kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/net/tipc
History
Doruk Tan Ozturk bda3348872 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done 
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
crypto_aead_decrypt(req) without taking a reference on the netns, unlike
the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the
meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
per-netns tipc_crypto, and the completion then reads it:
tipc_aead_decrypt_done() dereferences aead->crypto->stats and
aead->crypto->net, and tipc_crypto_rcv_complete() dereferences
aead->crypto->aead[] and the node table -- reading freed memory.

Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):

  BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)
  Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51
  Workqueue: events_unbound
  Call Trace:
   tipc_aead_decrypt_done (net/tipc/crypto.c:999)
   process_one_work (kernel/workqueue.c:3314)
   worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

  Allocated by task 169:
   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
   tipc_crypto_start (net/tipc/crypto.c:1502)
   tipc_init_net (net/tipc/core.c:72)
   ops_init (net/core/net_namespace.c:137)
   setup_net (net/core/net_namespace.c:446)
   copy_net_ns (net/core/net_namespace.c:579)
   create_new_namespaces (kernel/nsproxy.c:132)
   __x64_sys_unshare (kernel/fork.c:3316)
   do_syscall_64 (arch/x86/entry/syscall_64.c:63)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

  Freed by task 8:
   kfree (mm/slub.c:6566)
   tipc_exit_net (net/tipc/core.c:119)
   cleanup_net (net/core/net_namespace.c:704)
   process_one_work (kernel/workqueue.c:3314)
   kthread (kernel/kthread.c:436)

This is the same class of bug that commit e279024617 ("net/tipc: fix
slab-use-after-free Read in tipc_aead_encrypt_done") fixed for the encrypt
side. The encrypt path takes maybe_get_net(aead->crypto->net) before
crypto_aead_encrypt() and drops it with put_net() on the synchronous
return paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY
return keeps the reference for the async callback to release. The decrypt
path was left without the equivalent guard.

Mirror the encrypt-side fix on the decrypt path: take a net reference
before crypto_aead_decrypt() (failing with -ENODEV and the matching
bearer put if it cannot be acquired), keep it across the
-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the
synchronous success/error return and at the end of
tipc_aead_decrypt_done().

Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is
flooded with crafted encrypted frames from an unknown peer (driving the
cluster-key decrypt path) while the bearer's netns is repeatedly torn
down. The completion must run asynchronously to outlive
tipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts
synchronously, so the async path was exercised via cryptd offload. The
unguarded aead->crypto dereference in tipc_aead_decrypt_done() is the
unpatched upstream path; tipc_aead_decrypt() still lacks
maybe_get_net(aead->crypto->net), so the completion can outlive the free
on any config where crypto_aead_decrypt() goes async.

Found by 0sec automated security-research tooling (https://0sec.ai).

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Cc: stable@vger.kernel.org
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260617075818.37431-1-doruk@0sec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
History 2026-06-18 18:35:35 -07:00
..
addr.c tipc: adjust tipc_nodeid2string() to return string length 2025-09-30 11:22:39 +02:00
addr.h tipc: adjust tipc_nodeid2string() to return string length 2025-09-30 11:22:39 +02:00
bcast.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c tipc: fix UAF in tipc_l2_send_msg() 2026-06-15 12:50:29 -07:00
bearer.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-17 11:39:10 +01:00
core.h kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
crypto.c tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done 2026-06-18 18:35:35 -07:00
crypto.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
diag.c sock_diag: add module pointer to "struct sock_diag_handler" 2024-01-23 15:13:54 +01:00
discover.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
discover.h tipc: some cleanups in the file discover.c 2018-03-23 13:12:17 -04:00
eth_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
group.c tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG 2026-04-03 15:31:17 -07:00
group.h tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
ib_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
link.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
link.h tipc: Remove unused declaration tipc_link_build_bc_sync_msg() 2023-08-09 13:03:14 -07:00
Makefile tipc: rename the module name diag to tipc_diag 2024-02-06 13:47:36 +01:00
monitor.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c tipc: fix double-free in tipc_buf_append() 2026-04-23 11:45:01 -07:00
msg.h net: tipc: remove unused static inlines 2022-01-27 13:53:27 +00:00
name_distr.c tipc: reject inverted service ranges from peer bindings 2026-06-11 16:01:16 -07:00
name_distr.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
name_table.c Including fixes from IPsec, Bluetooth and netfilter 2026-02-26 08:00:13 -08:00
name_table.h net: tipc: remove one synchronize_net() from tipc_nametbl_stop() 2024-12-06 17:41:28 -08:00
net.c tipc: Fix use-after-free in tipc_mon_reinit_self(). 2025-11-10 18:14:40 -08:00
net.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
netlink.c tipc: require net admin for TIPCv2 netlink mutators 2026-06-11 16:01:16 -07:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
netlink_compat.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
node.c net: use get_random_u{16,32,64}() where appropriate 2026-04-09 19:27:43 -07:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
socket.h tipc: add stricter control of reserved service types 2020-10-30 08:19:18 -07:00
subscr.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
topsrv.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
trace.c net/tipc: fix various kernel-doc warnings 2020-12-01 15:37:46 -08:00
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
udp_media.c tipc: Store struct sock in struct udp_bearer. 2026-05-05 17:47:06 -07:00
udp_media.h tipc: implement configuration of UDP media MTU 2018-04-20 11:04:05 -04:00