From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Fedor Pchelkin <pchelkin@ispras.ru>,
Oleksij Rempel <o.rempel@pengutronix.de>,
Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [PATCH 5.10 43/68] can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
Date: Mon, 12 Jun 2023 12:26:35 +0200 [thread overview]
Message-ID: <20230612101700.200822358@linuxfoundation.org> (raw)
In-Reply-To: <20230612101658.437327280@linuxfoundation.org>
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit 9f16eb106aa5fce15904625661312623ec783ed3 upstream.
Syzkaller reports the following failure:
BUG: KASAN: use-after-free in kref_put include/linux/kref.h:64 [inline]
BUG: KASAN: use-after-free in j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172
Write of size 4 at addr ffff888141c15058 by task swapper/3/0
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.10.144-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x107/0x167 lib/dump_stack.c:118
print_address_description.constprop.0+0x1c/0x220 mm/kasan/report.c:385
__kasan_report mm/kasan/report.c:545 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
check_memory_region_inline mm/kasan/generic.c:186 [inline]
check_memory_region+0x145/0x190 mm/kasan/generic.c:192
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_fetch_sub_release include/asm-generic/atomic-instrumented.h:220 [inline]
__refcount_sub_and_test include/linux/refcount.h:272 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
kref_put include/linux/kref.h:64 [inline]
j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172
j1939_sk_sock_destruct+0x44/0x90 net/can/j1939/socket.c:374
__sk_destruct+0x4e/0x820 net/core/sock.c:1784
rcu_do_batch kernel/rcu/tree.c:2485 [inline]
rcu_core+0xb35/0x1a30 kernel/rcu/tree.c:2726
__do_softirq+0x289/0x9a3 kernel/softirq.c:298
asm_call_irq_on_stack+0x12/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0xaa/0xe0 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:393 [inline]
__irq_exit_rcu kernel/softirq.c:423 [inline]
irq_exit_rcu+0x136/0x200 kernel/softirq.c:435
sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1095
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
Allocated by task 1141:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
kasan_set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc.constprop.0+0xc9/0xd0 mm/kasan/common.c:461
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
j1939_priv_create net/can/j1939/main.c:131 [inline]
j1939_netdev_start+0x111/0x860 net/can/j1939/main.c:268
j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485
__sys_bind+0x1f2/0x260 net/socket.c:1645
__do_sys_bind net/socket.c:1656 [inline]
__se_sys_bind net/socket.c:1654 [inline]
__x64_sys_bind+0x6f/0xb0 net/socket.c:1654
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Freed by task 1141:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
__kasan_slab_free+0x112/0x170 mm/kasan/common.c:422
slab_free_hook mm/slub.c:1542 [inline]
slab_free_freelist_hook+0xad/0x190 mm/slub.c:1576
slab_free mm/slub.c:3149 [inline]
kfree+0xd9/0x3b0 mm/slub.c:4125
j1939_netdev_start+0x5ee/0x860 net/can/j1939/main.c:300
j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485
__sys_bind+0x1f2/0x260 net/socket.c:1645
__do_sys_bind net/socket.c:1656 [inline]
__se_sys_bind net/socket.c:1654 [inline]
__x64_sys_bind+0x6f/0xb0 net/socket.c:1654
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
It can be caused by this scenario:
CPU0 CPU1
j1939_sk_bind(socket0, ndev0, ...)
j1939_netdev_start()
j1939_sk_bind(socket1, ndev0, ...)
j1939_netdev_start()
mutex_lock(&j1939_netdev_lock)
j1939_priv_set(ndev0, priv)
mutex_unlock(&j1939_netdev_lock)
if (priv_new)
kref_get(&priv_new->rx_kref)
return priv_new;
/* inside j1939_sk_bind() */
jsk->priv = priv
j1939_can_rx_register(priv) // fails
j1939_priv_set(ndev, NULL)
kfree(priv)
j1939_sk_sock_destruct()
j1939_priv_put() // <- uaf
To avoid this, call j1939_can_rx_register() under j1939_netdev_lock so
that a concurrent thread cannot process j1939_priv before
j1939_can_rx_register() returns.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20230526171910.227615-3-pchelkin@ispras.ru
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/j1939/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -286,16 +286,18 @@ struct j1939_priv *j1939_netdev_start(st
return priv_new;
}
j1939_priv_set(ndev, priv);
- mutex_unlock(&j1939_netdev_lock);
ret = j1939_can_rx_register(priv);
if (ret < 0)
goto out_priv_put;
+ mutex_unlock(&j1939_netdev_lock);
return priv;
out_priv_put:
j1939_priv_set(ndev, NULL);
+ mutex_unlock(&j1939_netdev_lock);
+
dev_put(ndev);
kfree(priv);
next prev parent reply other threads:[~2023-06-12 10:50 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-12 10:25 [PATCH 5.10 00/68] 5.10.184-rc1 review Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 01/68] ata: ahci: fix enum constants for gcc-13 Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 02/68] gcc-plugins: Reorganize gimple includes for GCC 13 Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 03/68] sfc (gcc13): synchronize ef100_enqueue_skb()s return type Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 04/68] remove the sx8 block driver Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 05/68] bonding (gcc13): synchronize bond_{a,t}lb_xmit() types Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 06/68] f2fs: fix iostat lock protection Greg Kroah-Hartman
