net: rtnetlink: rtnl_link_unregister() vs in-flight RTM_GETLINK dump readers -- v7.3 lacks the synchronize_rcu() fix (Fixes: 6b57ff21a310 family); A/B reproduction on stock 7.3

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 4303 bytes --]

On v7.3, rtnl_link_unregister() removes the rtnl_link_ops from the
global list and immediately destroys the embedded srcu_struct and
frees the ops memory -- a concurrent RTM_GETLINK dump that already
found the ops (rtnl_link_ops_get(), rtnetlink.c:599 hand-off inside
an RCU read critical section at :595) but has not yet taken
ops->srcu will, after the free, execute __srcu_read_lock() /
__srcu_read_unlock() on freed memory: two reads of the destroyed
object (ssp->srcu_ctrp, ssp->sda) whose subsequent percpu counter
writes land wherever the freed percpu pointers point -- for a module
rtnl_link_ops, the ops (and its srcu) live in module memory, so
module_memfree() is the freeing side.  Upstream already fixed this
with a synchronize_rcu() in rtnl_link_unregister() (the patch with
Fixes: 6b57ff21a310; its own comment: "Wait for rtnl_link_ops_get()
readers that found ops but have not yet taken ops->srcu").  v7.3
does not contain it.  I verified both sides on a stock 7.3 KASAN
kernel: parking a real dump reader (driven by an ordinary
RTM_GETLINK + IFLA_LINKINFO dump request) exactly at the :599
hand-off and unregistering+freeing underneath produces three KASAN
slab-use-after-free reports (__srcu_read_lock+0xe, +0x25,
__srcu_read_unlock+0x1a; bad address = ops+0x10 = ops->srcu); and
rebuilding the SAME kernel with ONLY the upstream one-line fix
flips the outcome to zero reports, with the kfree demonstrably
delayed until the parked reader left its RCU section.  Natural
hammering did not hit (the hand-off window is ~100 ns against a
~4 ms unregister -- it needs a preempted/preemptible-RCU reader),
which matches the fix's own reasoning; the controlled run models
exactly that preemption.  The purpose of this mail is to support
the fix's propagation: trees still carrying the unfixed
rtnl_link_unregister() keep a cross-CPU UAF (write) plus potential
freed-module execution reachable by unprivileged netlink dumps
racing a module unload.


The detailed description:

* The gap (v7.3, net/core/rtnetlink.c)
  rtnl_dump_ifinfo() runs lockless for dumps
  (RTNL_FLAG_DUMP_UNLOCKED), takes rcu_read_lock() at :595, calls
  linkinfo_to_kind_ops() -> rtnl_link_ops_get() which returns the
  ops pointer at :599, and only then takes ops->srcu
  (srcu_read_lock) to call ops->dumpit.  rtnl_link_unregister()
  holds rtnl_mutex, removes the ops from the list, calls
  cleanup_srcu_struct(&ops->srcu) and returns to the module, whose
  exit then frees the module memory.  Nothing between the :599
  hand-off and the srcu_read_lock is waited for on the unregister
  side in 7.3 -- hence the fix's synchronize_rcu().

