Skip to content

Commit 6c4a92d

Browse files
veritas501kuba-moo
authored andcommitted
net: appletalk: Fix use-after-free in AARP proxy probe
The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same entry, leading to a use-after-free. race condition: cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !! ================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278 CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc1/0x630 mm/kasan/report.c:521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated: aarp_alloc net/appletalk/aarp.c:382 [inline] aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarp_expire_timer net/appletalk/aarp.c:261 [inline] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Kito Xu (veritas501) <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent 18ff09c commit 6c4a92d

File tree

1 file changed

+21
-3
lines changed

1 file changed

+21
-3
lines changed

net/appletalk/aarp.c

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include <linux/seq_file.h>
3636
#include <linux/export.h>
3737
#include <linux/etherdevice.h>
38+
#include <linux/refcount.h>
3839

3940
int sysctl_aarp_expiry_time = AARP_EXPIRY_TIME;
4041
int sysctl_aarp_tick_time = AARP_TICK_TIME;
@@ -44,6 +45,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME;
4445
/* Lists of aarp entries */
4546
/**
4647
* struct aarp_entry - AARP entry
48+
* @refcnt: Reference count
4749
* @last_sent: Last time we xmitted the aarp request
4850
* @packet_queue: Queue of frames wait for resolution
4951
* @status: Used for proxy AARP
@@ -55,6 +57,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME;
5557
* @next: Next entry in chain
5658
*/
5759
struct aarp_entry {
60+
refcount_t refcnt;
5861
/* These first two are only used for unresolved entries */
5962
unsigned long last_sent;
6063
struct sk_buff_head packet_queue;
@@ -79,6 +82,17 @@ static DEFINE_RWLOCK(aarp_lock);
7982
/* Used to walk the list and purge/kick entries. */
8083
static struct timer_list aarp_timer;
8184

85+
static inline void aarp_entry_get(struct aarp_entry *a)
86+
{
87+
refcount_inc(&a->refcnt);
88+
}
89+
90+
static inline void aarp_entry_put(struct aarp_entry *a)
91+
{
92+
if (refcount_dec_and_test(&a->refcnt))
93+
kfree(a);
94+
}
95+
8296
/*
8397
* Delete an aarp queue
8498
*
@@ -87,7 +101,7 @@ static struct timer_list aarp_timer;
87101
static void __aarp_expire(struct aarp_entry *a)
88102
{
89103
skb_queue_purge(&a->packet_queue);
90-
kfree(a);
104+
aarp_entry_put(a);
91105
}
92106

93107
/*
@@ -380,9 +394,11 @@ static void aarp_purge(void)
380394
static struct aarp_entry *aarp_alloc(void)
381395
{
382396
struct aarp_entry *a = kmalloc(sizeof(*a), GFP_ATOMIC);
397+
if (!a)
398+
return NULL;
383399

384-
if (a)
385-
skb_queue_head_init(&a->packet_queue);
400+
refcount_set(&a->refcnt, 1);
401+
skb_queue_head_init(&a->packet_queue);
386402
return a;
387403
}
388404

@@ -477,6 +493,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa)
477493
entry->dev = atif->dev;
478494

479495
write_lock_bh(&aarp_lock);
496+
aarp_entry_get(entry);
480497

481498
hash = sa->s_node % (AARP_HASH_SIZE - 1);
482499
entry->next = proxies[hash];
@@ -502,6 +519,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa)
502519
retval = 1;
503520
}
504521

522+
aarp_entry_put(entry);
505523
write_unlock_bh(&aarp_lock);
506524
out:
507525
return retval;

0 commit comments

Comments
 (0)