2023-06-12 10:25 ` [PATCH 5.10 07/68] blk-iocost: avoid 64-bit division in ioc_timer_fn Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 08/68] block/blk-iocost (gcc13): keep large values in a new enum Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 09/68] i40iw: fix build warning in i40iw_manage_apbvt() Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 10/68] i40e: fix build warnings in i40e_alloc.h Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 11/68] i40e: fix build warning in ice_fltr_add_mac_to_list() Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 12/68] staging: vchiq_core: drop vchiq_status from vchiq_initialise Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 13/68] spi: qup: Request DMA before enabling clocks Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 14/68] afs: Fix setting of mtime when creating a file/dir/symlink Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 15/68] wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 16/68] neighbour: fix unaligned access to pneigh_entry Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 17/68] net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 18/68] net/smc: Avoid to access invalid RMBs MRs in SMCRv1 ADD LINK CONT Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 19/68] net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 20/68] Bluetooth: Fix l2cap_disconnect_req deadlock Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 21/68] Bluetooth: L2CAP: Add missing checks for invalid DCID Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 22/68] qed/qede: Fix scheduling while atomic Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 23/68] netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 24/68] netfilter: ipset: Add schedule point in call_ad() Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 25/68] ipv6: rpl: Fix Route of Death Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 26/68] rfs: annotate lockless accesses to sk->sk_rxhash Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 27/68] rfs: annotate lockless accesses to RFS sock flow table Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 28/68] net: sched: move rtm_tca_policy declaration to include file Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 29/68] net: sched: fix possible refcount leak in tc_chain_tmplt_add() Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 30/68] bpf: Add extra path pointer check to d_path helper Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 31/68] lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 32/68] bnxt_en: Dont issue AP reset during ethtools reset operation Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 33/68] bnxt_en: Query default VLAN before VNIC setup on a VF Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 34/68] bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 35/68] batman-adv: Broken sync while rescheduling delayed work Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 36/68] Input: xpad - delete a Razer DeathAdder mouse VID/PID entry Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 37/68] Input: psmouse - fix OOB access in Elantech protocol Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 38/68] ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 39/68] ALSA: hda/realtek: Add Lenovo P3 Tower platform Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 40/68] drm/amdgpu: fix xclk freq on CHIP_STONEY Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 41/68] can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 42/68] can: j1939: change j1939_netdev_lock type to mutex Greg Kroah-Hartman
2023-06-12 10:26 ` Greg Kroah-Hartman [this message]
2023-06-12 10:26 ` [PATCH 5.10 44/68] ceph: fix use-after-free bug for inodes when flushing capsnaps Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 45/68] s390/dasd: Use correct lock while counting channel queue length Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 46/68] Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 47/68] Bluetooth: hci_qca: fix debugfs registration Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 48/68] tee: amdtee: Add return_origin to struct tee_cmd_load_ta Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 49/68] rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 50/68] rbd: get snapshot context after exclusive lock is ensured to be held Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 51/68] pinctrl: meson-axg: add missing GPIOA_18 gpio group Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 52/68] usb: usbfs: Enforce page requirements for mmap Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 53/68] usb: usbfs: Use consistent mmap functions Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 54/68] staging: vc04_services: fix gcc-13 build warning Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 55/68] ASoC: codecs: wsa881x: do not set can_multi_write flag Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 56/68] i2c: sprd: Delete i2c adapter in .removes error path Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 57/68] eeprom: at24: also select REGMAP Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 58/68] riscv: fix kprobe __user string arg print fault issue Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 59/68] vhost: support PACKED when setting-getting vring_base Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 60/68] Revert "ext4: dont clear SB_RDONLY when remounting r/w until quota is re-enabled" Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 61/68] ext4: only check dquot_initialize_needed() when debugging Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 62/68] tcp: fix tcp_min_tso_segs sysctl Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 63/68] xfs: verify buffer contents when we skip log replay Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 64/68] MIPS: locking/atomic: Fix atomic{_64,}_sub_if_positive Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 65/68] drm/atomic: Dont pollute crtc_state->mode_blob with error pointers Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 66/68] btrfs: check return value of btrfs_commit_transaction in relocation Greg Kroah-Hartman
2023-06-12 10:26 ` [PATCH 5.10 67/68] btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() Greg Kroah-Hartman
2023-06-12 10:27 ` [PATCH 5.10 68/68] Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" Greg Kroah-Hartman
2023-06-12 21:52 ` [PATCH 5.10 00/68] 5.10.184-rc1 review Chris Paterson
2023-06-12 22:17 ` Shuah Khan
2023-06-13 8:38 ` Jon Hunter
2023-06-13 9:02 ` Naresh Kamboju
2023-06-13 12:13 ` Sudip Mukherjee (Codethink)
2023-06-13 16:35 ` Guenter Roeck
2023-06-13 17:36 ` Greg Kroah-Hartman
2023-06-13 18:01 ` Guenter Roeck
2023-06-13 17:45 ` Allen Pais
2023-06-13 23:09 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230612101700.200822358@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=mkl@pengutronix.de \
--cc=o.rempel@pengutronix.de \
--cc=patches@lists.linux.dev \
--cc=pchelkin@ispras.ru \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).