syzkaller: WARNING in `inet_csk_listen_stop` #371

cpaasch · 2023-03-13T04:51:40Z

HEAD: 778e547

syzkaller-id: 476b97a3ddd5841a107493bdeaba02eec9f13a19

Trace:

RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387
RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9
RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004
Modules linked in:
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c
R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40

 </TASK>
CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387
Code: 89 f7 e8 bf 36 9d ff e9 75 fb ff ff e8 65 b4 57 ff 48 8b 7c 24 08 be 03 00 00 00 e8 a6 36 9d ff e9 cd fb ff ff e8 4c b4 57 ff <0f> 0b e9 3e fa ff ff e8 40 b4 57 ff 48 8b 7c 24 08 be 02 00 00 00
RSP: 0018:ffffc90001a83c88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000
RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005
RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040
R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8
FS:  00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875
 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427
 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277
 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304
 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965
 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057
 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072
 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429
 __sock_release+0x4e/0xf0 net/socket.c:651
 sock_close+0x15/0x20 net/socket.c:1393
 __fput+0xff/0x420 fs/file_table.c:321
 task_work_run+0x8b/0xe0 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296
 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f7850af70dc
Code: 15 51 9d 0d 00 f7 d8 64 89 02 48 83 c8 ff c3 48 83 ec 18 89 7c 24 08 e8 10 2f fa ff 8b 7c 24 08 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 1d 9d 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00000000007dfb80 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc
RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0
R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31
R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0
 </TASK>

Kconfig:
Kconfig_k8_kmemleak.txt

The text was updated successfully, but these errors were encountered:

cpaasch · 2023-03-20T16:29:07Z

Reproducer on k5:

kconfig:
Kconfig_k5_lockdep.txt

syz-repro:

# {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false UseTmpDir:false HandleSegv:false Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @empty}, 0x10)
listen(r0, 0x0)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
sendmsg$inet(r1, &(0x7f0000000440)={&(0x7f00000000c0)={0x2, 0x4e24, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0xc0}, 0x30000004)
accept4(r0, 0x0, 0x0, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002300), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x28, r3, 0x91, 0x0, 0x0, {0x2}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x28}}, 0x0)

C-repro attached:
repro.c.txt

cpaasch · 2023-03-20T18:01:19Z

Bisected down to 3a236ae

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 torvalds#7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Christoph Paasch <cpaasch@apple.com>

cpaasch · 2023-03-27T16:07:14Z

With the above patch and the reproducer I get:

