rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record (9ebeddef) · Commits · 戴 / test

The rxrpc_peer record needs to hold a reference on the rxrpc_local record it points as the peer is used as a base to access information in the rxrpc_local record. This can cause problems in __rxrpc_put_peer(), where we need the network namespace pointer, and in rxrpc_send_keepalive(), where we need to access the UDP socket, leading to symptoms like: BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411 [inline] BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0 net/rxrpc/peer_object.c:435 Read of size 8 at addr ffff888097ec0058 by task syz-executor823/24216 Fix this by taking a ref on the local record for the peer record. Fixes: ("rxrpc: Fix firewall route keepalive") Fixes: ("rxrpc: Support network namespacing") Reported-by:

<syzbot+b9be979c55f2bea8ed30@syzkaller.appspotmail.com> Signed-off-by:

David Howells <dhowells@redhat.com>

net/rxrpc/peer_object.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -216,7 +216,7 @@ struct rxrpc_peer rxrpc_alloc_peer(struct rxrpc_local local, gfp_t gfp)
		peer = kzalloc(sizeof(struct rxrpc_peer), gfp);
		if (peer) {
		atomic_set(&peer->usage, 1);
		peer->local = local;
		peer->local = rxrpc_get_local(local);
		INIT_HLIST_HEAD(&peer->error_targets);
		peer->service_conns = RB_ROOT;
		seqlock_init(&peer->service_conn_lock);
		@@ -307,7 +307,6 @@ void rxrpc_new_incoming_peer(struct rxrpc_sock rx, struct rxrpc_local local,
		unsigned long hash_key;

		hash_key = rxrpc_peer_hash_key(local, &peer->srx);
		peer->local = local;
		rxrpc_init_peer(rx, peer, hash_key);

		spin_lock(&rxnet->peer_hash_lock);
		@@ -417,6 +416,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
		list_del_init(&peer->keepalive_link);
		spin_unlock_bh(&rxnet->peer_hash_lock);

		rxrpc_put_local(peer->local);
		kfree_rcu(peer, rcu);
		}

		@@ -453,6 +453,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
		if (n == 0) {
		hash_del_rcu(&peer->hash_link);
		list_del_init(&peer->keepalive_link);
		rxrpc_put_local(peer->local);
		kfree_rcu(peer, rcu);
		}
		}

Admin message