From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932220AbdBVJfD (ORCPT ); Wed, 22 Feb 2017 04:35:03 -0500 Received: from mail-eopbgr00117.outbound.protection.outlook.com ([40.107.0.117]:62102 "EHLO EUR02-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932138AbdBVJee (ORCPT ); Wed, 22 Feb 2017 04:34:34 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Gerrit Renker , "David S. Miller" CC: Andrey Ryabinin , Eric Dumazet , Arnaldo Carvalho de Melo , , Dmitry Vyukov , Cong Wang , Alexey Kuznetsov , Hideaki YOSHIFUJI , Patrick McHardy , syzkaller , netdev , LKML Subject: [PATCH v2] net/dccp: fix use after free in tw_timer_handler() Date: Wed, 22 Feb 2017 12:35:27 +0300 Message-ID: <20170222093527.19698-1-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20170221112740.661-1-aryabinin@virtuozzo.com> References: <20170221112740.661-1-aryabinin@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: HE1PR0401CA0068.eurprd04.prod.outlook.com (10.168.27.36) To HE1PR0801MB2057.eurprd08.prod.outlook.com (10.168.95.22) X-MS-Office365-Filtering-Correlation-Id: f07691e2-cae2-4ce8-71f4-08d45b05ffab X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:HE1PR0801MB2057; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB2057;3:psQGMyMLrBuzIDHz4voX4utw7UAom4yulCuBy/c6gluiK6qKobTQwbZAxqN8xU+VxEWlqZKtd2Xikt/HnsXhpPy0pmalL4kibSc7uRsf1IvUdCnEGT9Ol9rU2oHCBBL+zVUI2I5NXlPq01W+dmDyJ2RSJO4Q4+ForPAwOVkVDBJOzUo5VtuegQK9W1dpMjQkTvNPe2yZ/Ltdoxd+1hIpokkSR/Lks8/yPPGVTxSxvtscVAXyjMXulL7Vv54y7YliNFB0AcpE2+o4/G2eu20zoA==;25:T8dBKkGKux8L7QF9DzIRB1YkryIxCnZxR+hx7pfJA+TBtsnWR/+Mt4s8AP7NImJKvxyjg/i4UYdWpluIJ5ynaBbQhca7qklzuJfNPN+2dZO1VNsVn674XPlpU9t+qQpIsEQ9+o37j9jhLWDZyyfL1WHa++lBwo7bJCuP/qjreQHvQFqywLw33q3sBJSk108Bc6u+Js8bN5v4RWKTtrrvcGqlicG2+QMVip4khyA84U09B8JSZXi3Q8gl1iwjhmRd3EABDL0c9ZqRE1Rt9wDuud0JSDRmfwABrPJ39cZirJQlCkE47FN8xOFFUZlUh8fb0e+AJfFLcybswKyQgdKwiHLky/SXaFtCV5cYiit9YP+358bfDmHlQ+DupYcNFug544uYM/zsKRpe7usHGX1f+GlMWgZuz2ywrx5jc1cGbHFtj+sn2sbEQH3BVSt+eXIaesDbvD9Burox2tzehKEj2w== X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB2057;31:0cm5m/sOy0ItHNAni5JvHJRly4nUds78XV/tgDMy5ZDoB1ABft3fDuR6HmIJjo/pq1EOUqKkBgmjq/9uuQFXhWdIVj6gksj9KYzbT9EZRxAukkxAJ6ub9c/AOTKNX2tXaRnEsZu+hbsf/cbuCu3YIOCsV8pi1JKkQA6xci1ndCa/ZrLmldFtXpGuDQrhFQlGBVBRosbyJUapyXtBhtSbkObknS+RGM/IzCXH1aDtiYyDQUvG4gNKhxhLQbo3xp6m;20:YofC98Q/ALF72w8G61d78SOK1xicIgeS0QIo8PZwHLBsYSH/BB4KRA5Xp+MwPIpHUrlfL6BVw4Y4RCGo8bio1x59EwLK5TlWMXxoec8CRCf2Ts9UFRjSfA5z+gK4rVGjQ/z3NumlSsQYM+dlrSYfcOhCIZFizFy6hv5XD+Pq1N7BZdNbod19lXcAdexbATmw9hwWPco1e6qG6gdbnBfLZmunP6oWd9+62j6vZVzcPlH5DfElmzYNRhdjRHSXSLMrb8Cq683uZAzrdYqQEchl8rVsbljwB+6Iib+iaDRgCDdHoGUXfgrbP4PSFgQcHtMA4xsfkQLXX8RXlFzDL+4mS2uovhDxUtY+4+BHdOlR1n11HoCPcKGHo8JxDzO16IUPtTgFGmhVVcFB1skvmEtZen2l8blajJ9awaQ4K97NY/I= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(211936372134217); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123560025)(20161123558025)(20161123555025)(20161123562025)(20161123564025)(6072148);SRVR:HE1PR0801MB2057;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB2057; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB2057;4:tGmEbp8PSbdWCfBH14SVzrSGK4VDFjrHu/Yj+5c6QevY8Ckni6BC281h9PWUF9W8RdXp+dCJk36UYJbIViwNabiChSUuYTxYkh2w2IBHM9vLHHVXwtR1KvPBbMCNtF5gwQ34Dortn0SvGs7k1vyWgpGzb47ZtkWW3OKrL0QHDh9tYuY1NPtlqVF4IwgkPFLf4w0yqLy/Zg+LDPmiBkUUPAxgAe8HCQ/SANqqBfJU2Eg9iCGauBZ+2af0oOvdbAGhjJPdj/fu2CZJ6kiseUJ/Xy1fyb2rm4wEgUloPTujB9gpqalymZSN+Kg/sGxRf5vltaXxmof0k0wI3IrTRcyCnTTyTbUXVVbxQ9YN5ULur7TmEIflAB9hhYU0ZQ7gXcLedcIGCzckGMHWMwMWvXy+f1aPxSVPYRyBQpN5igDjGdvEwtLRk9y28LLtocowyvBP1cO3dO603t+YGZFgNMSdakp7zbjmSIJoLEwQvyEB/lxRIJzlHIi+0/pL2md1N0gW2I/9NOs1iinrDPm4Gxf/atPBwuFr2Z5iW454/3CzaToU0clrrwtarvWxk+h6F3/tE4WeWWqaTe8Pw8rFwAZeeFRPeX4sXL6V7b7skRPbQKLKHYXOQ8pcIch3wWoLYCswARIWuLoRexKzq9MKU71T/A== X-Forefront-PRVS: 022649CC2C X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(7916002)(39450400003)(189002)(199003)(6486002)(50466002)(53416004)(76506005)(42186005)(76176999)(5660300001)(53936002)(48376002)(189998001)(6506006)(8676002)(81166006)(6512007)(69596002)(25786008)(7416002)(54906002)(50986999)(1076002)(7736002)(33646002)(81156014)(105586002)(47776003)(305945005)(6116002)(3846002)(50226002)(36756003)(38730400002)(106356001)(68736007)(101416001)(66066001)(5003940100001)(92566002)(4326007)(97736004)(2906002)(86362001)(2950100002)(575784001);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB2057;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;HE1PR0801MB2057;23:XBQCmm2GLpNg8KIVxLdL2ADCQKr6nWeetglSA9T?= =?us-ascii?Q?X2YoOR1ndz0cievjIorZU1tQDrjTmdn1CuslEu9wUHvTm4iD7iNB0xHfloLq?= =?us-ascii?Q?44J5kPMM7N8MFYGB1/DYxGSPJA6+cO5vUhIPLrt50MLTTi6n1+uv3bY62wc/?= =?us-ascii?Q?vHIufYVurBrJNxV5RSsnilX9sei+GIbn7rY5Yag7GToh77daBuxrZtc5glW5?= =?us-ascii?Q?xk0GWx2Eh3gI67VAtlapGsrh1ka8QleiHWkIuPcISALOujy3yqHWQZupIIpG?= =?us-ascii?Q?6XBF/qYYI/Oghz+OSIOO2ksYa+XQ5MNh6sfu77rn5tU4EZBUpMeN6c2lLaul?= =?us-ascii?Q?1elpR7oNO9rF0vVPY8aw1VzUd8U6YNTcG1WwA6jYz28sKR1WkIZiQzI+DXxf?= =?us-ascii?Q?UhJkdTRFgys6Ve9VYWqd1wecdeFnNEBMejbiL/spwvAcyHtsEUwghJ3Vt1Zb?= =?us-ascii?Q?+7+D6p84dQeRa2XOQm43H8WTuXZYLqIy3lgVsuF14PNWX/T6RLDia3zx/3OX?