linux

mirror of https://github.com/torvalds/linux.git synced 2024-10-22 21:20:52 +00:00

A mirror of the official Linux kernel repository just in case

Go to file

Kuniyuki Iwashima e8c526f2bd tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit `83fccfc394` ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb Fixes: `83fccfc394` ("inet: fix potential deadlock in reqsk_queue_unlink()") Reported-by: Martin KaFai Lau <martin.lau@kernel.org> Closes: https://lore.kernel.org/netdev/eb6684d0-ffd9-4bdc-9196-33f690c25824@linux.dev/ Link: https://lore.kernel.org/netdev/b55e2ca0-42f2-4b7c-b445-6ffd87ca74a0@linux.dev/ [1] Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org> Link: https://patch.msgid.link/20241014223312.4254-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2024-10-15 17:47:30 -07:00
arch	fs/proc/kcore.c: allow translation of physical memory addresses	2024-10-09 12:47:19 -07:00
block	block-6.12-20241004	2024-10-04 10:43:44 -07:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
Documentation	Including fixes from bluetooth and netfilter.	2024-10-10 12:36:35 -07:00
drivers	net: bcmasp: fix potential memory leak in bcmasp_xmit()	2024-10-15 17:10:27 -07:00
fs	for-6.12-rc2-tag	2024-10-10 10:02:59 -07:00
include	net: enetc: add missing static descriptor and inline keyword	2024-10-11 15:59:15 -07:00
init	cfi: encode cfi normalized integers + kasan/gcov bug in Kconfig	2024-09-26 21:27:27 +02:00
io_uring	io_uring/net: harden multishot termination case for recv	2024-09-30 08:26:59 -06:00
ipc	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
kernel	posix-clock: Fix missing timespec64 check in pc_clock_settime()	2024-10-14 17:22:43 -07:00
lib	slab fixes for 6.12-rc1	2024-10-04 12:05:39 -07:00
LICENSES	LICENSES: add 0BSD license text	2024-09-01 20:43:24 -07:00
mm	mm: zswap: delete comments for "value" member of 'struct zswap_entry'.	2024-10-09 12:47:19 -07:00
net	tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().	2024-10-15 17:47:30 -07:00
rust	rust: kunit: use C-string literals to clean warning	2024-10-01 23:46:42 +02:00
samples	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
scripts	kbuild: deb-pkg: Remove blank first line from maint scripts	2024-10-07 02:36:38 +09:00
security	bcachefs: do not use PF_MEMALLOC_NORECLAIM	2024-10-09 12:47:18 -07:00
sound	sound fixes for 6.12-rc2	2024-10-04 11:29:46 -07:00
tools	selftests: mptcp: join: test for prohibited MPC to port-based endp	2024-10-15 10:57:02 -07:00
usr	initramfs: shorten cmd_initfs in usr/Makefile	2024-07-16 01:07:52 +09:00
virt	x86:	2024-09-28 09:20:14 -07:00
.clang-format	clang-format: Update with v6.11-rc1's `for_each` macro list	2024-08-02 13:20:31 +02:00
.cocciconfig
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	Add Jeff Kirsher to .get_maintainer.ignore	2024-03-08 11:36:54 +00:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	Kbuild updates for v6.12	2024-09-24 13:02:06 -07:00
.mailmap	.mailmap: update Fangrui's email	2024-10-09 12:47:19 -07:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING
CREDITS	CREDITS: sort alphabetically by name	2024-10-09 12:47:19 -07:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig
MAINTAINERS	MAINTAINERS: add Andrew Lunn as a co-maintainer of all networking drivers	2024-10-14 07:49:41 -07:00
Makefile	Linux 6.12-rc2	2024-10-06 15:32:27 -07:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.