kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Jamal Hadi Salim 389d03992d net/sched: act_tunnel_key: Defer dst_release to RCU callback 
[ Upstream commit f1f5c8a395 ]

Fix a race-condition use-after-free in tunnel_key_release_params().

The function releases the metadata_dst of the old params synchronously
via dst_release() while deferring the params struct free with
kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
still hold the old params pointer (under rcu_read_lock_bh) and proceed
to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's
dst_release has already pushed the dst's rcuref to RCUREF_DEAD.

zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified
that KASAN reports:

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112
BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326
BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109
BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173
BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168
Write of size 4 at addr ffff88806158de40 by task poc/9388

CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G        W           7.1.0-rc7 #7 PREEMPT(lazy)
Tainted: [W]=WARN
Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378
 print_report+0x139/0x4ad mm/kasan/report.c:482
 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186
 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200
 instrument_atomic_read_write include/linux/instrumented.h:112
 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326
 __rcuref_put include/linux/rcuref.h:109
 rcuref_put include/linux/rcuref.h:173
 dst_release+0x5b/0x370 net/core/dst.c:168
 refdst_drop include/net/dst.h:272
 skb_dst_drop include/net/dst.h:284
 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163
 skb_release_all net/core/skbuff.c:1187
[..]
Allocated by task 9391:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398
 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263
 __do_kmalloc_node mm/slub.c:5296
 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308
 kmalloc_noprof include/linux/slab.h:954
 kzalloc_noprof include/linux/slab.h:1188
 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35
 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258
 tcf_action_offload_add net/sched/act_api.c:293
 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547
 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
[..]
Freed by task 9391:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253
 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235
 slab_free_hook mm/slub.c:2689
 slab_free mm/slub.c:6251
 kfree+0x21f/0x6b0 mm/slub.c:6566
 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284
 tcf_action_offload_add net/sched/act_api.c:293
 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547
 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101

The buggy address belongs to the object at ffff88806158de00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 64 bytes inside of
 freed 256-byte region [ffff88806158de00, ffff88806158df00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190
raw: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190
head: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9391, tgid 9378 (poc), ts 123227323196, free_ts 0
 set_page_owner include/linux/page_owner.h:32
 post_alloc_hook+0xfe/0x140 mm/page_alloc.c:1853
 prep_new_page mm/page_alloc.c:1861
 get_page_from_freelist+0x110c/0x2fc0 mm/page_alloc.c:3941
 __alloc_frozen_pages_noprof+0x263/0x2bc0 mm/page_alloc.c:5221
 alloc_slab_page mm/slub.c:3278
 allocate_slab mm/slub.c:3467
 new_slab+0xa6/0x690 mm/slub.c:3525
 refill_objects+0x271/0x420 mm/slub.c:7272
 refill_sheaf mm/slub.c:2816
 __pcs_replace_empty_main+0x373/0x630 mm/slub.c:4652
 alloc_from_pcs mm/slub.c:4750
 slab_alloc_node mm/slub.c:4884
 __do_kmalloc_node mm/slub.c:5295
 __kmalloc_noprof+0x66d/0x830 mm/slub.c:5308
 kmalloc_noprof include/linux/slab.h:954
 metadata_dst_alloc+0x26/0x90 net/core/dst.c:298
 tun_rx_dst include/net/dst_metadata.h:144
 __ip_tun_set_dst include/net/dst_metadata.h:208
 tunnel_key_init+0xb01/0x1b90 net/sched/act_tunnel_key.c:451
 tcf_action_init_1+0x46b/0x6c0 net/sched/act_api.c:1428
 tcf_action_init+0x448/0xa20 net/sched/act_api.c:1503
 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
[..]
==================================================================

Fix by moving dst_release() into a custom RCU callback that runs
after the grace period, matching the lifetime of the containing
params struct.  Readers in the datapath therefore always find a live
rcuref when calling dst_clone().

Fixes: 9174c3df1c ("net/sched: act_tunnel_key: fix memory leak in case of action replace")
Reported-by: zdi-disclosures@trendmicro.com
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/20260711150537.7946-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-19 17:13:54 +02:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-07-24 15:51:20 +02:00
9p net/9p: fix infinite loop in p9_client_rpc on fatal signal 2026-07-24 15:51:50 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: reject out-of-range traffic classes in QoS validation 2026-07-24 15:51:46 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: clean untagged VLAN on netdev registration failure 2026-07-24 15:51:53 +02:00
bluetooth Bluetooth: L2CAP: Fix regressions caused by reusing ident 2026-07-24 15:52:02 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge netfilter: ebtables: zero chainstack array 2026-07-24 15:51:58 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: j1939: fix lockless local-destination check 2026-08-19 17:13:54 +02:00
ceph use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
core rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths 2026-07-24 15:51:27 +02:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: defer node table free until after RCU readers 2026-06-19 13:33:46 +02:00
ieee802154 ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 2026-07-24 15:51:53 +02:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-07-24 15:51:46 +02:00
ipv4 ipv4: fib: free fib_alias with kfree_rcu() on insert error path 2026-08-19 17:13:53 +02:00
ipv6 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 2026-07-24 15:51:53 +02:00
iucv net/iucv: take a reference on the socket found in afiucv_hs_rcv() 2026-08-19 17:13:53 +02:00
kcm kcm: use WRITE_ONCE() when changing lower socket callbacks 2026-07-24 15:51:36 +02:00
key net: af_key: initialize alg_key_len for IPComp states 2026-07-24 15:51:21 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-24 15:51:55 +02:00
mac80211 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock 2026-08-19 17:13:53 +02:00
mac802154 mac802154: remove interfaces with RCU list deletion 2026-07-24 15:51:54 +02:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU 2026-07-24 15:51:42 +02:00
mptcp mptcp: fix missing wakeups in edge scenarios 2026-07-04 13:39:40 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter audit: add audit_log_nf_skb helper function 2026-07-24 15:52:02 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: llcp: protect nfc_llcp_sock_unlink() calls 2026-07-24 15:51:15 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: reject oversized nested action attrs 2026-07-24 15:51:55 +02:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-06-19 13:33:40 +02:00
phonet net: phonet: free phonet_device after RCU grace period 2026-07-04 13:39:41 +02:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-07-24 15:51:39 +02:00
qrtr net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 2026-07-24 15:51:46 +02:00
rds net: rds: clear i_sends on setup unwind 2026-06-19 13:33:38 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-06-01 17:35:12 +02:00
sched net/sched: act_tunnel_key: Defer dst_release to RCU callback 2026-08-19 17:13:54 +02:00
sctp sctp: validate STALE_COOKIE cause length before reading staleness 2026-07-24 15:51:51 +02:00
smc net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 2026-07-24 15:51:44 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc xprtrdma: Fix bcall rep leak and unbounded peek 2026-07-24 15:51:38 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix UAF in tipc_l2_send_msg() 2026-07-24 15:51:36 +02:00
tls net: skmsg: preserve sg.copy across SG transforms 2026-07-24 15:51:16 +02:00
unix af_unix: Reject SIOCATMARK on non-stream sockets 2026-07-04 13:39:37 +02:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-19 13:33:37 +02:00
wireless wifi: cfg80211: bound element ID read when checking non-inheritance 2026-08-19 17:13:53 +02:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-18 10:33:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert 2026-08-19 17:13:52 +02:00
compat.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Drop the lock in skb_may_tx_timestamp() 2026-07-24 15:51:21 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00