= =?us-ascii?Q?xh28otJJqsmEhnfazOydYNuGLy9t3U+pysK+xL8nAAbbDm8Dklz+avAX+J1H?= =?us-ascii?Q?ZINXfrszToT57yB8dpQsbowkJMykSTRoMyEbyg0dstlimuKExduEAzQBQwgM?= =?us-ascii?Q?L8m2bzpThlPlCwx3PC1j8ViKAm/W8xCSenaG2jd33SB8RvAPUd01Z9UOOwXP?= =?us-ascii?Q?M7w7Vuep0ZBx7bEF0t0NrUw/d2Q9WHcRVIdWqZdVCUsjLjK25WigbL/DMm92?= =?us-ascii?Q?ct0ZDdtKTD1Z4zYuVgqHMwwSsmh34l/QHtOGLK1Ci+U5SIS4qLyMYAeJhoR0?= =?us-ascii?Q?5MJzkkIohBbNqTmjHctBYaO6zSdwr7QrtW3ifR18xMxdFKn6yCbrj2Sc2V+E?= =?us-ascii?Q?ZNw7CMSbaPtzp+Pm13mK1o0P0weio84wA4kfTTZZWnEZnCQZA9Zca583vbvk?= =?us-ascii?Q?w2RV/U+HbOLCvdUP963ku9Uwyz+54qZ6aHAvXOkxzaU0Nkx/B0HrqvfSPgHw?= =?us-ascii?Q?ZhTRofkdVhw1ZttN3Oh0xrTVwmCM5NSX4jHIryNtyRyKyejbW4wm8nkjSTfd?= =?us-ascii?Q?zmB5fXq3jWuoUv1bodlktiixtVBL2pjM8InmeizHduzd+cWlLCtH3+2tzwsL?= =?us-ascii?Q?eNkTy1IKwS1zZ+CcMtPN1qiUoKMdcj7h7B2k8MNT2005ncGZ6lEmbOr9FNXZ?= =?us-ascii?Q?rLvvIGQs0QxoVEcQNCkSb/6JzBezoHz91gbvU?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB2057;6:ojgHwzRzPEZINdCkMX+W1c5YkQsd9Wt1P53cgQlwnEgVt3CpBGxvsSiM4Czte3scT8gXLd5cht/sdBG/GZ96Ha9r4kfRVVLsjXrxsD2CuPJPb4FkAKArNJLIB8a7FwYOYR3jBsoa8zHZQY9ppwXe/iVE9+l4croAxKpfH/qcksBmT4XtvVYAZ/LkBIG71txRvjX5jJh85PzeKd1NeCMbj2porq153MHMsdnEEtsG3FhAIOAz88lpTSN993DvZqIu2joLETgBT+aZ3CbP1DLjSbyG8/UYl8mJiRu0Zihg51ew9J8NEHFJy6M5M4kSCNTFhmixHLBs29jtFQPHcnUexRVhDx+clV0wulqjQKdNnhhgMxEE0Adm2Sae8DczTmeQ3FUkA0kDCsVi6bAHdH2lXA==;5:Ydq2plGuE7noC8DfyLWwlDq/QvSx34gPfcjWqVf9f20hoTLxMz1iJmiNymx/oYjrJuDrmyG6FMkgeXTJCOtd02HTXXTKM4J06IldfnxMWNphDsbcxecO70hfdI08WQDJiwuLYf9igwxOs0+3CBi1lw==;24:YUOoYPD84JBjwYuYmgG9ogyRGX1sLMH+RSlaGcYsQmaDNfUZOqtrtlbaAfdCWhRdxd9QJBFSeSKfYIDIfGwhK2zkBFyZyiVF+cUv1GvIrHQ= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB2057;7:hvCRGKI2dzRDoAJEYeRuAJlQF7/SxdgVdtb6EBgrH1fevnp92oVixyOfIscevF1n+gstFHgZPEXfVeTO/DEFH0SwvjE2FTuXACFKLOcGpw/zP8ZQEVVdxITQiW/7K3qJHqFzHOJ4dO3IcjfJipXPi8EzPBoKxeH3vJmf1P7VX6UkfGPJtfouZYRpsYANsQBTI3KB4pHMujyZ9caOYd1XeMc0ozrqsOwSERj0lU+m9epHZ+Xq8YvR1N9bARAaZrOvGkP5k56hw9gP/0+P69SZEmqMVi930Bsc/ixx6CkzMuz9eRNTLvvY9C9fc14yVseO3tvijhy2XPghFtAvbvapfw==;20:WCKW3WpttpYUU3V1Vx2MmzvORN+n0rw/ftg4XXMsYv2W8iPhDObVIAy+D9kGxfPW6A2cF13Trthqf6JX0476ftT1CWf+VnO89Wf3ctmSTslROKAhEyDuO00BJFZPhofTWUG3qBkntBeiEYd6ZVsoPcRIZGBzhfuNxft/Hvy3ApI= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2017 09:34:28.3978 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB2057 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org DCCP doesn't purge timewait sockets on network namespace shutdown. So, after net namespace destroyed we could still have an