No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Muchun Song fe5838c22b net: fix use-after-free in tw_timer_handler
commit e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 upstream.

A real world panic issue was found as follow in Linux 5.4.

    BUG: unable to handle page fault for address: ffffde49a863de28
    PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
    RIP: 0010:tw_timer_handler+0x20/0x40
    Call Trace:
     <IRQ>
     call_timer_fn+0x2b/0x120
     run_timer_softirq+0x1ef/0x450
     __do_softirq+0x10d/0x2b8
     irq_exit+0xc7/0xd0
     smp_apic_timer_interrupt+0x68/0x120
     apic_timer_interrupt+0xf/0x20

This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.

The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops
in the list of pernet_list. There will be a use-after-free on
net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net
if there are some inflight time-wait timers.

This bug is not introduced by commit f2bf415cfe ("mib: add net to
NET_ADD_STATS_BH") since the net_statistics is a global variable
instead of dynamic allocation and freeing. Actually, commit
61a7e26028 ("mib: put net statistics on struct net") introduces
the bug since it put net statistics on struct net and free it when
net namespace is destroyed.

Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug
and replace pr_crit() with panic() since continuing is meaningless
when init_ipv4_mibs() fails.

[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1

Fixes: 61a7e26028 ("mib: put net statistics on struct net")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Cong Wang <cong.wang@bytedance.com>
Cc: Fam Zheng <fam.zheng@bytedance.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211228104145.9426-1-songmuchun@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-05 12:37:46 +01:00
arch ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling 2021-12-29 12:23:37 +01:00
block block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) 2021-12-14 14:49:02 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-17 09:48:40 +01:00
Documentation Input: i8042 - add deferred probe support 2022-01-05 12:37:43 +01:00
drivers Input: spaceball - fix parsing of movement data packets 2022-01-05 12:37:46 +01:00
fs f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 2021-12-29 12:23:37 +01:00
include uapi: fix linux/nfc.h userspace compilation errors 2022-01-05 12:37:45 +01:00
init
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel rcu: Mark accesses to rcu_state.n_force_qs 2021-12-22 09:29:40 +01:00
lib siphash: use _unaligned version by default 2021-12-08 09:01:12 +01:00
LICENSES
mm mm: mempolicy: fix THP allocations escaping mempolicy restrictions 2021-12-29 12:23:37 +01:00
net net: fix use-after-free in tw_timer_handler 2022-01-05 12:37:46 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts recordmcount.pl: fix typo in s390 mcount regex 2022-01-05 12:37:44 +01:00
security selinux: initialize proto variable in selinux_ip_postroute_compat() 2022-01-05 12:37:44 +01:00
sound ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 2021-12-29 12:23:36 +01:00
tools selftests/net: udpgso_bench_tx: fix dst ip argument 2022-01-05 12:37:45 +01:00
usr
virt KVM: do not shrink halt_poll_ns below grow_start 2021-10-09 14:39:50 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.169 2021-12-29 12:23:38 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.