* Evidence (stock 7.3 KASAN, QEMU; A/B on the one-line fix;
  reproducers attached)
  rtnlrace.c registers a kzalloc'd rtnl_link_ops (kind "rtnlrace"),
  parks a dump reader by kprobe at the exact hand-off (return
  address rtnl_dump_ifinfo+0x374, ENDBR-adjusted), and unregisters
  + kfrees from another thread (modeling module_exit ->
  module_memfree).  nlr (userspace) sends the IFLA_LINKINFO dump
  request that drives the reader path.
  Defect kernel (stock 7.3):
    park t=127041 (1004 ms) -> unregister+kfree at t=127249 (park
    +208 ms, reader still parked 792 ms) -> park ends t=128045:
    BUG: KASAN: slab-use-after-free in __srcu_read_lock+0xe
    BUG: KASAN: slab-use-after-free in __srcu_read_lock+0x25
    BUG: KASAN: slab-use-after-free in __srcu_read_unlock+0x1a
      read stack: __srcu_read_lock <- rtnl_dump_ifinfo+0x374 <-
        rtnl_dumpit <- netlink_dump <- rtnetlink_rcv_msg (task nlr)
      bad address = object+0x10 == ops->srcu (matches the
      disassembly lea 0x10(%rbx))
      alloc: insmod kzalloc;  free: unregister thread kfree
  Fixed kernel (same sources, ONLY the upstream synchronize_rcu()
  added to rtnl_link_unregister()):
    park t=191305 -> park ENDS t=192306 -> unregister+kfree
    t=192307 -- the order literally inverts -- zero KASAN reports,
    dump completes with zero errors.  Same module, same parking.
  Natural runs (three samplings, up to ~267k dumps/reader plus
  6-CPU preemption spinners): zero hits; the window arithmetic
  (~100 ns hand-off vs ~4 ms unregister) explains it, and the
  controlled park models precisely the preemption the upstream
  fix's comment describes.


Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: nlr.c --]
[-- Type: text/plain, Size: 3485 bytes --]

// SPDX-License-Identifier: GPL-2.0+
/*
 * nlr.c - userspace RTM_GETLINK dump hammer for the rtnl_link_ops_get()
 * verification (audit-report Case 1).
 *
 * Sends NLM_F_DUMP RTM_GETLINK requests carrying a nested
 * IFLA_LINKINFO{ IFLA_INFO_KIND=<kind> } filter, which drives exactly:
 *
 *   rtnl_dump_ifinfo -> linkinfo_to_kind_ops -> rtnl_link_ops_get(kind)
 *     -> (inlined) list_for_each_entry_rcu + strcmp + srcu_read_lock(&ops->srcu)
 *
 * i.e. the audited reader path. The dump walk itself runs without RTNL
 * (RTM_GETLINK is registered RTNL_FLAG_DUMP_UNLOCKED), so it is fully
 * concurrent with rtnl_link_unregister().
 *
 * Usage: nlr <kind> [seconds]
 */
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>

#ifndef RTNL_FAMILY_MAX
#define RTNL_FAMILY_MAX 33
#endif

#define NLR_BUF 65536

static int mk_dump_req(char *b, int blen, const char *kind, uint32_t seq)
{
	struct nlmsghdr *nh = (struct nlmsghdr *)b;
	struct ifinfomsg *ifi;
	struct rtattr *linfo, *ikind;
	int klen = strlen(kind) + 1;

	memset(b, 0, blen);
	nh->nlmsg_len = NLMSG_LENGTH(sizeof(*ifi));
	nh->nlmsg_type = RTM_GETLINK;
	nh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
	nh->nlmsg_seq = seq;
	nh->nlmsg_pid = 0;

	ifi = NLMSG_DATA(nh);
	ifi->ifi_family = AF_UNSPEC;

	/* nested IFLA_LINKINFO { IFLA_INFO_KIND = kind } */
	linfo = (struct rtattr *)((char *)b + NLMSG_ALIGN(nh->nlmsg_len));
	linfo->rta_type = IFLA_LINKINFO;
	linfo->rta_len = RTA_LENGTH(0);

	ikind = (struct rtattr *)((char *)linfo + RTA_ALIGN(linfo->rta_len));
	ikind->rta_type = IFLA_INFO_KIND;
	ikind->rta_len = RTA_LENGTH(klen);
	memcpy(RTA_DATA(ikind), kind, klen);

	linfo->rta_len = (char *)ikind + RTA_ALIGN(ikind->rta_len) - (char *)linfo;
	nh->nlmsg_len = (char *)ikind + RTA_ALIGN(ikind->rta_len) - b;
	return nh->nlmsg_len;
}

