From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Muchun Song <songmuchun@bytedance.com>,
Cong Wang <cong.wang@bytedance.com>,
Fam Zheng <fam.zheng@bytedance.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.4 36/37] net: fix use-after-free in tw_timer_handler
Date: Mon, 3 Jan 2022 15:24:14 +0100 [thread overview]
Message-ID: <20220103142052.985722765@linuxfoundation.org> (raw)
In-Reply-To: <20220103142051.883166998@linuxfoundation.org>
From: Muchun Song <songmuchun@bytedance.com>
commit e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 upstream.
A real world panic issue was found as follow in Linux 5.4.
BUG: unable to handle page fault for address: ffffde49a863de28
PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
RIP: 0010:tw_timer_handler+0x20/0x40
Call Trace:
<IRQ>
call_timer_fn+0x2b/0x120
run_timer_softirq+0x1ef/0x450
__do_softirq+0x10d/0x2b8
irq_exit+0xc7/0xd0
smp_apic_timer_interrupt+0x68/0x120
apic_timer_interrupt+0xf/0x20
This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.
The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops
in the list of pernet_list. There will be a use-after-free on
net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net
if there are some inflight time-wait timers.
This bug is not introduced by commit f2bf415cfed7 ("mib: add net to
NET_ADD_STATS_BH") since the net_statistics is a global variable
instead of dynamic allocation and freeing. Actually, commit
61a7e26028b9 ("mib: put net statistics on struct net") introduces
the bug since it put net statistics on struct net and free it when
net namespace is destroyed.
Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug
and replace pr_crit() with panic() since continuing is meaningless
when init_ipv4_mibs() fails.
[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1
Fixes: 61a7e26028b9 ("mib: put net statistics on struct net")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Cong Wang <cong.wang@bytedance.com>
Cc: Fam Zheng <fam.zheng@bytedance.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211228104145.9426-1-songmuchun@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/af_inet.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1974,6 +1974,10 @@ static int __init inet_init(void)
ip_init();
+ /* Initialise per-cpu ipv4 mibs */
+ if (init_ipv4_mibs())
+ panic("%s: Cannot init ipv4 mibs\n", __func__);
+
/* Setup TCP slab cache for open requests. */
tcp_init();
@@ -2004,12 +2008,6 @@ static int __init inet_init(void)
if (init_inet_pernet_ops())
pr_crit("%s: Cannot init ipv4 inet pernet ops\n", __func__);
- /*
- * Initialise per-cpu ipv4 mibs
- */
-
- if (init_ipv4_mibs())
- pr_crit("%s: Cannot init ipv4 mibs\n", __func__);
ipv4_proc_init();
next prev parent reply other threads:[~2022-01-03 14:28 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-03 14:23 [PATCH 5.4 00/37] 5.4.170-rc1 review Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 01/37] HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 02/37] tee: handle lookup of shm with reference count 0 Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 03/37] Input: i8042 - add deferred probe support Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 04/37] Input: i8042 - enable deferred probe quirk for ASUS UM325UA Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 05/37] tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok() Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 06/37] platform/x86: apple-gmux: use resource_size() with res Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 07/37] memblock: fix memblock_phys_alloc() section mismatch error Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 08/37] recordmcount.pl: fix typo in s390 mcount regex Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 09/37] selinux: initialize proto variable in selinux_ip_postroute_compat() Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 10/37] scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 11/37] net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 12/37] udp: using datalen to cap ipv6 udp max gso segments Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 13/37] selftests: Calculate udpgso segment count without header adjustment Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 14/37] net: phy: fixed_phy: Fix NULL vs IS_ERR() checking in __fixed_phy_register Greg Kroah-Hartman
2022-01-03 18:34 ` Florian Fainelli
2022-01-03 14:23 ` [PATCH 5.4 15/37] sctp: use call_rcu to free endpoint Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 16/37] net: usb: pegasus: Do not drop long Ethernet frames Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 17/37] net: lantiq_xrx200: fix statistics of received bytes Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 18/37] NFC: st21nfca: Fix memory leak in device probe and remove Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 19/37] ionic: Initialize the lif->dbid_inuse bitmap Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 20/37] net/mlx5e: Fix wrong features assignment in case of error Greg Kroah-Hartman
2022-01-03 14:23 ` [PATCH 5.4 21/37] selftests/net: udpgso_bench_tx: fix dst ip argument Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 22/37] net/ncsi: check for error return from call to nla_put_u32 Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 23/37] fsl/fman: Fix missing put_device() call in fman_port_probe Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 24/37] i2c: validate user data in compat ioctl Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 25/37] nfc: uapi: use kernel size_t to fix user-space builds Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 26/37] uapi: fix linux/nfc.h userspace compilation errors Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 27/37] xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 28/37] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 29/37] usb: mtu3: add memory barrier before set GPDs HWO Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 30/37] usb: mtu3: fix list_head check warning Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 31/37] usb: mtu3: set interval of FS intr and isoc endpoint Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 32/37] binder: fix async_free_space accounting for empty parcels Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 33/37] scsi: vmw_pvscsi: Set residual data length conditionally Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 34/37] Input: appletouch - initialize work before device registration Greg Kroah-Hartman
2022-01-03 14:24 ` [PATCH 5.4 35/37] Input: spaceball - fix parsing of movement data packets Greg Kroah-Hartman
2022-01-03 14:24 ` Greg Kroah-Hartman [this message]
2022-01-03 14:24 ` [PATCH 5.4 37/37] perf script: Fix CPU filtering of a scripts switch events Greg Kroah-Hartman
2022-01-03 19:02 ` [PATCH 5.4 00/37] 5.4.170-rc1 review Florian Fainelli
2022-01-04 6:28 ` Naresh Kamboju
2022-01-04 1:27 ` Guenter Roeck
2022-01-04 9:53 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220103142052.985722765@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=cong.wang@bytedance.com \
--cc=fam.zheng@bytedance.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=songmuchun@bytedance.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).