Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1290367
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.3 03/71] af-unix: fix use-after-free with concurrent readers while splicing |
| Date | 2015-12-12 21:30 +0100 |
| Message-ID | <qEYXM-6UZ-27@gated-at.bofh.it> (permalink) |
| References | <qEYO5-6QW-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
[ Upstream commit 73ed5d25dce0354ea381d6dc93005c3085fae03d ]
During splicing an af-unix socket to a pipe we have to drop all
af-unix socket locks. While doing so we allow another reader to enter
unix_stream_read_generic which can read, copy and finally free another
skb. If exactly this skb is just in process of being spliced we get a
use-after-free report by kasan.
First, we must make sure to not have a free while the skb is used during
the splice operation. We simply increment its use counter before unlocking
the reader lock.
Stream sockets have the nice characteristic that we don't care about
zero length writes and they never reach the peer socket's queue. That
said, we can take the UNIXCB.consumed field as the indicator if the
skb was already freed from the socket's receive queue. If the skb was
fully consumed after we locked the reader side again we know it has been
dropped by a second reader. We indicate a short read to user space and
abort the current splice operation.
This bug has been found with syzkaller
(http://github.com/google/syzkaller) by Dmitry Vyukov.
Fixes: 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/unix/af_unix.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -440,6 +440,7 @@ static void unix_release_sock(struct soc
if (state == TCP_LISTEN)
unix_release_sock(skb->sk, 1);
/* passed fds are erased in the kfree_skb hook */
+ UNIXCB(skb).consumed = skb->len;
kfree_skb(skb);
}
@@ -2071,6 +2072,7 @@ static int unix_stream_read_generic(stru
do {
int chunk;
+ bool drop_skb;
struct sk_buff *skb, *last;
unix_state_lock(sk);
@@ -2151,7 +2153,11 @@ unlock:
}
chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
+ skb_get(skb);
chunk = state->recv_actor(skb, skip, chunk, state);
+ drop_skb = !unix_skb_len(skb);
+ /* skb is only safe to use if !drop_skb */
+ consume_skb(skb);
if (chunk < 0) {
if (copied == 0)
copied = -EFAULT;
@@ -2160,6 +2166,18 @@ unlock:
copied += chunk;
size -= chunk;
+ if (drop_skb) {
+ /* the skb was touched by a concurrent reader;
+ * we should not expect anything from this skb
+ * anymore and assume it invalid - we can be
+ * sure it was dropped from the socket queue
+ *
+ * let's report a short read
+ */
+ err = 0;
+ break;
+ }
+
/* Mark read part of skb as used */
if (!(flags & MSG_PEEK)) {
UNIXCB(skb).consumed += chunk;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.3 00/71] 4.3.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 15/71] packet: only allow extra vlan len on ethernet devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 14/71] packet: always probe for transport header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 07/71] af-unix: passcred support for sendpage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 17/71] packet: fix tpacket_snd max frame len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 06/71] unix: avoid use-after-free in ep_remove_wait_queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 02/71] r8169: fix kasan reported skb use-after-free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 08/71] ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 12/71] tools/net: Use include/uapi with __EXPORTED_HEADERS__ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 09/71] ipv6: Check expire on DST_NOCACHE route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:20 +0100
[PATCH 4.3 31/71] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 62/71] debugfs: fix refcount imbalance in start_creating Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 04/71] af_unix: dont append consumed skbs to sk_receive_queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 29/71] tcp: fix potential huge kmalloc() calls in TCP_REPAIR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 25/71] net/ip6_tunnel: fix dst leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 03/71] af-unix: fix use-after-free with concurrent readers while splicing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 24/71] snmp: Remove duplicate OUTMCAST stat increment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 36/71] tipc: fix error handling of expanding buffer headroom Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
Re: [PATCH 4.3 36/71] tipc: fix error handling of expanding buffer headroom Ben Hutchings <ben@decadent.org.uk> - 2015-12-14 18:50 +0100
Re: [PATCH 4.3 36/71] tipc: fix error handling of expanding buffer headroom Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-15 01:00 +0100
[PATCH 4.3 16/71] packet: infer protocol from ethernet header if unset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 66/71] ocfs2: fix umask ignored issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 64/71] nfs4: resend LAYOUTGET when there is a race that changes the seqid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 10/71] ipv6: Check rt->dst.from for the DST_NOCACHE route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 01/71] certs: add .gitignore to stop git nagging about x509_certificate_list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 52/71] Btrfs: fix race when listing an inodes xattrs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 67/71] block: fix segment split Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 63/71] nfs4: start callback_ident at idr 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 65/71] nfs: if we have no valid attrs, then dont declare the attribute cache valid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 05/71] af_unix: take receive queue lock while appending new skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 61/71] nfsd: eliminate sending duplicate and repeated delegations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 11/71] Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:30 +0100