[   20.724234] ------------[ cut here ]------------
[   20.724653] MPTCP: addr_signal error, rm_addr=4
[   20.725070] refcount_t: addition on 0; use-after-free.
[   20.725662] MPTCP: addr_signal error, rm_addr=4
[   20.726104] WARNING: CPU: 1 PID: 6842 at lib/refcount.c:25 refcount_warn_saturate+0x105/0x1b0
[   20.726736] MPTCP: addr_signal error, rm_addr=4
[   20.727049] Modules linked in:
[   20.728008] MPTCP: addr_signal error, rm_addr=4
[   20.728407]
[   20.728805] MPTCP: addr_signal error, rm_addr=4
[   20.729232] CPU: 1 PID: 6842 Comm: repro Not tainted 6.3.0-rc3-g43848b6484d9 #152
[   20.729244] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[   20.731605] RIP: 0010:refcount_warn_saturate+0x105/0x1b0
[   20.732173] Code: 02 31 ff 89 de e8 7b a9 a8 ff 84 db 0f 85 6e ff ff ff e8 9e ae a8 ff 48 c7 c7 a0 3f 34 83 c6 05 bf 0d 10 02 01 e8 9b 1c 91 ff <0f> 0b e9 4f ff ff ff e8 7f ae a8 ff 0f b6 1d a6 0d 10 02 31 ff 89
[   20.734041] RSP: 0018:ffffc90002d2fbf8 EFLAGS: 00010282
[   20.734609] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   20.735354] RDX: ffff888008883180 RSI: ffffffff81096b5f RDI: 0000000000000001
[   20.736095] RBP: ffff888008b8e380 R08: 0000000000000001 R09: 0000000000000000
[   20.736892] R10: 0000000000000001 R11: ffff888008883a08 R12: ffff888008b8e300
[   20.737694] R13: ffff888008b8ec88 R14: ffff888007783af8 R15: ffff888008b8ec88
[   20.738440] FS:  0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000
[   20.739282] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   20.739887] CR2: 00007f36aefa20b2 CR3: 0000000003647004 CR4: 0000000000170ee0
[   20.740640] Call Trace:
[   20.740914]  <TASK>
[   20.741151]  __mptcp_close+0x4c6/0x4d0
[   20.741571]  mptcp_close+0x24/0xe0
[   20.741964]  inet_release+0x56/0xa0
[   20.742354]  __sock_release+0x51/0xf0
[   20.742764]  ? __pfx_sock_close+0x10/0x10
[   20.743205]  sock_close+0x18/0x20
[   20.743568]  __fput+0x113/0x430
[   20.743936]  task_work_run+0x96/0x100
[   20.744340]  do_exit+0x4fc/0x1010
[   20.744722]  do_group_exit+0x51/0xf0
[   20.745118]  get_signal+0x1495/0x1570
[   20.745529]  ? __call_rcu_common.constprop.0+0x17f/0x3d0
[   20.746102]  arch_do_signal_or_restart+0x25/0x260
[   20.746627]  exit_to_user_mode_prepare+0x131/0x1a0
[   20.747138]  syscall_exit_to_user_mode+0x19/0x40
[   20.747652]  do_syscall_64+0x46/0x90
[   20.748046]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[   20.748599] RIP: 0033:0x7f36af0a1e79
[   20.748990] Code: Unable to access opcode bytes at 0x7f36af0a1e4f.
[   20.749644] RSP: 002b:00007f36aef9fe08 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   20.750425] RAX: 0000000000000001 RBX: 00007f36aefa0640 RCX: 00007f36af0a1e79
[   20.751205] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000006031ac
[   20.751968] RBP: 00007f36aef9fe20 R08: 0000000000000000 R09: 0000000000000000
[   20.752717] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36aefa0640
[   20.753452] R13: 0000000000000000 R14: 00007f36af029600 R15: 00007f36aef80000
[   20.754201]  </TASK>
[   20.754446] irq event stamp: 1907
[   20.754816] hardirqs last  enabled at (1919): [<ffffffff811365f6>] __up_console_sem+0x76/0x80
[   20.755711] hardirqs last disabled at (1930): [<ffffffff811365db>] __up_console_sem+0x5b/0x80
[   20.756628] softirqs last  enabled at (1772): [<ffffffff810a4a4e>] irq_exit_rcu+0xbe/0x130
[   20.757502] softirqs last disabled at (1767): [<ffffffff810a4a4e>] irq_exit_rcu+0xbe/0x130
[   20.758362] ---[ end trace 0000000000000000 ]---
[   20.759611] ------------[ cut here ]------------
[   20.760134] refcount_t: underflow; use-after-free.
[   20.760735] WARNING: CPU: 0 PID: 6842 at lib/refcount.c:28 refcount_warn_saturate+0x141/0x1b0
[   20.761639] Modules linked in:
[   20.761978] CPU: 0 PID: 6842 Comm: repro Tainted: G        W          6.3.0-rc3-g43848b6484d9 #152
[   20.762922] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[   20.763822] RIP: 0010:refcount_warn_saturate+0x141/0x1b0
