Eric Dumazet 48cac18ecf ipv6: orphan skbs in reassembly unit ... Andrey reported a use-after-free in IPv6 stack. Issue here is that we free the socket while it still has skb in TX path and in some queues. It happens here because IPv6 reassembly unit messes skb->truesize, breaking skb_set_owner_w() badly. We fixed a similar issue for IPV4 in commit 8282f27449 ("inet: frag: Always orphan skbs inside ip_defrag()") Acked-by: Joe Stringer <joe@ovn.org> ================================================================== BUG: KASAN: use-after-free in sock_wfree+0x118/0x120 Read of size 8 at addr ffff880062da0060 by task a.out/4140 page:ffffea00018b6800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 0000000000000000 0000000000000000 0000000180130013 raw: dead000000000100 dead000000000200 ffff88006741f140 0000000000000000 page dumped because: kasan: bad access detected CPU: 0 PID: 4140 Comm: a.out Not tainted 4.10.0-rc3+ #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:15 dump_stack+0x292/0x398 lib/dump_stack.c:51 describe_address mm/kasan/report.c:262 kasan_report_error+0x121/0x560 mm/kasan/report.c:370 kasan_report mm/kasan/report.c:392 __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:413 sock_flag ./arch/x86/include/asm/bitops.h:324 sock_wfree+0x118/0x120 net/core/sock.c:1631 skb_release_head_state+0xfc/0x250 net/core/skbuff.c:655 skb_release_all+0x15/0x60 net/core/skbuff.c:668 __kfree_skb+0x15/0x20 net/core/skbuff.c:684 kfree_skb+0x16e/0x4e0 net/core/skbuff.c:705 inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304 inet_frag_put ./include/net/inet_frag.h:133 nf_ct_frag6_gather+0x1125/0x38b0 net/ipv6/netfilter/nf_conntrack_reasm.c:617 ipv6_defrag+0x21b/0x350 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68 nf_hook_entry_hookfn ./include/linux/netfilter.h:102 nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310 nf_hook ./include/linux/netfilter.h:212 __ip6_local_out+0x52c/0xaf0 net/ipv6/output_core.c:160 ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170 ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722 ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742 rawv6_push_pending_frames net/ipv6/raw.c:613 rawv6_sendmsg+0x2cff/0x4130 net/ipv6/raw.c:927 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 sock_sendmsg+0xca/0x110 net/socket.c:645 sock_write_iter+0x326/0x620 net/socket.c:848 new_sync_write fs/read_write.c:499 __vfs_write+0x483/0x760 fs/read_write.c:512 vfs_write+0x187/0x530 fs/read_write.c:560 SYSC_write fs/read_write.c:607 SyS_write+0xfb/0x230 fs/read_write.c:599 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:203 RIP: 0033:0x7ff26e6f5b79 RSP: 002b:00007ff268e0ed98 EFLAGS: 00000206 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ff268e0f9c0 RCX: 00007ff26e6f5b79 RDX: 0000000000000010 RSI: 0000000020f50fe1 RDI: 0000000000000003 RBP: 00007ff26ebc1220 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ff268e0f9c0 R14: 00007ff26efec040 R15: 0000000000000003 The buggy address belongs to the object at ffff880062da0000 which belongs to the cache RAWv6 of size 1504 The buggy address ffff880062da0060 is located 96 bytes inside of 1504-byte region [ffff880062da0000, ffff880062da05e0) Freed by task 4113: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:502 set_track mm/kasan/kasan.c:514 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:578 slab_free_hook mm/slub.c:1352 slab_free_freelist_hook mm/slub.c:1374 slab_free mm/slub.c:2951 kmem_cache_free+0xb2/0x2c0 mm/slub.c:2973 sk_prot_free net/core/sock.c:1377 __sk_destruct+0x49c/0x6e0 net/core/sock.c:1452 sk_destruct+0x47/0x80 net/core/sock.c:1460 __sk_free+0x57/0x230 net/core/sock.c:1468 sk_free+0x23/0x30 net/core/sock.c:1479 sock_put ./include/net/sock.h:1638 sk_common_release+0x31e/0x4e0 net/core/sock.c:2782 rawv6_close+0x54/0x80 net/ipv6/raw.c:1214 