| Message ID | 20241024014701.2086286-1-dongchenchen2@huawei.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v2] net: netfilter: Fix use-after-free in get_info() | expand |
Dong Chenchen <dongchenchen2@huawei.com> wrote: > While xt_table module was going away and has been removed from > xt_templates list, we couldnt get refcnt of xt_table->me. Check > module in xt_net->tables list re-traversal to fix it. > > Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") > Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> > --- > net/netfilter/x_tables.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c > index da5d929c7c85..709840612f0d 100644 > --- a/net/netfilter/x_tables.c > +++ b/net/netfilter/x_tables.c > @@ -1269,7 +1269,7 @@ struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af, > > /* and once again: */ > list_for_each_entry(t, &xt_net->tables[af], list) > - if (strcmp(t->name, name) == 0) > + if (strcmp(t->name, name) == 0 && owner == t->me) > return t; LGTM, thanks. Reviewed-by: Florian Westphal <fw@strlen.de>
On Thu, Oct 24, 2024 at 09:47:01AM +0800, Dong Chenchen wrote: > ip6table_nat module unload has refcnt warning for UAF. call trace is: > > WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 > Modules linked in: ip6table_nat(-) > CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), > BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 > RIP: 0010:module_put+0x6f/0x80 > Call Trace: > <TASK> > get_info+0x128/0x180 > do_ip6t_get_ctl+0x6a/0x430 > nf_getsockopt+0x46/0x80 > ipv6_getsockopt+0xb9/0x100 > rawv6_getsockopt+0x42/0x190 > do_sock_getsockopt+0xaa/0x180 > __sys_getsockopt+0x70/0xc0 > __x64_sys_getsockopt+0x20/0x30 > do_syscall_64+0xa2/0x1a0 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Concurrent execution of module unload and get_info() trigered the warning. > The root cause is as follows: > > cpu0 cpu1 > module_exit > //mod->state = MODULE_STATE_GOING > ip6table_nat_exit > xt_unregister_template > kfree(t) > //removed from templ_list > getinfo() > t = xt_find_table_lock > list_for_each_entry(tmpl, &xt_templates[af]...) > if (strcmp(tmpl->name, name)) > continue; //table not found > try_module_get > list_for_each_entry(t, &xt_net->tables[af]...) > return t; //not get refcnt > module_put(t->me) //uaf > unregister_pernet_subsys > //remove table from xt_net list > > While xt_table module was going away and has been removed from > xt_templates list, we couldnt get refcnt of xt_table->me. Check > module in xt_net->tables list re-traversal to fix it. Applied, thanks
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index da5d929c7c85..709840612f0d 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -1269,7 +1269,7 @@ struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af, /* and once again: */ list_for_each_entry(t, &xt_net->tables[af], list) - if (strcmp(t->name, name) == 0) + if (strcmp(t->name, name) == 0 && owner == t->me) return t; module_put(owner);
ip6table_nat module unload has refcnt warning for UAF. call trace is: WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Modules linked in: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Call Trace: <TASK> get_info+0x128/0x180 do_ip6t_get_ctl+0x6a/0x430 nf_getsockopt+0x46/0x80 ipv6_getsockopt+0xb9/0x100 rawv6_getsockopt+0x42/0x190 do_sock_getsockopt+0xaa/0x180 __sys_getsockopt+0x70/0xc0 __x64_sys_getsockopt+0x20/0x30 do_syscall_64+0xa2/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows: cpu0 cpu1 module_exit //mod->state = MODULE_STATE_GOING ip6table_nat_exit xt_unregister_template kfree(t) //removed from templ_list getinfo() t = xt_find_table_lock list_for_each_entry(tmpl, &xt_templates[af]...) if (strcmp(tmpl->name, name)) continue; //table not found try_module_get list_for_each_entry(t, &xt_net->tables[af]...) return t; //not get refcnt module_put(t->me) //uaf unregister_pernet_subsys //remove table from xt_net list While xt_table module was going away and has been removed from xt_templates list, we couldnt get refcnt of xt_table->me. Check module in xt_net->tables list re-traversal to fix it. Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> --- net/netfilter/x_tables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)