[   20.764405] Code: 02 31 ff 89 de e8 3f a9 a8 ff 84 db 0f 85 32 ff ff ff e8 62 ae a8 ff 48 c7 c7 d0 3f 34 83 c6 05 82 0d 10 02 01 e8 5f 1c 91 ff <0f> 0b e9 13 ff ff ff e8 43 ae a8 ff 0f b6 1d 68 0d 10 02 31 ff 89
[   20.766300] RSP: 0018:ffffc90002d2fbd8 EFLAGS: 00010282
[   20.766858] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   20.767605] RDX: ffff888008883180 RSI: ffffffff81096b5f RDI: 0000000000000001
[   20.768345] RBP: ffff888008b8e380 R08: 0000000000000001 R09: 0000000000000000
[   20.769080] R10: 0000000000000001 R11: ffff888008883a08 R12: ffff888008b8e380
[   20.769829] R13: ffff888008b8ec88 R14: ffff888007783af8 R15: ffff888008b8ec88
[   20.770568] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[   20.771416] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   20.772022] CR2: 00007ffde6ff9ee8 CR3: 00000000084fb006 CR4: 0000000000170ef0
[   20.772771] Call Trace:
[   20.773043]  <TASK>
[   20.773287]  __mptcp_destroy_sock+0x158/0x1c0
[   20.773769]  __mptcp_close+0x3c8/0x4d0
[   20.774186]  mptcp_close+0x24/0xe0
[   20.774554]  inet_release+0x56/0xa0
[   20.774948]  __sock_release+0x51/0xf0
[   20.775355]  ? __pfx_sock_close+0x10/0x10
[   20.775796]  sock_close+0x18/0x20
[   20.776166]  __fput+0x113/0x430
[   20.776519]  task_work_run+0x96/0x100
[   20.776928]  do_exit+0x4fc/0x1010
[   20.777321]  do_group_exit+0x51/0xf0
[   20.777759]  get_signal+0x1495/0x1570
[   20.778164]  ? __call_rcu_common.constprop.0+0x17f/0x3d0
[   20.778738]  arch_do_signal_or_restart+0x25/0x260
[   20.779252]  exit_to_user_mode_prepare+0x131/0x1a0
[   20.779772]  syscall_exit_to_user_mode+0x19/0x40
[   20.780270]  do_syscall_64+0x46/0x90
[   20.780671]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[   20.781217] RIP: 0033:0x7f36af0a1e79
[   20.781612] Code: Unable to access opcode bytes at 0x7f36af0a1e4f.
[   20.782257] RSP: 002b:00007f36aef9fe08 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   20.783039] RAX: 0000000000000001 RBX: 00007f36aefa0640 RCX: 00007f36af0a1e79
[   20.783793] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000006031ac
[   20.784532] RBP: 00007f36aef9fe20 R08: 0000000000000000 R09: 0000000000000000
[   20.785278] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36aefa0640
[   20.786016] R13: 0000000000000000 R14: 00007f36af029600 R15: 00007f36aef80000
[   20.786772]  </TASK>
[   20.787019] irq event stamp: 2561
[   20.787379] hardirqs last  enabled at (2571): [<ffffffff811365f6>] __up_console_sem+0x76/0x80
[   20.788268] hardirqs last disabled at (2582): [<ffffffff811365db>] __up_console_sem+0x5b/0x80
[   20.789150] softirqs last  enabled at (2088): [<ffffffff810a4a4e>] irq_exit_rcu+0xbe/0x130
[   20.790008] softirqs last disabled at (2073): [<ffffffff810a4a4e>] irq_exit_rcu+0xbe/0x130
[   20.790869] ---[ end trace 0000000000000000 ]---
[   20.791408]
[   20.791607] ======================================================
[   20.792235] WARNING: possible circular locking dependency detected
[   20.792856] 6.3.0-rc3-g43848b6484d9 #152 Tainted: G        W
[   20.793512] ------------------------------------------------------
[   20.794135] repro/6842 is trying to acquire lock:
[   20.794623] ffff888008b8ebf8 ((work_completion)(&msk->work)){+.+.}-{0:0}, at: __flush_work+0x6e/0x7e0
[   20.795567]
[   20.795567] but task is already holding lock:
[   20.796160] ffff888008b8e430 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x19/0xe0
[   20.796964]
[   20.796964] which lock already depends on the new lock.
[   20.796964]
[   20.797789]
[   20.797789] the existing dependency chain (in reverse order) is:
[   20.798546]
[   20.798546] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}:
[   20.799175]        lock_sock_nested+0x34/0xa0
[   20.799638]        mptcp_worker+0x27/0x830
[   20.800066]        process_one_work+0x3bd/0x800
[   20.800547]        worker_thread+0x5b/0x610
[   20.800983]        kthread+0x138/0x170
[   20.801389]        ret_from_fork+0x2c/0x50