int main(int argc, char **argv)
{
	const char *kind = argc > 1 ? argv[1] : "rtnlrace";
	int secs = argc > 2 ? atoi(argv[2]) : 30;
	int fd, iters = 0, errs = 0;
	uint32_t seq = 1;
	char req[NLR_BUF], buf[NLR_BUF];
	struct timeval tv = { .tv_sec = 1, .tv_usec = 0 };
	time_t t0 = time(NULL);

	fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
	if (fd < 0) {
		perror("socket");
		return 1;
	}
	setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));

	fprintf(stderr, "nlr: hammering RTM_GETLINK dumps with kind=%s for %ds\n",
		kind, secs);

	while (time(NULL) - t0 < secs) {
		struct sockaddr_nl sa = { .nl_family = AF_NETLINK };
		struct iovec iov = { buf, sizeof(buf) };
		struct msghdr msg = {
			.msg_name = &sa, .msg_namelen = sizeof(sa),
			.msg_iov = &iov, .msg_iovlen = 1,
		};
		int len = mk_dump_req(req, sizeof(req), kind, seq++);
		ssize_t n;

		if (sendto(fd, req, len, 0, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
			errs++;
			continue;
		}
		/* drain until DONE or timeout/error */
		for (;;) {
			n = recvmsg(fd, &msg, 0);
			if (n <= 0) {
				errs++;
				break;
			}
			{
				struct nlmsghdr *nh = (struct nlmsghdr *)buf;

				for (; NLMSG_OK(nh, (unsigned)n);
				     nh = NLMSG_NEXT(nh, n)) {
					if (nh->nlmsg_type == NLMSG_DONE ||
					    nh->nlmsg_type == NLMSG_ERROR)
						goto next_iter;
				}
			}
		}
next_iter:
		iters++;
		if ((iters & 0x3ff) == 0)
			fprintf(stderr, "nlr: %d iters (%d errs)\n", iters, errs);
	}
	fprintf(stderr, "nlr: done: %d iters, %d errs\n", iters, errs);
	return 0;
}

[-- Attachment #3: rtnlrace.c --]
[-- Type: text/plain, Size: 7729 bytes --]

// SPDX-License-Identifier: GPL-2.0+
/*
 * rtnlrace.c - dynamic verification for the audit-report Case 1:
 *
 *   rtnl_link_unregister() (net/core/rtnetlink.c:701-729) is missing the
 *   synchronize_rcu() that upstream "rtnetlink: wait for RCU readers in
 *   rtnl_link_unregister()" (Fixes: 6b57ff21a310) added.
 *
 *   Reader window under test (rtnetlink.c:595-606, rtnl_link_ops_get inlined):
 *        rcu_read_lock();                       // :595
 *        list_for_each_entry_rcu(...)           // :597  found ops via RCU
 *          strcmp(ops->kind, kind)              // :598  matched
 *          *srcu_index = srcu_read_lock(&ops->srcu);   // :599  <-- handoff
 *        rcu_read_unlock();                     // :606
 *
 * Controlled mode (stall_us > 0):
 *   - registers a kzalloc()'d rtnl_link_ops with kind "rtnlrace"
 *     (rtnl_link_register is EXPORT_SYMBOL_GPL), so a userspace RTM_GETLINK
 *     dump with IFLA_INFO_KIND=rtnlrace walks exactly the audited path.
 *   - a kprobe on __srcu_read_lock with return-address filter parks the dump
 *     reader exactly at the :599 handoff (inside the RCU read-side critical
 *     section, before any SRCU state is touched): the audited window, enlarged
 *     for deterministic observation (same technique as kmod/r4_stall.c).
 *   - the unregister kthread then performs what module_exit does:
 *     rtnl_link_unregister(ops) -> list_del_rcu + synchronize_srcu (returns
 *     immediately: the parked reader has NOT entered the SRCU region) +
 *     cleanup_srcu_struct (frees srcu_usage and the percpu sda, sets
 *     ssp->srcu_sup/sda to NULL, leaves srcu_ctrp dangling), then kfree(ops)
 *     (models module_memfree of the unloaded module's static storage; KASAN
 *     slab poisoning makes the post-free read observable).
 *   - the parked reader resumes: READ_ONCE(ssp->srcu_ctrp) on freed memory
 *     => KASAN use-after-free Read in __srcu_read_lock.
 *
 * Natural mode (stall_us == 0): no kprobe, no init registration. A kthread
 * hammers kzalloc/rtnl_link_register/rtnl_link_unregister/kfree cycles of a
 * kind-"rtnlrace" ops while userspace hammers dumps; the natural
 * strcmp->srcu_read_lock window is the only interleaving (rmmod shape).
 *
 * Offsets for build-kasan-7.3/vmlinux (rtnl_link_ops_get fully inlined):
 *   rtnl_dump_ifinfo @ 0xffffffff826e8030 (size 0x925)
 *     call __srcu_read_lock @ +0x36f -> return address +0x374 (kprobe base skips ENDBR, live filter +0x370)
 */
#define pr_fmt(fmt) "RTNLRACE: " fmt

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>
#include <linux/delay.h>
#include <linux/slab.h>
#include <linux/srcu.h>
#include <net/rtnetlink.h>
#include <linux/kthread.h>
#include <linux/atomic.h>

static int stall_ms = 1000;	/* 0 = natural mode */
module_param(stall_ms, int, 0600);
MODULE_PARM_DESC(stall_ms, "park the dump reader this long at the handoff (0=natural); implemented as udelay(10000) x N to dodge x86 __bad_udelay truncation for >20ms values");

static int unreg_delay_ms = 120;
module_param(unreg_delay_ms, int, 0600);

static int natural_secs = 90;
module_param(natural_secs, int, 0600);

static ulong ret_off = 0x370;
module_param(ret_off, ulong, 0600);
MODULE_PARM_DESC(ret_off, "return-address offset of the __srcu_read_lock call inside rtnl_dump_ifinfo");

static struct rtnl_link_ops *rops;	/* controlled mode only */
static atomic_t hits = ATOMIC_INIT(0);
static atomic_t parked = ATOMIC_INIT(0);
static atomic_t freed = ATOMIC_INIT(0);
static atomic_t rounds = ATOMIC_INIT(0);
static unsigned long base_addr;
static struct kprobe kp;
static int probe_live;
static struct task_struct *uthr;

static int stall_pre(struct kprobe *p, struct pt_regs *regs)
{
	unsigned long ra = *(unsigned long *)regs->sp;

	if (ra == base_addr + ret_off) {
		int h = atomic_inc_return(&hits);
		u64 t0 = ktime_to_ms(ktime_get());
		int i;

		atomic_set(&parked, 1);
		if (h <= 3)
			pr_warn("stall #%d: parking dump reader %d ms at handoff (ra=%lx == rtnl_dump_ifinfo+0x%lx) t=%llu\n",
				h, stall_ms, ra, ret_off, t0);
		for (i = 0; i < stall_ms / 10; i++)
			udelay(10000);
		if (h <= 3)
			pr_warn("stall #%d: park END t=%llu (held %llu ms)\n",
				h, ktime_to_ms(ktime_get()),
				ktime_to_ms(ktime_get()) - t0);
	} else if (ra > base_addr && ra < base_addr + 0x2000) {
		static atomic_t dbg;

		int d = atomic_inc_return(&dbg);

		if (d <= 8)
			pr_warn("near-caller #%d ra-off=0x%lx\n", d, ra - base_addr);
	}
	return 0;
}

static unsigned long sym_addr(const char *name)
{
	struct kprobe probe = { .symbol_name = name, };
	unsigned long addr = 0;

	if (register_kprobe(&probe) == 0) {
		addr = (unsigned long)probe.addr;
		unregister_kprobe(&probe);
	}
	return addr;
}

