From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752097AbdBUL1D (ORCPT ); Tue, 21 Feb 2017 06:27:03 -0500 Received: from mail-db5eur01on0111.outbound.protection.outlook.com ([104.47.2.111]:46976 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751325AbdBUL04 (ORCPT ); Tue, 21 Feb 2017 06:26:56 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Gerrit Renker , "David S. Miller" , CC: Dmitry Vyukov , Eric Dumazet , Cong Wang , Alexey Kuznetsov , Hideaki YOSHIFUJI , Patrick McHardy , , , , Andrey Ryabinin Subject: [PATCH] net/dccp: fix use after free in tw_timer_handler() Date: Tue, 21 Feb 2017 14:27:40 +0300 Message-ID: <20170221112740.661-1-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.10.2 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: HE1PR03CA0004.eurprd03.prod.outlook.com (10.163.170.142) To DB6PR0801MB2054.eurprd08.prod.outlook.com (10.168.86.135) X-MS-Office365-Filtering-Correlation-Id: e98f6401-8f88-477f-a50e-08d45a4c88bb X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB6PR0801MB2054; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;3:WxE3etknGiIHJ7y+W4Kmqbe1o0nw80IHg1QUleAU/Y4xG1Qz7x2oKKNb1tNUf+nKUjfDj+GnzdxJgy5189GDHR+UFxgiaxLdxrY7e0rgZIvMKSXxIyyxJMZdWZRan4z9HaCv6j5OKy3ZDYXcAYE5QW651rrp3dq+/mQ0OfcBTxOytezJnsG++pNsw8Z844B3nu+QL7sn55e1io8HhefX8usotR/rSTDZWKlzE9fAVOKqdCa6Hjm0oYtRvRSZpCdagLrmdeg3KTvwNz11aF6Xug==;25:kTppMpQY68r04L2hMMGsaFR7x/CmfpQLlzLISvfsu2hX8Kdpu6n7MYSgwVpj9AERUW9FQ8YyMy6S7xg7LeZTMfiPCoyDQcDhrjteY/xK9e0J3q8UydPLHqWknJEHLiX5NCUUDJkdCL7gK5wgXwZVXD8tWY/pySmO78laBcWngkfF8HZxb4PDSvgWGB4oB74hX7itCcy+5cAVLxlnKIxsrxB17IJCLnZgCr/3FhfZ5T5Q4RvkAXukuwhdhPzG00ElVk7D6yIYquLOzA6HFTLqjhfuFsCVs93bGwIRWQ4+dXRTV/KbH4hqNXd5quFxZpd3dx7/HwQQcWE+oyi/K5CXNLG91nt1RmDSXf7f4rk+1sMF4oROiSHRJncsEw3Bg6i617bdhVH9ZQZTaqJSVhetnmsUTsZxDFM2NflHQnz47DeueIhJIGtbq/x8xUUmvdUZQHMG0NGiZNDi22EG7Rtseg== X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;31:gYwaf7hLMBi+6ONovweUPAbb0HBHyWtWJDuWukj79/hHmoczs7gSzE4H0zrG3yL4ZFId21n4ddsmYH08WHcvwhvNEffBifzJQSK2oNIJIhSnbCNtue72Vrf+RePSE/Hvn2ZAFeXu97iQVgD+Oev69YvhCikUIEAScwuhPMrkXvAeDFzTtnZ03/AVEhBuUGprhOE4tbW/IiwNbAYjd+BmaFGISHvYQJMlGlLVF3oXWKkSz9g9uQo4vtZNch6Qq7FS;20:2TO3S0s33jfmBAMQAA+S8FqME9jA0RU2Yo+XNigIYaaIqhVFrp6IKr/IKIbCA+Xg8CbmSSIiOQADD2dWpMZwX3/NcWtMsZHgEXCX/UifzrOWmG8uE7GVsyBCWbTEyO5yvWgTUNoTWur3rvNYj6RYbqxxaJd5fXIaAH8k6OVcnkWIcTF8bxXjO4Fau25oHeV2/5SFZYpglhBqTUYwCOh0zksWd1z7H5g9L8ujpkTyeox/MbIYpjRC6zaJBOjWjuaYbiRXTZxqe2F1K8DDXI3Cme5y2RlSxbqEbEYG6KjsQpxg+VOjArRVHbHlsRKDkxaWrVP2aK0jmZTvZX79W4lprmA8m9IZB0mJq3RMSPx5yt4VjV4QmnZGBmkgPXADa8NgrPwxG7eWgOP2hr/IhO2Xre15hIPa6zRwcy7UaowmQpA= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(211936372134217); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(20161123558025)(6072148);SRVR:DB6PR0801MB2054;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB2054; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;4:plDaOTynmsBnfeFv52x53MRhQmL4XTpG8xeCf94vy2YLAa4RqpjX5Odgw+C0ykwrYv99lC4ISafJFhbR2yCVIhVQSDTQf++bueXnqne/0QJ16zFnarIiK0KRX2TbUCetlbiefe2hu9b0xojbYrmLuqirlCwoV71ExGCxgAIaoQIJAG9rgL+tsTroVwvK4Y4zFou6V+EFaQbk1f9JnByM/VUWKYaFmuqKzqWYVXO3+CI6QhJs7harv6mRDg6ZkjtqmPTKy4Jk789lOLwzx4OKbscbEyA10/H6Myf3Fy4zWI04KqTSQbLuPj9AhM7KtkUxVZ5JmYrjPdC4M6oeGWPv2wo+Bt5uKdyU4wf2HZC4MycZwLzhXWKdvM8P7ltJnzAfeE5J4Z9e+PHM47saW+qYthAwmduwpIxQ3LZV1x8Bl/y2ueZZwGgAMnUWe/s66cZbUGEQT7oo9eIHCwHSenUYHOtPtLFv1OuSNx/s5EiWTRjcZu25f2KRKhjoZxQMNqJIZj8mVomUn2WK6ojBNjCB2aqL2qOUG1FAqAgjl52MBtJe5k3ETcd+TldGgA+q/uAW0xM4ZVqyk7uvvSh0FoCIw6VxQhSsC3Ffn5MQq9siIwICofSFnr4yoEqPp6OpXr5+BM6m8ep9TbLvdgIDYiWpnw== X-Forefront-PRVS: 0225B0D5BC X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(7916002)(39830400002)(39450400003)(39410400002)(189002)(199003)(5660300001)(69596002)(36756003)(48376002)(86362001)(305945005)(4326007)(6666003)(1076002)(105586002)(3846002)(106356001)(575784001)(6116002)(7736002)(107886003)(66066001)(92566002)(47776003)(6506006)(50986999)(81166006)(68736007)(2906002)(81156014)(54906002)(101416001)(6486002)(189998001)(5003940100001)(25786008)(76506005)(53936002)(38730400002)(76176999)(50466002)(8676002)(7416002)(2950100002)(53416004)(42186005)(33646002)(50226002)(6512007)(97736004)(2101003);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB2054;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DB6PR0801MB2054;23:K4dbkNarT+eF/6w0q4MUWZ4kt4yaG3MTuHL9LtF?= =?us-ascii?Q?8WSt4GCZNJuIZt+y87gz3Ef4k2wgAklQhwS5E6MlJzGz3Desy3wTlgDRRbVf?= =?us-ascii?Q?YGnBE44hbIoqlKHBcVOysIRlbTgoN/OG/s6GiQrKcyqoOQ7lpn+s437FA2AF?= =?us-ascii?Q?WN2jCEIJWsDm83nyzRY0cF5O9wuKm7GP63nVekmT5MwAVcIg7kWO2Am274bL?= =?us-ascii?Q?eDXU+CmyooyB2DNEO2sSYWVbsmsLO1rKaySWVNT3hNr6QxCo1BN+8ayEuLd5?= =?us-ascii?Q?tilBGb4gE7HD3ndosDvwb0JtX5VHFUzXdk4tepmMtEkIFB+gEGlsE5NxgDHZ?= =?us-ascii?Q?1XrHviVoy6C210BjSq01gbu+GdiCNYeSL0LOAACeRkaJJdj+E1QitrT5ZcYV?= =?us-ascii?Q?++pIrbvc3sOc/QbrNXMq52t1bnvNdMocTRM3gfm4VyJ8dY2EgZPv/2YNpPYG?= =?us-ascii?Q?qM5M2F2p7TkrJFrsLTY8/H1T+EEX8i2DN4HPFT0uUP+GljVu2VIy4zr4aHOV?= =?us-ascii?Q?MnfDb+w6eVWOQi8SNo4FG2oPjt4PKKGWvxu9fW1j7CDo4y0YyXBCwRgo4yju?