[   20.801865]
[   20.801865] -> #0 ((work_completion)(&msk->work)){+.+.}-{0:0}:
[   20.802613]        __lock_acquire+0x16fc/0x2830
[   20.803087]        lock_acquire+0xc7/0x2b0
[   20.803524]        __flush_work+0x9a/0x7e0
[   20.803952]        __cancel_work_timer+0x1cb/0x290
[   20.804456]        mptcp_cancel_work+0x18/0x70
[   20.804920]        mptcp_close+0xa0/0xe0
[   20.805336]        inet_release+0x56/0xa0
[   20.805756]        __sock_release+0x51/0xf0
[   20.806241]        sock_close+0x18/0x20
[   20.806740]        __fput+0x113/0x430
[   20.807191]        task_work_run+0x96/0x100
[   20.807655]        do_exit+0x4fc/0x1010
[   20.808058]        do_group_exit+0x51/0xf0
[   20.808497]        get_signal+0x1495/0x1570
[   20.808933]        arch_do_signal_or_restart+0x25/0x260
[   20.809485]        exit_to_user_mode_prepare+0x131/0x1a0
[   20.810037]        syscall_exit_to_user_mode+0x19/0x40
[   20.810575]        do_syscall_64+0x46/0x90
[   20.811004]        entry_SYSCALL_64_after_hwframe+0x72/0xdc
[   20.811580]
[   20.811580] other info that might help us debug this:
[   20.811580]
[   20.812384]  Possible unsafe locking scenario:
[   20.812384]
[   20.812925] MPTCP: addr_signal error, rm_addr=4
[   20.812977]        CPU0                    CPU1
[   20.812979]        ----                    ----
[   20.812981]   lock(sk_lock-AF_INET
[   20.813541] MPTCP: addr_signal error, rm_addr=4
[   20.813938] );
[   20.813940]                                lock((work_completion)(&msk->work));
[   20.813946]                                lock(sk_lock-AF_INET);
[   20.815535] MPTCP: addr_signal error, rm_addr=4
[   20.816202]   lock((work_completion)(&msk->work));
[   20.816208]
[   20.816208]  *** DEADLOCK ***
[   20.816208]
[   20.816210] 2 locks held by repro/6842:
[   20.816215]  #0: ffff8880077e1288 (
[   20.816877] MPTCP: addr_signal error, rm_addr=4
[   20.817310] &sb->s_type->i_mutex_key
[   20.818145] MPTCP: addr_signal error, rm_addr=4
[   20.818403] #7){+.+.}-{3:3}
[   20.818844] MPTCP: addr_signal error, rm_addr=4
[   20.819182] , at: __sock_release+0x41/0xf0
[   20.819194]  #1:
[   20.819970] MPTCP: addr_signal error, rm_addr=4
[   20.820030] ffff888008b8e430
[   20.820538] MPTCP: addr_signal error, rm_addr=4
[   20.820805]  (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x19/0xe0
[   20.820822]
[   20.820822] stack backtrace:
[   20.820827] CPU: 0 PID: 6842 Comm: repro Tainted: G        W          6.3.0-rc3-g43848b6484d9 #152
[   20.821697] MPTCP: addr_signal error, rm_addr=4
[   20.821763] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[   20.822009] MPTCP: addr_signal error, rm_addr=4
[   20.822456] Call Trace:
[   20.822459]  <TASK>
[   20.822462]  dump_stack_lvl+0x8d/0xe0
[   20.828059]  check_noncircular+0x102/0x120
[   20.828503]  ? tick_nohz_tick_stopped+0x12/0x30
[   20.828981]  __lock_acquire+0x16fc/0x2830
[   20.829463]  lock_acquire+0xc7/0x2b0
[   20.829845]  ? __flush_work+0x6e/0x7e0
[   20.830252]  ? __warn+0xf8/0x210
[   20.830598]  ? refcount_warn_saturate+0x141/0x1b0
[   20.831089]  __flush_work+0x9a/0x7e0
[   20.831478]  ? __flush_work+0x6e/0x7e0
[   20.831876]  ? __lock_acquire+0x396/0x2830
[   20.832317]  __cancel_work_timer+0x1cb/0x290
[   20.832767]  mptcp_cancel_work+0x18/0x70
[   20.833186]  mptcp_close+0xa0/0xe0
[   20.833549]  inet_release+0x56/0xa0
[   20.833922]  __sock_release+0x51/0xf0
[   20.834337]  ? __pfx_sock_close+0x10/0x10
[   20.834860]  sock_close+0x18/0x20
[   20.835291]  __fput+0x113/0x430
[   20.835710]  task_work_run+0x96/0x100
[   20.836216]  do_exit+0x4fc/0x1010
[   20.836671]  do_group_exit+0x51/0xf0
[   20.837146]  get_signal+0x1495/0x1570
[   20.837635]  ? __call_rcu_common.constprop.0+0x17f/0x3d0
[   20.838313]  arch_do_signal_or_restart+0x25/0x260
[   20.838923]  exit_to_user_mode_prepare+0x131/0x1a0
[   20.839567]  syscall_exit_to_user_mode+0x19/0x40
[   20.840375]  do_syscall_64+0x46/0x90
[   20.840875]  entry_SYSCALL_64_after_hwframe+0x72/0xdc

