From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sender-of-o51.zoho.in (sender-of-o51.zoho.in [103.117.158.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 944971D12F for ; Mon, 18 Dec 2023 19:00:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=siddh.me Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=siddh.me Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=siddh.me header.i=code@siddh.me header.b="lEygYXxj" ARC-Seal: i=1; a=rsa-sha256; t=1702926018; cv=none; d=zohomail.in; s=zohoarc; b=KWs11M3z/V0f0/k+DITHurIR7GHoT8U8d1OnzKkfFqMH8fE62AEZJpx+izPMnwUeN4NLiZXhvgn5fKhq26rD8f+yykjTod2claRaM8EYUdV9bOKw6wkFXpXSsgrgL0E63pxMumdywXZ5dWj8OkjeEHpoSJOMXrOWgKIWttGPBBY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1702926018; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=J/tv9MKDK7sxn43WTD9DYlF3cz5jRBVn/+j5ya7lOpE=; b=HiIUlVYvs3WyZaNAu3fiPQ4XuApghl6wRemU2w2GkTPTR+X9ARFaWm3SH7pqQ9DSEhlW6H6nxaXYoC++Egewxo40va0PXpfDcMflHuZVqp11U0GUxnAFUtFY3+SzhlmBCPOwqzAhz4uyJdugDeDk3xyypmX+3yZBy/qQMyeN2IU= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1702926018; s=zmail; d=siddh.me; i=code@siddh.me; h=Message-ID:Date:Date:MIME-Version:To:To:Cc:Cc:References:Subject:Subject:From:From:In-Reply-To:Content-Type:Content-Transfer-Encoding:Message-Id:Reply-To; bh=J/tv9MKDK7sxn43WTD9DYlF3cz5jRBVn/+j5ya7lOpE=; b=lEygYXxjfmexHbMTHMlM64FwCMl8e3aiVcrS591oXu3cgcrG3FM8Fsv5CuAtECEg zRfEFQvO8VEJ008ejYPi/kV6O/Byj5/SD3OAyHWPL4TCMZhvJ0fWypSFmMrhiNA6EWa 9U87CyXNcAV5nMuD9CUe18WlsxNJ4dfpyZs+bH48= Received: from [192.168.1.12] (122.170.167.40 [122.170.167.40]) by mx.zoho.in with SMTPS id 1702926016954586.4065466888987; Tue, 19 Dec 2023 00:30:16 +0530 (IST) Message-ID: <5b6b9fff-e0db-4f13-866f-42aa2756c47d@siddh.me> Date: Tue, 19 Dec 2023 00:30:13 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com References: <000000000000cb112e0609b419d3@google.com> Subject: Re: [syzbot] [net?] [nfc?] KASAN: slab-use-after-free Read in nfc_alloc_send_skb Content-Language: en-US, en-GB, hi-IN From: Siddh Raman Pant In-Reply-To: <000000000000cb112e0609b419d3@google.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ZohoMailClient: External #syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main --- net/nfc/llcp_core.c | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 1dac28136e6a..18be13fb9b75 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -145,6 +145,13 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) { + /* Since using nfc_llcp_local may result in usage of nfc_dev, whenever + * we hold a reference to local, we also need to hold a reference to + * the device to avoid UAF. + */ + if (!nfc_get_device(local->dev->idx)) + return NULL; + kref_get(&local->ref); return local; @@ -177,10 +184,18 @@ static void local_release(struct kref *ref) int nfc_llcp_local_put(struct nfc_llcp_local *local) { + struct nfc_dev *dev; + int ret; + if (local == NULL) return 0; - return kref_put(&local->ref, local_release); + dev = local->dev; + + ret = kref_put(&local->ref, local_release); + nfc_put_device(dev); + + return ret; } static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, @@ -959,8 +974,17 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, } new_sock = nfc_llcp_sock(new_sk); - new_sock->dev = local->dev; + new_sock->local = nfc_llcp_local_get(local); + if (!new_sock->local) { + reason = LLCP_DM_REJ; + sock_put(&new_sock->sk); + release_sock(&sock->sk); + sock_put(&sock->sk); + goto fail; + } + + new_sock->dev = local->dev; new_sock->rw = sock->rw; new_sock->miux = sock->miux; new_sock->nfc_protocol = sock->nfc_protocol; @@ -1597,7 +1621,16 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) if (local == NULL) return -ENOMEM; - local->dev = ndev; + /* As we are going to initialize local's refcount, we need to get the + * nfc_dev to avoid UAF, otherwise there is no point in continuing. + * See nfc_llcp_local_get(). + */ + local->dev = nfc_get_device(ndev->idx); + if (!local->dev) { + kfree(local); + return -ENODEV; + } + INIT_LIST_HEAD(&local->list); kref_init(&local->ref); mutex_init(&local->sdp_lock); -- 2.43.0