= =?us-ascii?Q?pJBzszI+en0gWMn4YNy8dobQXe6UGKqj9Qsss1Zv2B1YjoyvEeMk4NBOsqsO?= =?us-ascii?Q?kcdl24wBk0Y58C4nLAMq5KbVnsWs79j8Cpry8jl/RCp0kILo68AR8EC/Qh41?= =?us-ascii?Q?E+MOLkynGKU8Sqihd2BGAzOCD06xfX+DVeM6mGoRHGqEEVoRFb10MiCBPSXz?= =?us-ascii?Q?A+eqr88lKcpVIQmMYSgj2wHqOvuLbTiKGyRZHsPvHjWOFYLZbscRRNeuChTS?= =?us-ascii?Q?jBz2s8sapug6yuds0N/ZE9zkxL1CiIdS0Lv2o0CJxku5pSnevzpfnzxpbAvR?= =?us-ascii?Q?LKjQcSs2XIOut4zih38i3U6JDYYvmTK2fh//3XlPPBsu4Uu6SFym/QaoKhA8?= =?us-ascii?Q?2+TO6Rne7UBW+xsEv6ZmYFOVXB9Tz1CS2ajhfmmAZBJwNhShnMSx7C7uAjC4?= =?us-ascii?Q?Q/UkXbb9wM8mXipUvhAS/6DwMfFwMVA8yXgcgIqNp0zjD9o/AYhetyBVPwkr?= =?us-ascii?Q?Fyyspjjt95eaJmiSk8KsOM9Xv//ljopnYqss+XZVCeyqmjj1TZYntZa63OjC?= =?us-ascii?Q?dHQuryjAi969tx18o5gsEcm5YlUZwiYY2ac/2GySeSu409DvN2KIp/JQ0gb3?= =?us-ascii?Q?J5iJvIc0tqOY+gyzen8ZJJzZevG0ssakeGiWzkd/OQMoPGbfaxmSRQ1WEeqJ?= =?us-ascii?Q?3jWq9RR6E2iEZNlIzX6KgnK3cmIw4lCpeUkqcSJeu6PwcwBxWMdq+ep4vOmq?= =?us-ascii?Q?T/7ajUqzYpLrrLFH7lDFhp6E=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;6:K6OENOhJWb+t9nJ0DHQ4y9iZYg3dcY/s20uAuKPTxvJFVMsjj78M5kwF3VQiM2mU2a7mnG5792IhysN9T5MPTzIj0TN+qPiWo/lTFSMac0Ncdo/8C2aaizESHHm7XrYA+3IL40Oxx+4XK8VLjI3vkZT5ngWc+tnIbFtXKdhNCKebmiXsNgNjtx3XeKGhfdUIfsBt+xH1gBirXbHgDZzXYnzyu6wUU+BzISvIGz8IOD2UFKeUy6xx++bxJO7yBlPaV9CMXoLBVgMbTofbHTY6nh6Bdn63kAw/1y3J+YvDSggy13blAvZQdnEFDcCSkUdl7Y4Nhf4ym/hEhPhLeouC/kAYxB1CU919ORhmhN044ZfszunY5RiV/pUo+ZFhW9j48CjfiC3YN4Q4btuLY2xZ2g==;5:UvYwrvkJc+jlG25QMbBfSJO5Vvxz2RQQsTfj/MFFgOVS48IJnpLCQgioB1Tuy5qeqCD4EjFvxwABqgzarFSXgMg6fC5zKPeWyPU4Dg7t85gQR2Sq8gpj159vLiua7ZJSshNu/zCo4WblYxDFt0z2RQ==;24:ApsvkIMbq+V9LOlyaDFXGdQ0ZT78vRiTYvtijeGbyL48YhH2ZaN9YE8el+JZOwUfHjt03mhPJOr1a06nO91cEpZHF6PYTAFpKCAukTWaJEs= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;7:KJtqWnQPTCfOmB+XeiYsOpHoQeid0CgS/pb7sLE+O2h1o79DvQabIUDYnnc7Yh0rJVGw//BF5e8G+BeYO9eVh2kRiQFjmJZSc/ns/YBUHiYZfRem1VIg3tvrRXRXmMXZt6xIaoC+pmLEBlcLMnMWbqqxvJBFesZJ5xmBrcGRJ4N0r1ejAsC9Xrm5R79jnyDOt3pYDHeasx00YxAQ15GvS8ZxVddoVY9TKSxnjMI3bi8xVqKCzX1k6LFL8YYLfSQ5kYvv50pVGHUVjDCKesEs4h2LMnxPMO6dOyjOlVKMoDU1aVboi8IPVm65LH/COgQrOQqdhxh53WzBpTgIQBBBkw==;20:0l0G+A/mUcdZvxj34qVRtBg+G8ONyFXFm2ARozhREYe1AXwPUy4BKsD+ZY2MOvw7JGCSuIP8ZtnxSrS2W2QYcr2vH1XvpEQk4fmNIrx/xn1OhN21/vphIguOjyKVxOTnaXhRgEiffGi6F2upzB5pLOhKagkYwavCBPqC5LbZjVw= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Feb 2017 11:26:51.0804 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB2054 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org DCCP doesn't purge timewait