cpaasch · 2023-03-27T17:40:24Z

[   13.711965] ------------[ cut here ]------------
[   13.712838] MPTCP: addr_signal error, rm_addr=4
[   13.713020] refcount_t: addition on 0; use-after-free.
[   13.713024] MPTCP: addr_signal error, rm_addr=4
[   13.713577] WARNING: CPU: 0 PID: 2854 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25 (discriminator 3))
[   13.714130] MPTCP: addr_signal error, rm_addr=4
[   13.714556] Modules linked in:
[   13.715505] MPTCP: addr_signal error, rm_addr=4
[   13.715923]
[   13.715930] CPU: 0 PID: 2854 Comm: repro Not tainted 6.3.0-rc3-gb6fb4dd50771 #156
[   13.717710] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[   13.718613] RIP: 0010:refcount_warn_saturate (lib/refcount.c:25 (discriminator 3))
[ 13.719171] Code: 02 31 ff 89 de e8 7b a9 a8 ff 84 db 0f 85 6e ff ff ff e8 9e ae a8 ff 48 c7 c7 a0 3f 34 83 c6 05 bf 0d 10 02 01 e8 9b 1c 91 ff <0f> 0b e9 4f ff ff ff e8 7f ae a8
 ff 0f b6 1d a6 0d 10 02 31 ff 89
All code
========
   0:   02 31                   add    (%rcx),%dh
   2:   ff 89 de e8 7b a9       decl   -0x56841722(%rcx)
   8:   a8 ff                   test   $0xff,%al
   a:   84 db                   test   %bl,%bl
   c:   0f 85 6e ff ff ff       jne    0xffffffffffffff80
  12:   e8 9e ae a8 ff          callq  0xffffffffffa8aeb5
  17:   48 c7 c7 a0 3f 34 83    mov    $0xffffffff83343fa0,%rdi
  1e:   c6 05 bf 0d 10 02 01    movb   $0x1,0x2100dbf(%rip)        # 0x2100de4
  25:   e8 9b 1c 91 ff          callq  0xffffffffff911cc5
  2a:*  0f 0b                   ud2             <-- trapping instruction
  2c:   e9 4f ff ff ff          jmpq   0xffffffffffffff80
  31:   e8 7f ae a8 ff          callq  0xffffffffffa8aeb5
  36:   0f b6 1d a6 0d 10 02    movzbl 0x2100da6(%rip),%ebx        # 0x2100de3
  3d:   31 ff                   xor    %edi,%edi
  3f:   89                      .byte 0x89

Code starting with the faulting instruction
===========================================
   0:   0f 0b                   ud2
   2:   e9 4f ff ff ff          jmpq   0xffffffffffffff56
   7:   e8 7f ae a8 ff          callq  0xffffffffffa8ae8b
   c:   0f b6 1d a6 0d 10 02    movzbl 0x2100da6(%rip),%ebx        # 0x2100db9
  13:   31 ff                   xor    %edi,%edi
  15:   89                      .byte 0x89
[   13.721069] RSP: 0018:ffffc900015cfbf8 EFLAGS: 00010282
[   13.721639] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   13.722410] RDX: ffff888008373180 RSI: ffffffff81096b5f RDI: 0000000000000001
[   13.723173] RBP: ffff888008461680 R08: 0000000000000001 R09: 0000000000000000
[   13.723998] R10: 0000000000000001 R11: ffff888008373a08 R12: ffff888008461600
[   13.724758] R13: ffff888008461f88 R14: ffff88800747b750 R15: ffff888008461f88
[   13.725511] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[   13.726341] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.726944] CR2: 00007f10325730b2 CR3: 0000000008a37003 CR4: 0000000000170ef0
[   13.727693] Call Trace:
[   13.727964]  <TASK>
[   13.728201] __mptcp_close (./include/linux/refcount.h:199 ./include/linux/refcount.h:250 ./include/linux/refcount.h:267 ./include/net/sock.h:775 net/mptcp/protocol.c:3055)
[   13.728635] mptcp_close (net/mptcp/protocol.c:3077)
[   13.729010] inet_release (net/ipv4/af_inet.c:430)
[   13.729398] __sock_release (net/socket.c:654)
[   13.729806] ? __pfx_sock_close (net/socket.c:1394)
[   13.730240] sock_close (net/socket.c:1397)
[   13.730624] __fput (fs/file_table.c:322)
[   13.730977] task_work_run (kernel/task_work.c:181 (discriminator 1))
[   13.731381] do_exit (kernel/exit.c:870)
[   13.731762] do_group_exit (kernel/exit.c:1000)
[   13.732158] get_signal (kernel/signal.c:2833)
[   13.732579] arch_do_signal_or_restart (arch/x86/kernel/signal.c:306)
[   13.733090] exit_to_user_mode_prepare (kernel/entry/common.c:170 kernel/entry/common.c:203)
[   13.733618] syscall_exit_to_user_mode (kernel/entry/common.c:130 kernel/entry/common.c:298)
[   13.734110] do_syscall_64 (arch/x86/entry/common.c:87)
[   13.734531] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[   13.735067] RIP: 0033:0x7f1032672e79
[ 13.735473] Code: Unable to access opcode bytes at 0x7f1032672e4f.
objdump: '/tmp/tmp.Oif66YLKMr.o': No such file