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:431 sock_release+0x8d/0x1e0 net/socket.c:599 sock_close+0x16/0x20 net/socket.c:1063 __fput+0x332/0x7f0 fs/file_table.c:208 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x19b/0x270 kernel/task_work.c:116 exit_task_work ./include/linux/task_work.h:21 do_exit+0x186b/0x2800 kernel/exit.c:839 do_group_exit+0x149/0x420 kernel/exit.c:943 SYSC_exit_group kernel/exit.c:954 SyS_exit_group+0x1d/0x20 kernel/exit.c:952 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:203 Allocated by task 4115: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:502 set_track mm/kasan/kasan.c:514 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:605 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:544 slab_post_alloc_hook mm/slab.h:432 slab_alloc_node mm/slub.c:2708 slab_alloc mm/slub.c:2716 kmem_cache_alloc+0x1af/0x250 mm/slub.c:2721 sk_prot_alloc+0x65/0x2a0 net/core/sock.c:1334 sk_alloc+0x105/0x1010 net/core/sock.c:1396 inet6_create+0x44d/0x1150 net/ipv6/af_inet6.c:183 __sock_create+0x4f6/0x880 net/socket.c:1199 sock_create net/socket.c:1239 SYSC_socket net/socket.c:1269 SyS_socket+0xf9/0x230 net/socket.c:1249 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:203 Memory state around the buggy address: ffff880062d9ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880062d9ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff880062da0000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff880062da0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880062da0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-03-01 20:55:57 -08:00
..
ila	lwtunnel: remove device arg to lwtunnel_build_state	2017-01-30 15:14:22 -05:00
netfilter	ipv6: orphan skbs in reassembly unit	2017-03-01 20:55:57 -08:00
addrconf_core.c	ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument	2015-07-31 15:21:30 -07:00
addrconf.c	net/ipv6: avoid possible dead locking on addr_gen_mode sysctl	2017-03-01 10:22:48 -08:00
addrlabel.c	ipv6/addrlabel: fix ip6addrlbl_get()	2015-12-22 15:57:54 -05:00
af_inet6.c	Introduce a sysctl that modifies the value of PROT_SOCK.	2017-01-24 12:10:51 -05:00
ah6.c	IPsec: do not ignore crypto err in ah6 input	2017-01-16 12:57:48 +01:00
anycast.c	ipv6: coding style: comparison for equality with NULL	2015-03-31 13:51:54 -04:00
calipso.c	calipso: fix resource leak on calipso_genopt failure	2016-08-13 14:56:17 -07:00
datagram.c	ipv6: Handle IPv4-mapped src to in6addr_any dst.	2017-02-14 12:13:51 -05:00
esp6_offload.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
esp6.c	esp: Introduce a helper to setup the trailer	2017-01-17 10:23:08 +01:00
exthdrs_core.c	ipv6: constify the skb pointer of ipv6_find_tlv().	2016-06-27 15:06:15 -04:00
exthdrs_offload.c	ipv6: fix exthdrs offload registration in out_rt path	2015-09-02 15:31:00 -07:00
exthdrs.c	ipv6: sr: remove cleanup flag and fix HMAC computation	2017-02-03 11:05:23 -05:00
fib6_rules.c	net: flow: Add l3mdev flow update	2016-09-10 23:12:51 -07:00
fou6.c	fou: add Kconfig options for IPv6 support	2016-05-29 22:24:21 -07:00
icmp.c	net: for rate-limited ICMP replies save one atomic operation	2017-01-09 15:49:12 -05:00
inet6_connection_sock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-01-28 10:33:06 -05:00
inet6_hashtables.c	inet: collapse ipv4/v6 rcv_saddr_equal functions into one	2017-01-18 13:04:28 -05:00
ip6_checksum.c	ipv6: fix checksum annotation in udp6_csum_init	2016-06-14 15:26:42 -04:00
ip6_fib.c	net: ipv6: Change notifications for multipath delete to RTA_MULTIPATH	2017-02-04 19:58:14 -05:00
ip6_flowlabel.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
ip6_gre.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-07 16:29:30 -05:00
ip6_icmp.c	ipv6: icmp: add a force_saddr param to icmp6_send()	2016-06-18 22:11:38 -07:00
