lkml.org 
[lkml]   [2022]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 11/29] net: bonding: fix use-after-free after 802.3ad slave unbind
    Date
    From: Yevhen Orlov <yevhen.orlov@plvision.eu>

    commit 050133e1aa2cb49bb17be847d48a4431598ef562 upstream.

    commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),
    resolve case, when there is several aggregation groups in the same bond.
    bond_3ad_unbind_slave will invalidate (clear) aggregator when
    __agg_active_ports return zero. So, ad_clear_agg can be executed even, when
    num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,
    previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave
    will not update slave ports list, because lag_ports==NULL. So, here we
    got slave ports, pointing to freed aggregator memory.

    Fix with checking actual number of ports in group (as was before
    commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ),
    before ad_clear_agg().

    The KASAN logs are as follows:

    [ 767.617392] ==================================================================
    [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470
    [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767
    [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15
    [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)
    [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler
    [ 767.666468] Call trace:
    [ 767.668930] dump_backtrace+0x0/0x2d0
    [ 767.672625] show_stack+0x24/0x30
    [ 767.675965] dump_stack_lvl+0x68/0x84
    [ 767.679659] print_address_description.constprop.0+0x74/0x2b8
    [ 767.685451] kasan_report+0x1f0/0x260
    [ 767.689148] __asan_load2+0x94/0xd0
    [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470

    Fixes: 0622cab0341c ("bonding: fix 802.3ad aggregator reselection")
    Co-developed-by: Maksym Glubokiy <maksym.glubokiy@plvision.eu>
    Signed-off-by: Maksym Glubokiy <maksym.glubokiy@plvision.eu>
    Signed-off-by: Yevhen Orlov <yevhen.orlov@plvision.eu>
    Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
    Link: https://lore.kernel.org/r/20220629012914.361-1-yevhen.orlov@plvision.eu
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/bonding/bond_3ad.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/bonding/bond_3ad.c
    +++ b/drivers/net/bonding/bond_3ad.c
    @@ -2163,7 +2163,8 @@ void bond_3ad_unbind_slave(struct slave
    temp_aggregator->num_of_ports--;
    if (__agg_active_ports(temp_aggregator) == 0) {
    select_new_active_agg = temp_aggregator->is_active;
    - ad_clear_agg(temp_aggregator);
    + if (temp_aggregator->num_of_ports == 0)
    + ad_clear_agg(temp_aggregator);
    if (select_new_active_agg) {
    netdev_info(bond->dev, "Removing an active aggregator\n");
    /* select new active aggregator */

    \
     
     \ /
      Last update: 2022-07-05 14:01    [W:3.197 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site