active timer which will trigger use after free in tw_timer_handler(): BUG: KASAN: use-after-free in tw_timer_handler+0x4a/0xa0 at addr ffff88010e0d1e10 Read of size 8 by task swapper/1/0 Call Trace: __asan_load8+0x54/0x90 tw_timer_handler+0x4a/0xa0 call_timer_fn+0x127/0x480 expire_timers+0x1db/0x2e0 run_timer_softirq+0x12f/0x2a0 __do_softirq+0x105/0x5b4 irq_exit+0xdd/0xf0 smp_apic_timer_interrupt+0x57/0x70 apic_timer_interrupt+0x90/0xa0 Object at ffff88010e0d1bc0, in cache net_namespace size: 6848 Allocated: save_stack_trace+0x1b/0x20 kasan_kmalloc+0xee/0x180 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x134/0x310 copy_net_ns+0x8d/0x280 create_new_namespaces+0x23f/0x340 unshare_nsproxy_namespaces+0x75/0xf0 SyS_unshare+0x299/0x4f0 entry_SYSCALL_64_fastpath+0x18/0xad Freed: save_stack_trace+0x1b/0x20 kasan_slab_free+0xae/0x180 kmem_cache_free+0xb4/0x350 net_drop_ns+0x3f/0x50 cleanup_net+0x3df/0x450 process_one_work+0x419/0xbb0 worker_thread+0x92/0x850 kthread+0x192/0x1e0 ret_from_fork+0x2e/0x40 Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge timewait sockets on net namespace destruction and prevent above issue. Fixes: f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") Reported-by: Dmitry Vyukov Signed-off-by: Andrey Ryabinin Acked-by: Arnaldo Carvalho de Melo --- Changes since v1: - Rebased on top the -next - Added Fixes/Acked tags. net/dccp/ipv4.c | 6 ++++++ net/dccp/ipv6.c | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c index b043ec8..409d0cf 100644 --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -1017,9 +1017,15 @@ static void __net_exit dccp_v4_exit_net(struct net *net) inet_ctl_sock_destroy(net->dccp.v4_ctl_sk); } +static void __net_exit dccp_v4_exit_batch(struct list_head *net_exit_list) +{ + inet_twsk_purge(&dccp_hashinfo, AF_INET); +} + static struct pernet_operations dccp_v4_ops = { .init = dccp_v4_init_net, .exit = dccp_v4_exit_net, + .exit_batch = dccp_v4_exit_batch, }; static int __init dccp_v4_init(void) diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index cef60a4..233b573 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -1075,9 +1075,15 @@ static void __net_exit dccp_v6_exit_net(struct net *net) inet_ctl_sock_destroy(net->dccp.v6_ctl_sk); } +static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list) +{ + inet_twsk_purge(&dccp_hashinfo, AF_INET6); +} + static struct pernet_operations dccp_v6_ops = { .init = dccp_v6_init_net, .exit = dccp_v6_exit_net, + .exit_batch = dccp_v6_exit_batch, }; static int __init dccp_v6_init(void) -- 2.10.2