static int unreg_thr(void *unused)
{
	if (stall_ms > 0) {
		/* controlled: wait until the kprobe parked the dump reader */
		while (!atomic_read(&parked) && !kthread_should_stop())
			msleep(5);
		if (kthread_should_stop())
			return 0;
		msleep(unreg_delay_ms);

		rtnl_link_unregister(rops);
		/* protocol evidence: what did cleanup_srcu_struct leave behind?
		 * (rops itself is still allocated here, so these reads are safe) */
		pr_warn("post-unregister t=%llu: ops=%px srcu.srcu_sup=%px srcu.sda=%px srcu.srcu_ctrp=%px\n",
			ktime_to_ms(ktime_get()), rops, rops->srcu.srcu_sup, rops->srcu.sda,
			rops->srcu.srcu_ctrp);
		kfree(rops);
		atomic_set(&freed, 1);
		pr_warn("ops kfree()d (models module_memfree of the unloaded module); parked reader will resume on freed memory\n");
	} else {
		/* natural: hammer kzalloc/register/unregister/kfree (rmmod shape) */
		u64 t0 = ktime_to_ms(ktime_get());

		while (!kthread_should_stop() &&
		       ktime_to_ms(ktime_get()) - t0 < (u64)natural_secs * 1000) {
			struct rtnl_link_ops *o = kzalloc(sizeof(*o), GFP_KERNEL);

			if (!o)
				break;
			o->kind = "rtnlrace";
			if (rtnl_link_register(o) == 0) {
				rtnl_link_unregister(o);
				kfree(o);
			} else {
				kfree(o);
			}
			atomic_inc(&rounds);
			if ((atomic_read(&rounds) & 0x3ff) == 0)
				pr_warn("natural round %d\n", atomic_read(&rounds));
		}
		pr_warn("natural done: %d register/unregister/kfree rounds\n",
			atomic_read(&rounds));
	}
	return 0;
}

static int __init rtnlrace_init(void)
{
	int ret;

	if (stall_ms > 0) {
		rops = kzalloc(sizeof(*rops), GFP_KERNEL);
		if (!rops)
			return -ENOMEM;
		rops->kind = "rtnlrace";
		ret = rtnl_link_register(rops);
		if (ret) {
			pr_err("rtnl_link_register failed: %d\n", ret);
			kfree(rops);
			rops = NULL;
			return ret;
		}
		pr_warn("registered rtnl_link_ops kind=rtnlrace (%px); start: /nlr rtnlrace\n", rops);

		base_addr = sym_addr("rtnl_dump_ifinfo");
		if (!base_addr) {
			pr_err("cannot resolve rtnl_dump_ifinfo\n");
			return -EINVAL;
		}
		kp.symbol_name = "__srcu_read_lock";
		kp.pre_handler = stall_pre;
		ret = register_kprobe(&kp);
		if (ret) {
			pr_err("cannot register kprobe: %d\n", ret);
			return ret;
		}
		probe_live = 1;
		pr_warn("kprobe on __srcu_read_lock, park ra=rtnl_dump_ifinfo+0x%lx (%px)\n",
			ret_off, (void *)(base_addr + ret_off));
	}

	uthr = kthread_run(unreg_thr, NULL, "rtnlrace_unreg");
	if (IS_ERR(uthr))
		return PTR_ERR(uthr);
	pr_warn("armed: stall_ms=%d unreg_delay_ms=%d mode=%s\n", stall_ms,
		unreg_delay_ms, stall_ms > 0 ? "controlled" : "natural");
	return 0;
}

static void __exit rtnlrace_exit(void)
{
	if (uthr)
		kthread_stop(uthr);
	if (probe_live)
		unregister_kprobe(&kp);
	if (stall_ms > 0 && atomic_read(&freed) == 0 && rops) {
		rtnl_link_unregister(rops);
		kfree(rops);
	}
	pr_warn("module exit (hits=%d rounds=%d)\n", atomic_read(&hits),
		atomic_read(&rounds));
}

module_init(rtnlrace_init);
module_exit(rtnlrace_exit);
MODULE_LICENSE("GPL");