lkml.org 
[lkml]   [2021]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 40/95] can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
    Date
    From: Ziyang Xuan <william.xuanziyang@huawei.com>

    commit d9d52a3ebd284882f5562c88e55991add5d01586 upstream.

    It will trigger UAF for rx_kref of j1939_priv as following.

    cpu0 cpu1
    j1939_sk_bind(socket0, ndev0, ...)
    j1939_netdev_start
    j1939_sk_bind(socket1, ndev0, ...)
    j1939_netdev_start
    j1939_priv_set
    j1939_priv_get_by_ndev_locked
    j1939_jsk_add
    .....
    j1939_netdev_stop
    kref_put_lock(&priv->rx_kref, ...)
    kref_get(&priv->rx_kref, ...)
    REFCOUNT_WARN("addition on 0;...")

    ====================================================
    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
    RIP: 0010:refcount_warn_saturate+0x169/0x1e0
    Call Trace:
    j1939_netdev_start+0x68b/0x920
    j1939_sk_bind+0x426/0xeb0
    ? security_socket_bind+0x83/0xb0

    The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
    protect.

    Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
    Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/can/j1939/main.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/net/can/j1939/main.c
    +++ b/net/can/j1939/main.c
    @@ -249,11 +249,14 @@ struct j1939_priv *j1939_netdev_start(st
    struct j1939_priv *priv, *priv_new;
    int ret;

    - priv = j1939_priv_get_by_ndev(ndev);
    + spin_lock(&j1939_netdev_lock);
    + priv = j1939_priv_get_by_ndev_locked(ndev);
    if (priv) {
    kref_get(&priv->rx_kref);
    + spin_unlock(&j1939_netdev_lock);
    return priv;
    }
    + spin_unlock(&j1939_netdev_lock);

    priv = j1939_priv_create(ndev);
    if (!priv)
    @@ -269,10 +272,10 @@ struct j1939_priv *j1939_netdev_start(st
    /* Someone was faster than us, use their priv and roll
    * back our's.
    */
    + kref_get(&priv_new->rx_kref);
    spin_unlock(&j1939_netdev_lock);
    dev_put(ndev);
    kfree(priv);
    - kref_get(&priv_new->rx_kref);
    return priv_new;
    }
    j1939_priv_set(ndev, priv);

    \
     
     \ /
      Last update: 2021-10-25 21:40    [W:4.148 / U:0.352 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site