Code starting with the faulting instruction
===========================================
[   13.736107] RSP: 002b:00007f103254fe08 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   13.736896] RAX: fffffffffffffe00 RBX: 00007f1032550640 RCX: 00007f1032672e79
[   13.737642] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006031b8
[   13.738378] RBP: 00007f103254fe20 R08: 0000000000000000 R09: 0000000000000000
[   13.739112] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1032550640
[   13.739858] R13: 0000000000000000 R14: 00007f10325fa600 R15: 00007f1032530000
[   13.740609]  </TASK>
[   13.740855] irq event stamp: 959
[   13.741197] hardirqs last enabled at (969): __up_console_sem (./arch/x86/include/asm/irqflags.h:42 (discriminator 1) ./arch/x86/include/asm/irqflags.h:77 (discriminator 1) ./arch/x86/include/asm/irqflags.h:135 (discriminator 1) kernel/printk/printk.c:345 (discriminator 1))
[   13.742078] hardirqs last disabled at (980): __up_console_sem (kernel/printk/printk.c:343 (discriminator 1))
[   13.742963] softirqs last enabled at (836): irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650 kernel/softirq.c:662)
[   13.743814] softirqs last disabled at (831): irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650 kernel/softirq.c:662)
[   13.744665] ---[ end trace 0000000000000000 ]---
[   13.746547] ------------[ cut here ]------------

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 torvalds#7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

cpaasch · 2023-04-04T15:57:48Z

On 3d4ef70, I get:

