: AJcUukeZbZnnJrutGBksdtXNzyp/icTsVmH6+eX9lb1yTrzK8gQ2gfgo b6X82218dVWAXE9UEvBiTsmEhRGbBKs= X-Google-Smtp-Source: ALg8bN4yig8OIu9T4hWX2a241yGqBp9BMt2MeFbUJUNkXMQNhTSE0CyBRAvaWE0U5TcnLoxhGwSJ2Q== X-Received: by 2002:a2e:8006:: with SMTP id j6-v6mr16089086ljg.186.1548666816792; Mon, 28 Jan 2019 01:13:36 -0800 (PST) Received: from cloudflare.com ([176.221.114.230]) by smtp.gmail.com with ESMTPSA id l21-v6sm2835215ljj.48.2019.01.28.01.13.35 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Jan 2019 01:13:36 -0800 (PST) From: Jakub Sitnicki To: netdev@vger.kernel.org Cc: John Fastabend , Daniel Borkmann , Marek Majkowski Subject: [PATCH net] sk_msg: Always cancel strp work before freeing the psock Date: Mon, 28 Jan 2019 10:13:35 +0100 Message-Id: <20190128091335.20908-1-jakub@cloudflare.com> X-Mailer: git-send-email 2.17.2 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Despite having stopped the parser, we still need to deinitialize it by calling strp_done so that it cancels its work. Otherwise the worker thread can run after we have freed the parser, and attempt to access its workqueue resulting in a use-after-free: ================================================================== BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0 Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93 CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 Workqueue: (null) (kstrp) Call Trace: print_address_description+0x6e/0x2b0 ? pwq_activate_delayed_work+0x1b/0x1d0 kasan_report+0xfd/0x177 ? pwq_activate_delayed_work+0x1b/0x1d0 ? pwq_activate_delayed_work+0x1b/0x1d0 pwq_activate_delayed_work+0x1b/0x1d0 ? process_one_work+0x4aa/0x660 pwq_dec_nr_in_flight+0x9b/0x100 worker_thread+0x82/0x680 ? process_one_work+0x660/0x660 kthread+0x1b9/0x1e0 ? __kthread_create_on_node+0x250/0x250 ret_from_fork+0x1f/0x30 Allocated by task 111: sk_psock_init+0x3c/0x1b0 sock_map_link.isra.2+0x103/0x4b0 sock_map_update_common+0x94/0x270 sock_map_update_elem+0x145/0x160 __se_sys_bpf+0x152e/0x1e10 do_syscall_64+0xb2/0x3e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 112: kfree+0x7f/0x140 process_one_work+0x40b/0x660 worker_thread+0x82/0x680 kthread+0x1b9/0x1e0 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888069975180 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 192 bytes inside of 512-byte region [ffff888069975180, ffff888069975380) The buggy address belongs to the page: page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: Marek Majkowski Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com Signed-off-by: Jakub Sitnicki --- net/core/skmsg.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index d6d5c20d7044..8c826603bf36 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc) struct sk_psock *psock = container_of(gc, struct sk_psock, gc); /* No sk_callback_lock since already detached. */ - if (psock->parser.enabled) - strp_done(&psock->parser.strp); + strp_done(&psock->parser.strp); cancel_work_sync(&psock->work); -- 2.17.2