sockets on network namespace shutdown. So, after net namespace destroyed we could still have an active timer which will trigger use after free in tw_timer_handler(): BUG: KASAN: use-after-free in tw_timer_handler+0x4a/0xa0 at addr ffff88010e0d1e10 Read of size 8 by task swapper/1/0 Call Trace: __asan_load8+0x54/0x90 tw_timer_handler+0x4a/0xa0 call_timer_fn+0x127/0x480 expire_timers+0x1db/0x2e0 run_timer_softirq+0x12f/0x2a0 __do_softirq+0x105/0x5b4 irq_exit+0xdd/0xf0 smp_apic_timer_interrupt+0x57/0x70 apic_timer_interrupt+0x90/0xa0 Object at ffff88010e0d1bc0, in cache net_namespace size: 6848 Allocated: save_stack_trace+0x1b/0x20 kasan_kmalloc+0xee/0x180 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x134/0x310 copy_net_ns+0x8d/0x280 create_new_namespaces+0x23f/0x340 unshare_nsproxy_namespaces+0x75/0xf0 SyS_unshare+0x299/0x4f0 entry_SYSCALL_64_fastpath+0x18/0xad Freed: save_stack_trace+0x1b/0x20 kasan_slab_free+0xae/0x180 kmem_cache_free+0xb4/0x350 net_drop_ns+0x3f/0x50 cleanup_net+0x3df/0x450 process_one_work+0x419/0xbb0 worker_thread+0x92/0x850 kthread+0x192/0x1e0 ret_from_fork+0x2e/0x40 Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge timewait sockets on net namespace destruction and prevent above issue. Reported-by: Dmitry Vyukov Signed-off-by: Andrey Ryabinin --- net/dccp/ipv4.c | 6 ++++++ net/dccp/ipv6.c | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c index d859a5c..da7cb16 100644 --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -1018,9 +1018,15 @@ static void __net_exit dccp_v4_exit_net(struct net *net) inet_ctl_sock_destroy(net->dccp.v4_ctl_sk); } +static void __net_exit dccp_v4_exit_batch(struct list_head *net_exit_list) +{ + inet_twsk_purge(&dccp_hashinfo, &dccp_death_row, AF_INET); +} + static struct pernet_operations dccp_v4_ops = { .init = dccp_v4_init_net, .exit = dccp_v4_exit_net, + .exit_batch = dccp_v4_exit_batch, }; static int __init dccp_v4_init(void) diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index c4e879c..f3d8f92 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -1077,9 +1077,15 @@ static void __net_exit dccp_v6_exit_net(struct net *net) inet_ctl_sock_destroy(net->dccp.v6_ctl_sk); } +static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list) +{ + inet_twsk_purge(&dccp_hashinfo, &dccp_death_row, AF_INET6); +} + static struct pernet_operations dccp_v6_ops = { .init = dccp_v6_init_net, .exit = dccp_v6_exit_net, + .exit_batch = dccp_v6_exit_batch, }; static int __init dccp_v6_init(void) -- 2.10.2