Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Lin Ma 5c63ad2b0a nfc: nci: add flush_workqueue to prevent uaf ... [ Upstream commit ef27324e2cb7bb24542d6cb2571740eefe6b00dc ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-20 09:19:35 +02:00
..
6lowpan
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 11:22:39 +01:00
802
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:23:34 +01:00
appletalk
atm
ax25	ax25: Fix NULL pointer dereference in ax25_kill_by_device	2022-03-16 13:21:45 +01:00
batman-adv	ipv6: make mc_forwarding atomic	2022-04-15 14:18:32 +02:00
bluetooth	Bluetooth: Fix use after free in hci_send_acl	2022-04-15 14:18:34 +02:00
bpf
bpfilter
bridge	net: bridge: fix stale eth hdr pointer in br_dev_xmit	2022-02-16 12:52:50 +01:00
caif
can	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM	2021-12-08 09:01:08 +01:00
ceph
core	net/sched: flower: fix parsing of ethertype following VLAN header	2022-04-20 09:19:34 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:07:51 +01:00
dccp	dccp: don't duplicate ccid when cloning dccp sock	2021-09-22 12:26:40 +02:00
decnet
dns_resolver
dsa	net: dsa: Add missing of_node_put() in dsa_port_parse_of	2022-03-23 09:12:07 +01:00
ethernet
hsr
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:24:31 +01:00
ife
ipv4	net: ipv4: fix route with nexthop object delete warning	2022-04-15 14:18:37 +02:00
ipv6	ipv6: Fix stats accounting in ip6_pkt_drop	2022-04-15 14:18:37 +02:00
iucv
kcm
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-04-15 14:17:56 +02:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:26:41 +02:00
l3mdev
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 08:46:48 +02:00
mac80211	mac80211: fix potential double free on mesh join	2022-03-28 08:46:48 +02:00
mac802154
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:01:12 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:37:45 +01:00
netfilter	netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options	2022-04-15 14:18:20 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-15 14:18:35 +02:00
netlink	af_netlink: Fix shift out of bounds in group mask calculation	2022-04-15 14:18:16 +02:00
netrom
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-20 09:19:35 +02:00
nsh
openvswitch	net: openvswitch: don't send internal clone attribute to the userspace.	2022-04-15 14:18:37 +02:00
packet	net/packet: fix slab-out-of-bounds access in packet_recvmsg()	2022-03-23 09:12:06 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:23:33 +01:00
psample
qrtr
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:29:37 +01:00
rfkill
rose
rxrpc	rxrpc: fix a race in rxrpc_exit_net()	2022-04-15 14:18:38 +02:00
sched	net/sched: taprio: Check if socket flags are valid	2022-04-20 09:19:35 +02:00
sctp	sctp: Initialize daddr on peeled off socket	2022-04-20 09:19:35 +02:00
smc	net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()	2022-04-20 09:19:35 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-17 09:48:48 +01:00
sunrpc	SUNRPC: Handle low memory situations in call_status()	2022-04-15 14:18:38 +02:00
switchdev	net: switchdev: do not propagate bridge updates across bridges	2021-10-27 09:54:24 +02:00
tipc	tipc: fix the timer expires after interval 100ms	2022-04-15 14:18:17 +02:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-15 14:18:37 +02:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 09:19:53 +01:00
vmw_vsock	vsock: remove vsock from connected table when connect is interrupted by a signal	2022-02-23 11:59:57 +01:00
wimax
wireless	cfg80211: hold bss_lock while updating nontrans_list	2022-04-20 09:19:35 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-15 14:18:21 +02:00
xdp	Revert "xsk: Do not sleep in poll() when need_wakeup set"	2021-12-22 09:29:40 +01:00
xfrm	xfrm: fix tunnel model fragmentation behavior	2022-04-15 14:17:56 +02:00
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c