ip6_input.c	net: vrf: ipv6 support for local traffic to local addresses	2016-06-08 00:25:38 -07:00
ip6_offload.c	net: Add a skb_gro_flush_final helper.	2017-02-15 09:39:39 +01:00
ip6_offload.h	udp: Add GRO functions to UDP socket	2016-04-07 16:53:29 -04:00
ip6_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-19 11:18:46 -05:00
ip6_tunnel.c	ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()	2017-02-01 12:27:33 -05:00
ip6_udp_tunnel.c	ip6_udp_tunnel: remove unused IPCB related codes	2016-11-02 15:18:36 -04:00
ip6_vti.c	vti6: return GRE_KEY for vti6	2017-02-24 11:42:55 -05:00
ip6mr.c	ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt	2017-02-26 21:25:46 -05:00
ipcomp6.c	net: inet: Support UID-based routing in IP protocols.	2016-11-04 14:45:23 -04:00
ipv6_sockglue.c	net: Allow IP_MULTICAST_IF to set index to L3 slave	2016-12-30 15:24:47 -05:00
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
Makefile	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
mcast_snoop.c	net: fix wrong skb_get() usage / crash in IGMP/MLD parsing code	2015-08-13 17:08:39 -07:00
mcast.c	igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()	2017-02-09 16:43:45 -05:00
mip6.c	ktime: Get rid of ktime_equal()	2016-12-25 17:21:23 +01:00
ndisc.c	ipv6 addrconf: Implemented enhanced DAD (RFC7527)	2016-12-03 23:21:37 -05:00
netfilter.c	net: inet: Support UID-based routing in IP protocols.	2016-11-04 14:45:23 -04:00
output_core.c	ipv6: Set skb->protocol properly for local output	2016-12-02 12:34:22 -05:00
ping.c	ipv6: remove unnecessary inet6_sk check	2016-12-29 12:05:49 -05:00
proc.c	proc: Reduce cache miss in snmp6_seq_show	2016-09-30 01:50:44 -04:00
protocol.c	net: Export inet_offloads and inet6_offloads	2014-09-19 17:15:31 -04:00
raw.c	net: use dst_confirm_neigh for UDP, RAW, ICMP, L2TP	2017-02-07 13:07:47 -05:00
reassembly.c	ipv6: on reassembly, record frag_max_size	2016-11-03 15:41:11 -04:00
route.c	net: route: add missing nla_policy entry for RTA_MARK attribute	2017-03-01 10:25:56 -08:00
seg6_hmac.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-07 16:29:30 -05:00
seg6_iptunnel.c	ipv6: sr: fix non static symbol warnings	2017-02-07 11:42:35 -05:00
seg6.c	ipv6: seg6_genl_set_tunsrc() must check kmemdup() return value	2017-01-20 11:07:48 -05:00
sit.c	sit: fix a double free on error path	2017-02-08 13:12:22 -05:00
syncookies.c	syncookies: use SipHash in place of SHA1	2017-01-09 13:58:57 -05:00
sysctl_net_ipv6.c	calipso: Add a label cache.	2016-06-27 15:06:17 -04:00
tcp_ipv6.c	tcp: setup timestamp offset when write_seq already set	2017-02-22 16:35:32 -05:00
tcpv6_offload.c	tcp: cleanup static functions	2015-02-28 16:56:51 -05:00
tunnel6.c	ipv6: fix tunnel error handling	2015-11-03 10:52:13 -05:00
udp_impl.h	udplite: call proper backlog handlers	2016-11-24 15:32:14 -05:00
udp_offload.c	gso: Remove arbitrary checks for unsupported GSO	2016-05-20 18:03:15 -04:00
udp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-16 19:34:01 -05:00
udplite.c	udplite: call proper backlog handlers	2016-11-24 15:32:14 -05:00
xfrm6_input.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
xfrm6_mode_beet.c	xfrm: simplify xfrm_address_t use	2015-03-31 13:58:35 -04:00
xfrm6_mode_ro.c	ipv4/ipv6: Fix FSF address in file headers	2013-12-06 12:37:56 -05:00
xfrm6_mode_transport.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
xfrm6_mode_tunnel.c	ipv6: update skb->csum when CE mark is propagated	2016-01-15 15:07:23 -05:00
xfrm6_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-24 06:54:12 -07:00
xfrm6_policy.c	xfrm: policy: make policy backend const	2017-02-09 10:22:19 +01:00
xfrm6_protocol.c	xfrm: input: constify xfrm_input_afinfo	2017-02-09 10:22:17 +01:00
xfrm6_state.c	ipv6: White-space cleansing : Line Layouts	2014-08-24 22:37:52 -07:00
xfrm6_tunnel.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00