[   30.203089] ============================================
[   30.203294] MPTCP: addr_signal error, rm_addr=4
[   30.203743] WARNING: possible recursive locking detected
[   30.203751] 6.3.0-rc4-g3d4ef700263b #157 Not tainted
[   30.203757] --------------------------------------------
[   30.203760] repro/13953 is trying to acquire lock:
[   30.204345] MPTCP: addr_signal error, rm_addr=4
[   30.204783] ffff8880085fc330 (sk_lock-AF_INET
[   30.205349] MPTCP: addr_signal error, rm_addr=4
[   30.205852] /1){+.+.}-{0:0}, at: mptcp_subflow_queue_clean (net/mptcp/subflow.c:1854 (discriminator 3))
[   30.209033]
[   30.209033] but task is already holding lock:
[   30.209634] ffff8880085f8c30 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2424)
[   30.210537]
[   30.210537] other info that might help us debug this:
[   30.211193]  Possible unsafe locking scenario:
[   30.211193]
[   30.211802]        CPU0
[   30.212065]        ----
[   30.212327]   lock(sk_lock-AF_INET/1);
[   30.212732]   lock(sk_lock-AF_INET/1);
[   30.213128]
[   30.213128]  *** DEADLOCK ***
[   30.213128]
[   30.213735]  May be due to missing lock nesting notation
[   30.213735]
[   30.214417] 2 locks held by repro/13953:
[   30.214836] #0: ffff88800744be88 (&sb->s_type->i_mutex_key#7){+.+.}-{3:3}, at: __sock_release (net/socket.c:653)
[   30.215822] #1: ffff8880085f8c30 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2424)
[   30.216768]
[   30.216768] stack backtrace:
[   30.217221] CPU: 1 PID: 13953 Comm: repro Not tainted 6.3.0-rc4-g3d4ef700263b #157
[   30.217995] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[   30.218926] Call Trace:
[   30.219192]  <TASK>
[   30.219424] dump_stack_lvl (lib/dump_stack.c:107)
[   30.219838] __lock_acquire (kernel/locking/lockdep.c:4924)
[   30.220261] ? __mptcp_close (net/mptcp/protocol.c:3060)
[   30.220691] lock_acquire (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5671 kernel/locking/lockdep.c:5634)
[   30.221076] ? mptcp_subflow_queue_clean (net/mptcp/subflow.c:1854 (discriminator 3))
[   30.221631] ? module_put (kernel/module/main.c:850)
[   30.222015] ? sk_destruct (net/core/sock.c:2184)
[   30.222397] lock_sock_nested (net/core/sock.c:3476)
[   30.222862] ? mptcp_subflow_queue_clean (net/mptcp/subflow.c:1854 (discriminator 3))
[   30.223386] mptcp_subflow_queue_clean (net/mptcp/subflow.c:1854 (discriminator 3))
[   30.223901] __mptcp_close_ssk (net/mptcp/protocol.c:2424)
[   30.224336] mptcp_destroy_common (net/mptcp/protocol.c:3278)
[   30.224798] mptcp_destroy (./include/net/sock.h:1471 net/mptcp/protocol.c:3307)
[   30.225184] __mptcp_destroy_sock (net/mptcp/protocol.c:2961)
[   30.225643] __mptcp_close (net/mptcp/protocol.c:3060)
[   30.226045] mptcp_close (net/mptcp/protocol.c:3075)
[   30.226451] inet_release (net/ipv4/af_inet.c:430)
[   30.226876] __sock_release (net/socket.c:654)
[   30.227269] ? __pfx_sock_close (net/socket.c:1394)
[   30.227705] sock_close (net/socket.c:1397)
[   30.228066] __fput (fs/file_table.c:322)
[   30.228411] task_work_run (kernel/task_work.c:181 (discriminator 1))
[   30.228809] do_exit (kernel/exit.c:870)
[   30.229175] do_group_exit (kernel/exit.c:1000)
[   30.229569] get_signal (kernel/signal.c:2833)
[   30.229963] arch_do_signal_or_restart (arch/x86/kernel/signal.c:306)
[   30.230461] exit_to_user_mode_prepare (kernel/entry/common.c:170 kernel/entry/common.c:204)
[   30.230963] syscall_exit_to_user_mode (kernel/entry/common.c:130 kernel/entry/common.c:299)
[   30.231451] do_syscall_64 (arch/x86/entry/common.c:87)
[   30.231847] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[   30.232375] RIP: 0033:0x7fd004be1e79
[ 30.232767] Code: Unable to access opcode bytes at 0x7fd004be1e4f.
objdump: '/tmp/tmp.I0LcnDOTjD.o': No such file

Code starting with the faulting instruction
===========================================
[   30.233393] RSP: 002b:00007fd004adfe08 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   30.234170] RAX: fffffffffffffe00 RBX: 00007fd004ae0640 RCX: 00007fd004be1e79
[   30.234901] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006031a8
[   30.235633] RBP: 00007fd004adfe20 R08: 0000000000000000 R09: 0000000000000000
[   30.236354] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd004ae0640
[   30.237155] R13: 0000000000000000 R14: 00007fd004b69600 R15: 00007fd004ac0000
[   30.237914]  </TASK>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

This reverts commit 4edee9a. This piece of code was causing issues, see: #371 (comment) It sounds safer to revert it then. Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

This reverts commit 1859939. This piece of code was causing issues, see: #371 (comment) It sounds safer to revert it then. Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 torvalds#7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: #371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

commit 2a6a870 upstream. This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 torvalds#7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2a6a870 upstream. This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BugLink: https://bugs.launchpad.net/bugs/2023929 commit 2a6a870e44dd88f1a6a2893c65ef756a9edfb4c7 upstream. This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK> CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1f9c27 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: multipath-tcp/mptcp_net-next#371 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