[PATCH 4.3 21/71] ip_tunnel: disable preemption when updating per-cpu tstats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 55/71] ext4 crypto: fix memory leak in ext4_bio_write_page() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 39/71] bpf, array: fix heap out-of-bounds access when updating elements Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 54/71] rbd: dont put snap_context twice in rbd_queue_workfn() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 50/71] Btrfs: fix race leading to incorrect item deletion when dropping extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 35/71] broadcom: fix PHY_ID_BCM5481 entry in the id table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 57/71] ext4: fix potential use after free in __ext4_journal_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 48/71] Btrfs: fix truncation of compressed and inlined extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 41/71] net/neighbour: fix crash at dumping device-agnostic proxy entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 23/71] net: thunder: Check for driver data in nicvf_remove() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
RE: [PATCH 4.3 23/71] net: thunder: Check for driver data in nicvf_remove() Pavel Fedin <p.fedin@samsung.com> - 2015-12-14 08:20 +0100
Re: [PATCH 4.3 23/71] net: thunder: Check for driver data in nicvf_remove() 'Greg Kroah-Hartman' <gregkh@linuxfoundation.org> - 2015-12-14 15:20 +0100
RE: [PATCH 4.3 23/71] net: thunder: Check for driver data in nicvf_remove() Pavel Fedin <p.fedin@samsung.com> - 2015-12-14 16:00 +0100
[PATCH 4.3 51/71] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 56/71] ext4 crypto: fix bugs in ext4_encrypted_zeroout() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 47/71] Btrfs: fix file corruption and data loss after cloning inline extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 71/71] [media] cobalt: fix Kconfig dependency Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
Re: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure Ben Hutchings <ben@decadent.org.uk> - 2015-12-14 18:50 +0100
Re: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure David Ahern <dsa@cumulusnetworks.com> - 2015-12-14 20:00 +0100
Re: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-15 06:50 +0100
[PATCH 4.3] vrf: Fix memory leak on registration failure in vrf_newlink() Ben Hutchings <ben@decadent.org.uk> - 2015-12-15 16:20 +0100
Re: [PATCH 4.3] vrf: Fix memory leak on registration failure in vrf_newlink() David Miller <davem@davemloft.net> - 2015-12-15 18:50 +0100
[PATCH 4.3 45/71] btrfs: fix resending received snapshot with parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 33/71] net: ip6mr: fix static mfc/dev leaks on table destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 40/71] ipv6: add complete rcu protection around np->opt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 38/71] RDS: fix race condition when sending a message on unbound socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 32/71] net: ipmr: fix static mfc/dev leaks on table destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 46/71] btrfs: check unsupported filters in balance arguments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 53/71] btrfs: fix signed overflows in btrfs_sync_file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 44/71] net_sched: fix qdisc_tree_decrease_qlen() races Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 58/71] ext4, jbd2: ensure entering into panic after recording an error in superblock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 43/71] openvswitch: fix hangup on vxlan/gre/geneve device deletion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 19/71] net/mlx5e: Added self loopback prevention Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 42/71] ipv6: sctp: implement sctp_v6_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 20/71] net/mlx4_core: Fix sleeping while holding spinlock at rem_slave_counters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 59/71] firewire: ohci: fix JMicron JMB38x IT context discovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 37/71] ipv6: distinguish frag queues by device for multicast and link-local packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 18/71] sctp: translate host order to network order when setting a hmacid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 22/71] net: switchdev: fix return code of fdb_dump stub Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 60/71] nfsd: serialize state seqid morphing operations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:40 +0100
[PATCH 4.3 70/71] ALSA: hda/hdmi - apply Skylake fix-ups to Broxton display codec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
[PATCH 4.3 27/71] tcp: md5: fix lockdep annotation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
[PATCH 4.3 68/71] ceph: fix message length computation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
[PATCH 4.3 69/71] ALSA: pci: depend on ZONE_DMA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
[PATCH 4.3 30/71] tcp: initialize tp->copied_seq in case of cross SYN connection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
[PATCH 4.3 28/71] tcp: disable Fast Open on timeouts after handshake Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-12 21:50 +0100
Re: [PATCH 4.3 00/71] 4.3.3-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-12-13 04:10 +0100
Re: [PATCH 4.3 00/71] 4.3.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-13 04:50 +0100
Re: [PATCH 4.3 00/71] 4.3.3-stable review Guenter Roeck <linux@roeck-us.net> - 2015-12-13 17:10 +0100
Re: [PATCH 4.3 00/71] 4.3.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-14 04:30 +0100
csiph-web