Dongseok Yi 24cd331741 net: fix use-after-free when UDP GRO with shared fraglist ... [ Upstream commit 53475c5dd856212e91538a9501162e821cc1f791 ] skbs in fraglist could be shared by a BPF filter loaded at TC. If TC writes, it will call skb_ensure_writable -> pskb_expand_head to create a private linear section for the head_skb. And then call skb_clone_fraglist -> skb_get on each skb in the fraglist. skb_segment_list overwrites part of the skb linear section of each fragment itself. Even after skb_clone, the frag_skbs share their linear section with their clone in PF_PACKET. Both sk_receive_queue of PF_PACKET and PF_INET (or PF_INET6) can have a link for the same frag_skbs chain. If a new skb (not frags) is queued to one of the sk_receive_queue, multiple ptypes can see and release this. It causes use-after-free. [ 4443.426215] ------------[ cut here ]------------ [ 4443.426222] refcount_t: underflow; use-after-free. [ 4443.426291] WARNING: CPU: 7 PID: 28161 at lib/refcount.c:190 refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426726] pstate: 60400005 (nZCv daif +PAN -UAO) [ 4443.426732] pc : refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426737] lr : refcount_dec_and_test_checked+0xa0/0xc8 [ 4443.426808] Call trace: [ 4443.426813] refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426823] skb_release_data+0x144/0x264 [ 4443.426828] kfree_skb+0x58/0xc4 [ 4443.426832] skb_queue_purge+0x64/0x9c [ 4443.426844] packet_set_ring+0x5f0/0x820 [ 4443.426849] packet_setsockopt+0x5a4/0xcd0 [ 4443.426853] __sys_setsockopt+0x188/0x278 [ 4443.426858] __arm64_sys_setsockopt+0x28/0x38 [ 4443.426869] el0_svc_common+0xf0/0x1d0 [ 4443.426873] el0_svc_handler+0x74/0x98 [ 4443.426880] el0_svc+0x8/0xc Fixes: 3a1296a38d (net: Support GRO/GSO fraglist chaining.) Signed-off-by: Dongseok Yi <dseok.yi@samsung.com> Acked-by: Willem de Bruijn <willemb@google.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/1610072918-174177-1-git-send-email-dseok.yi@samsung.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-23 16:03:59 +01:00
..
bpf_sk_storage.c	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
datagram.c	net: zerocopy: combine pages in zerocopy_sg_from_iter()	2020-08-20 16:12:50 -07:00
datagram.h
dev_addr_lists.c	net: core: add nested_level variable in net_device	2020-09-28 15:00:15 -07:00
dev_ioctl.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dev.c	xdp: Remove the xdp_attachment_flags_ok() callback	2020-12-09 16:27:42 +01:00
devlink.c	devlink: Make sure devlink instance and port are in same net namespace	2020-11-25 17:26:34 -08:00
drop_monitor.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
dst_cache.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
dst.c	net: Correct the comment of dst_dev_put()	2020-09-10 13:28:57 -07:00
failover.c
fib_notifier.c
fib_rules.c	fib: fix fib_rule_ops indirect call wrappers when CONFIG_IPV6=m	2020-09-08 20:09:08 -07:00
filter.c	net: Properly typecast int values to set sk_max_pacing_rate	2020-10-22 12:18:25 -07:00
flow_dissector.c	net: flow_dissector: avoid indirect call to DSA .flow_dissect for generic case	2020-09-26 14:17:59 -07:00
flow_offload.c	net: flow_offload: Fix memory leak for indirect flow block	2020-12-09 16:08:33 -08:00
gen_estimator.c
gen_stats.c	docs: networking: convert gen_stats.txt to ReST	2020-04-28 14:39:46 -07:00
gro_cells.c	gro_cells: reduce number of synchronize_net() calls	2020-11-25 11:28:12 -08:00
hwbm.c
link_watch.c
lwt_bpf.c	lwt_bpf: Replace preempt_disable() with migrate_disable()	2020-12-07 11:53:40 -08:00
lwtunnel.c
Makefile
neighbour.c	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
net_namespace.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
net-procfs.c	net-sysfs: add backlog len and CPU id to softnet data	2020-09-21 13:56:37 -07:00
net-sysfs.c	net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc	2021-01-12 20:18:11 +01:00
net-sysfs.h
net-traces.c
netclassid_cgroup.c
netevent.c
netpoll.c	net: Have netpoll bring-up DSA management interface	2020-11-18 11:04:11 -08:00
netprio_cgroup.c
page_pool.c
pktgen.c	pktgen: Fix inconsistent of format with argument type in pktgen.c	2020-10-01 18:45:23 -07:00
ptp_classifier.c	ptp: Add generic ptp v2 header parsing function	2020-08-19 16:07:49 -07:00
request_sock.c	tcp: add rcu protection around tp->fastopen_rsk	2019-10-13 10:13:08 -07:00
rtnetlink.c	rtnetlink: fix data overflow in rtnl_calcit()	2020-10-21 18:24:08 -07:00
scm.c
secure_seq.c
skbuff.c	net: fix use-after-free when UDP GRO with shared fraglist	2021-01-23 16:03:59 +01:00
skmsg.c	bpf, sockmap: Avoid failures from skb_to_sgvec when skb has frag_list	2020-11-18 00:14:04 +01:00
sock_diag.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
sock_map.c	net, sockmap: Don't call bpf_prog_put() on NULL pointer	2020-10-15 21:05:23 +02:00
sock_reuseport.c
sock.c	net: Properly typecast int values to set sk_max_pacing_rate	2020-10-22 12:18:25 -07:00
stream.c
sysctl_net_core.c	net: add option to not create fall-back tunnels in root-ns as well	2020-08-28 06:52:44 -07:00
timestamping.c
tso.c
utils.c
xdp.c	xdp: Remove the xdp_attachment_flags_ok() callback	2020-12-09 16:27:42 +01:00