This patch fixes an incorrect assumption made in the original bpf_refcount series [0], specifically that the BPF program calling bpf_refcount_acquire on some node can always guarantee that the node is alive. In that series, the patch adding failure behavior to rbtree_add and list_push_{front, back} breaks this assumption for non-owning references. Consider the following program: n = bpf_kptr_xchg(&mapval, NULL); /* skip error checking */ bpf_spin_lock(&l); if(bpf_rbtree_add(&t, &n->rb, less)) { bpf_refcount_acquire(n); /* Failed to add, do something else with the node */ } bpf_spin_unlock(&l); It's incorrect to assume that bpf_refcount_acquire will always succeed in this scenario. bpf_refcount_acquire is being called in a critical section here, but the lock being held is associated with rbtree t, which isn't necessarily the lock associated with the tree that the node is already in. So after bpf_rbtree_add fails to add the node and calls bpf_obj_drop in it, the program has no ownership of the node's lifetime. Therefore the node's refcount can be decr'd to 0 at any time after the failing rbtree_add. If this happens before the refcount_acquire above, the node might be free'd, and regardless refcount_acquire will be incrementing a 0 refcount. Later patches in the series exercise this scenario, resulting in the expected complaint from the kernel (without this patch's changes): refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 207 at lib/refcount.c:25 refcount_warn_saturate+0xbc/0x110 Modules linked in: bpf_testmod(O) CPU: 1 PID: 207 Comm: test_progs Tainted: G O 6.3.0-rc7-02231-g723de1a718a2-dirty #371 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0xbc/0x110 Code: 6f 64 f6 02 01 e8 84 a3 5c ff 0f 0b eb 9d 80 3d 5e 64 f6 02 00 75 94 48 c7 c7 e0 13 d2 82 c6 05 4e 64 f6 02 01 e8 64 a3 5c ff <0f> 0b e9 7a ff ff ff 80 3d 38 64 f6 02 00 0f 85 6d ff ff ff 48 c7 RSP: 0018:ffff88810b9179b0 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000202 RSI: 0000000000000008 RDI: ffffffff857c3680 RBP: ffff88810027d3c0 R08: ffffffff8125f2a4 R09: ffff88810b9176e7 R10: ffffed1021722edc R11: 746e756f63666572 R12: ffff88810027d388 R13: ffff88810027d3c0 R14: ffffc900005fe030 R15: ffffc900005fe048 FS: 00007fee0584a700(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005634a96f6c58 CR3: 0000000108ce9002 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> bpf_refcount_acquire_impl+0xb5/0xc0 (rest of output snipped) The patch addresses this by changing bpf_refcount_acquire_impl to use refcount_inc_not_zero instead of refcount_inc and marking bpf_refcount_acquire KF_RET_NULL. For owning references, though, we know the above scenario is not possible and thus that bpf_refcount_acquire will always succeed. Some verifier bookkeeping is added to track "is input owning ref?" for bpf_refcount_acquire calls and return false from is_kfunc_ret_null for bpf_refcount_acquire on owning refs despite it being marked KF_RET_NULL. Existing selftests using bpf_refcount_acquire are modified where necessary to NULL-check its return value. [0]: https://lore.kernel.org/bpf/20230415201811.343116-1-davemarchevsky@fb.com/ Fixes: d2dcc67 ("bpf: Migrate bpf_rbtree_add and bpf_list_push_{front,back} to possibly fail") Reported-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com> Link: https://lore.kernel.org/r/20230602022647.1571784-5-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>

cpaasch added bug syzkaller labels Mar 13, 2023

cpaasch mentioned this issue Mar 20, 2023

syzkaller: WARNING: refcount bug in __mptcp_close #375

Closed

cpaasch added the reproducer Has a simple program to reproduce the bug label Mar 20, 2023

cpaasch mentioned this issue Mar 20, 2023

KASAN: slab-use-after-free Read in ip_mc_drop_socket #376

Closed

cpaasch added the bisected Git commit introducing the bug is known label Mar 20, 2023

matttbe closed this as completed in d3a03b5 Mar 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

syzkaller: WARNING in `inet_csk_listen_stop` #371

syzkaller: WARNING in `inet_csk_listen_stop` #371

cpaasch commented Mar 13, 2023

cpaasch commented Mar 20, 2023

cpaasch commented Mar 20, 2023

cpaasch commented Mar 27, 2023

cpaasch commented Mar 27, 2023

cpaasch commented Apr 4, 2023

syzkaller: WARNING in inet_csk_listen_stop #371

syzkaller: WARNING in inet_csk_listen_stop #371

Comments

cpaasch commented Mar 13, 2023

cpaasch commented Mar 20, 2023

cpaasch commented Mar 20, 2023

cpaasch commented Mar 27, 2023

cpaasch commented Mar 27, 2023

cpaasch commented Apr 4, 2023

syzkaller: WARNING in `inet_csk_listen_stop` #371

syzkaller: WARNING in `inet_csk_listen_stop` #371