• WANG Cong's avatar
    packet: fix use-after-free in prb_retire_rx_blk_timer_expired() · c800aaf8
    WANG Cong authored
    There are multiple reports showing we have a use-after-free in
    the timer prb_retire_rx_blk_timer_expired(), where we use struct
    tpacket_kbdq_core::pkbdq, a pg_vec, after it gets freed by
    free_pg_vec().
    
    The interesting part is it is not freed via packet_release() but
    via packet_setsockopt(), which means we are not closing the socket.
    Looking into the big and fat function packet_set_ring(), this could
    happen if we satisfy the following conditions:
    
    1. closing == 0, not on packet_release() path
    2. req->tp_block_nr == 0, we don't allocate a new pg_vec
    3. rx_ring->pg_vec is already set as V3, which means we already called
       packet_set_ring() wtih req->tp_block_nr > 0 previously
    4. req->tp_frame_nr == 0, pass sanity check
    5. po->mapped == 0, never called mmap()
    
    In this scenario we are clearing the old rx_ring->pg_vec, so we need
    to free this pg_vec, but we don't stop the timer on this path because
    of closing==0.
    
    The timer has to be stopped as long as we need to free pg_vec, therefore
    the check on closing!=0 is wrong, we should check pg_vec!=NULL instead.
    
    Thanks to liujian for testing different fixes.
    
    Reported-by: alexander.levin@verizon.com
    Reported-by: default avatarDave Jones <davej@codemonkey.org.uk>
    Reported-by: default avatarliujian (CE) <liujian56@huawei.com>
    Tested-by: default avatarliujian (CE) <liujian56@huawei.com>
    Cc: Ding Tianhong <dingtianhong@huawei.com>
    Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
    Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c800aaf8
af_packet.c 107 KB