From nobody Sun Dec 7 21:49:35 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8FCC48CFC; Fri, 6 Sep 2024 09:22:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725614533; cv=none; b=mUSJQ1nsSG3eifOtUAn08nsezXLexOD2ArkHXu4FH7fHPfD/mf8ZLcZ9bs7WszytHYYFEAOVNLVKlJGDO11Y2Gja87+1iE+AkBBiBd12tq1/lpaHesQAer1oHPma8d2p0f+AOM4Pz2TPO20ydNlsO98QBDZ0suzo1a8DSOL1rVc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725614533; c=relaxed/simple; bh=RFEywIVAJoTTG/a7ADoSCEliwGRzNjiGhHJjoveXyz8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bdGka6Y1JzRGXaVp30z9OCFYoQjxOfXXtFB75Eg+Q4SdcU0jKA72A16lO3EFWlr5J4Ktur0/mN+6XYnyKR/EdtS8nlOY10VKKLnedlUgZVD27GoXrAYAO+IxgUzbh4FMTkxyzYgMyxzUFr+d+1zOYBGX7jpaVmxJBgtd2oyT8QM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cFjl3WNE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cFjl3WNE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A3ACC4CEC4; Fri, 6 Sep 2024 09:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1725614533; bh=RFEywIVAJoTTG/a7ADoSCEliwGRzNjiGhHJjoveXyz8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cFjl3WNEj4FsiUL9dYBq4Wv4j+tWT18eBM0XH0gWN7OjKclRzjDv4gssNVKUNH89T 3Pq2hkk+9AtCJg+1omeFgBD0k0N3hj8VV0JusYRZBF0pKivxeJvG/pIbU0C47XQigW NX/yirqiDifdB/qQ+4CvSq9WI3kJhE2i9s2H78i/kRURmTZuEuGNyVOtt+y/74WmFy x6fXB4+rtkTVWD/0j7MsaCLhLI+OQlDtvVWeMdMuhpzoLX4HNZ/m8G36AzIAGq+53l LG5AE1Q1ZtdHURDDekhpMNjdOHP15fSDuU1NdsISlwPWkptVIV4eUmoTobT27IOywQ fwppKjXJoRbcw== From: "Matthieu Baerts (NGI0)" To: stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: MPTCP Upstream , "Matthieu Baerts (NGI0)" , Paolo Abeni , Mat Martineau , Jakub Kicinski Subject: [PATCH 5.15.y] mptcp: pm: avoid possible UaF when selecting endp Date: Fri, 6 Sep 2024 11:21:56 +0200 Message-ID: <20240906092155.1930090-2-matttbe@kernel.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <2024082658-pectin-freeness-1354@gregkh> References: <2024082658-pectin-freeness-1354@gregkh> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5433; i=matttbe@kernel.org; h=from:subject; bh=RFEywIVAJoTTG/a7ADoSCEliwGRzNjiGhHJjoveXyz8=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBm2smzYUu/8pNi+Q8otzaTZ189X4rO8xd/Po9ae Z4Rr76OXhWJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCZtrJswAKCRD2t4JPQmmg c5rjEADc21bqvXBHtf+RQdNei1ek0pS+nP94b8Yzkokf5sxI+DpgD3S7dUk+53FDKVoblMT1y7r tw7mF+aL9P+ns8ZDZO2xmrycSRCAcTMzqU41JrqLJzgrY6fXWWDDiIeDYHxbUhJDILVRnKHKi+V lIY2AEoSePUvuAExzi2haVnyw9MNMuf4R9uK1OtMJstDxA0M2E7m9T+yldMrqWYn9flY2oEbN8B ICUpT+xC7Vf6M2y0/iNk3hUswCeNm8hyFp30bf2XN1sEE9awm9pPaJvZfSjg0a6wkkMWGTLnrOV gVNxcQBl9VGsqnF+tjtiYoyPx7kJI6teYq2AHG6p3C4hldmsYnK9vce7KtLyyc4cLXorJpP3/Zr g306h/SpegrN4myEFDLO0xXnjvNPr7whjGiTA8gWcwaca0/qf7lRNe7MQSqBxvzmOxIYwZZqLpx dFvhmiggUwtnsyBXg1vTRQhBRleM5bqZN+oLM7/CgyIeuZdRzOA47if7qDISMd0gAb5+S9c58zi LgcEKK8xjr8GQx3Jpx+UJQI2NjyUO4Y6amKmXom9KfZoCOo9jqI/vYjR1eGhtU5aBHJStGjAutX AE8IWCc3Z/MhtBYxN3djAJIPMjl6rzhWNYIO6jZnlXj2FdS0fDcHIKlgVxZOOj/8Rm/+FofjDv0 /ZCTE+36/Ijnwjg== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d upstream. select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat= .com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035= d40de5b@kernel.org Signed-off-by: Jakub Kicinski [ Conflicts in pm_netlink.c, because quite a bit of new code has been added around since commit 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk"), and commit 2843ff6f36db ("mptcp: remote addresses fullmesh"). But the issue is still there. The conflicts have been resolved using the same way: by adding a new parameter to select_local_address() and select_signal_address(), and use it instead of the pointer they were previously returning. The code is simpler in this version, this conflict resolution looks safe. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 45 +++++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index ca57d856d5df..a73135e720d3 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -127,11 +127,13 @@ static bool lookup_subflow_by_saddr(const struct list= _head *list, return false; } =20 -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret =3D NULL; + struct mptcp_pm_addr_entry *entry; + bool found =3D false; =20 rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -145,19 +147,23 @@ select_local_address(const struct pm_nl_pernet *perne= t, if (entry->addr.family =3D=3D ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret =3D entry; + *new_entry =3D *entry; + found =3D true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } =20 -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret =3D NULL; + struct mptcp_pm_addr_entry *entry; + bool found =3D false; int i =3D 0; =20 rcu_read_lock(); @@ -170,12 +176,14 @@ select_signal_address(struct pm_nl_pernet *pernet, un= signed int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ =3D=3D pos) { - ret =3D entry; + *new_entry =3D *entry; + found =3D true; break; } } rcu_read_unlock(); - return ret; + + return found; } =20 static void check_work_pending(struct mptcp_sock *msk) @@ -305,7 +313,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(stru= ct mptcp_sock *msk) { struct mptcp_addr_info remote =3D { 0 }; struct sock *sk =3D (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; =20 pernet =3D net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -317,13 +325,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(st= ruct mptcp_sock *msk) =20 /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local =3D select_signal_address(pernet, - msk->pm.add_addr_signaled); - - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, msk->pm.add_addr_signaled, + &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -338,13 +344,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(st= ruct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); =20 - local =3D select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } --=20 2.45.2