Ignat Korchagin 78e4aa528a net: do not leave a dangling sk pointer, when socket creation fails ... commit 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 upstream. It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper * running traceroute -I 1.1.1.1 on a freshly booted VM A KASAN enabled kernel will log something like below (decoded and stripped): ================================================================== BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Read of size 8 at addr ffff888007110dd8 by task traceroute/299 CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __sock_release (net/socket.c:652) __sock_create (net/socket.c:1601) ... Allocated by task 299 on cpu 2 at 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) sk_prot_alloc (net/core/sock.c:2075) sk_alloc (net/core/sock.c:2134) inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 299 on cpu 2 at 78.328502s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) kasan_save_free_info (mm/kasan/generic.c:582) poison_slab_object (mm/kasan/common.c:242) __kasan_slab_free (mm/kasan/common.c:256) kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Fix this by clearing the struct socket reference in sk_common_release() to cover all protocol families create functions, which may already attached the reference to the sk object with sock_init_data(). Fixes: c5dbb89fc2 ("bpf: Expose bpf_get_socket_cookie to tracing programs") Suggested-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Ignat Korchagin <ignat@cloudflare.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/netdev/20240613194047.36478-1-kuniyu@amazon.com/T/ Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: D. Wythe <alibuda@linux.alibaba.com> Link: https://lore.kernel.org/r/20240617210205.67311-1-ignat@cloudflare.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-07-05 09:14:33 +02:00
..
Makefile	…
bpf_sk_storage.c	bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing	2023-08-11 15:13:50 +02:00
datagram.c	net: datagram: fix data-races in datagram_poll()	2023-05-24 17:36:42 +01:00
datagram.h	…
dev.c	net: give more chances to rcu in netdev_wait_allrefs_any()	2024-06-16 13:39:23 +02:00
dev_addr_lists.c	…
dev_ioctl.c	net: dev: Convert sa_data to flexible array in struct sockaddr	2024-03-01 13:21:59 +01:00
devlink.c	devlink: report devlink_port_type_warn source device	2024-03-01 13:21:55 +01:00
drop_monitor.c	drop_monitor: replace spin_lock by raw_spin_lock	2024-07-05 09:14:26 +02:00
dst.c	ipv6: remove max_size check inline with ipv4	2024-01-15 18:51:25 +01:00
dst_cache.c	…
failover.c	…
fib_notifier.c	…
fib_rules.c	…
filter.c	xdp: use flags field to disambiguate broadcast redirect	2024-05-17 11:50:47 +02:00
flow_dissector.c	net/core: Fix ETH_P_1588 flow dissector	2023-10-06 13:18:05 +02:00
flow_offload.c	…
gen_estimator.c	…
gen_stats.c	…
gro_cells.c	…
hwbm.c	…
link_watch.c	…
lwt_bpf.c	lwt: Fix return values of BPF xmit ops	2023-09-19 12:22:33 +02:00
lwtunnel.c	…
neighbour.c	neighbour: Don't let neigh_forced_gc() disable preemption for long	2024-01-25 14:52:29 -08:00
net-procfs.c	…
net-sysfs.c	…
net-sysfs.h	…
net-traces.c	…
net_namespace.c	netns: Make get_net_ns() handle zero refcount net	2024-07-05 09:14:30 +02:00
netclassid_cgroup.c	…
netevent.c	…
netpoll.c	netpoll: Fix race condition in netpoll_owner_active	2024-07-05 09:14:26 +02:00
netprio_cgroup.c	…
of_net.c	of: net: add a helper for loading netdev->dev_addr	2023-07-27 08:46:59 +02:00
page_pool.c	page_pool: fix inconsistency for page_pool_ring_[un]lock()	2023-06-05 09:21:22 +02:00
pktgen.c	net: pktgen: Fix interface flags printing	2023-10-25 11:58:58 +02:00
ptp_classifier.c	…
request_sock.c	tcp: make sure init the accept_queue's spinlocks once	2024-02-23 08:54:27 +01:00
rtnetlink.c	rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation	2024-05-17 11:50:58 +02:00
scm.c	io_uring/unix: drop usage of io_uring socket	2024-03-26 18:21:11 -04:00
secure_seq.c	…
selftests.c	…
skbuff.c	skbuff: introduce skb_pull_data	2024-07-05 09:14:11 +02:00
skmsg.c	bpf, sockmap: Improved check for empty queue	2024-05-17 11:50:56 +02:00
sock.c	net: do not leave a dangling sk pointer, when socket creation fails	2024-07-05 09:14:33 +02:00
sock_destructor.h	…
sock_diag.c	sock_diag: annotate data-races around sock_diag_handlers[family]	2024-03-26 18:21:17 -04:00
sock_map.c	sock_map: avoid race between sock_map_close and sk_psock_put	2024-07-05 09:14:20 +02:00
sock_reuseport.c	…
stream.c	net: deal with most data-races in sk_wait_event()	2023-05-24 17:36:42 +01:00
sysctl_net_core.c	…
timestamping.c	…
tso.c	…
utils.c	…
xdp.c	xdp: xdp_mem_allocator can be NULL in trace_mem_connect().	2023-06-05 09:21:23 +02:00