linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00

Linux kernel source tree

Go to file

Dongseok Yi 24cd331741 net: fix use-after-free when UDP GRO with shared fraglist [ Upstream commit `53475c5dd8` ] skbs in fraglist could be shared by a BPF filter loaded at TC. If TC writes, it will call skb_ensure_writable -> pskb_expand_head to create a private linear section for the head_skb. And then call skb_clone_fraglist -> skb_get on each skb in the fraglist. skb_segment_list overwrites part of the skb linear section of each fragment itself. Even after skb_clone, the frag_skbs share their linear section with their clone in PF_PACKET. Both sk_receive_queue of PF_PACKET and PF_INET (or PF_INET6) can have a link for the same frag_skbs chain. If a new skb (not frags) is queued to one of the sk_receive_queue, multiple ptypes can see and release this. It causes use-after-free. [ 4443.426215] ------------[ cut here ]------------ [ 4443.426222] refcount_t: underflow; use-after-free. [ 4443.426291] WARNING: CPU: 7 PID: 28161 at lib/refcount.c:190 refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426726] pstate: 60400005 (nZCv daif +PAN -UAO) [ 4443.426732] pc : refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426737] lr : refcount_dec_and_test_checked+0xa0/0xc8 [ 4443.426808] Call trace: [ 4443.426813] refcount_dec_and_test_checked+0xa4/0xc8 [ 4443.426823] skb_release_data+0x144/0x264 [ 4443.426828] kfree_skb+0x58/0xc4 [ 4443.426832] skb_queue_purge+0x64/0x9c [ 4443.426844] packet_set_ring+0x5f0/0x820 [ 4443.426849] packet_setsockopt+0x5a4/0xcd0 [ 4443.426853] __sys_setsockopt+0x188/0x278 [ 4443.426858] __arm64_sys_setsockopt+0x28/0x38 [ 4443.426869] el0_svc_common+0xf0/0x1d0 [ 4443.426873] el0_svc_handler+0x74/0x98 [ 4443.426880] el0_svc+0x8/0xc Fixes: `3a1296a38d` (net: Support GRO/GSO fraglist chaining.) Signed-off-by: Dongseok Yi <dseok.yi@samsung.com> Acked-by: Willem de Bruijn <willemb@google.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/1610072918-174177-1-git-send-email-dseok.yi@samsung.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-23 16:03:59 +01:00
arch	x86/hyperv: Initialize clockevents after LAPIC is initialized	2021-01-23 16:03:57 +01:00
block	blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED	2021-01-19 18:27:29 +01:00
certs	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
crypto	X.509: Fix crash caused by NULL pointer	2021-01-23 16:03:58 +01:00
Documentation	dt-bindings: display: sii902x: Add supply bindings	2021-01-19 18:27:19 +01:00
drivers	net: ipa: modem: add missing SET_NETDEV_DEV() for proper sysfs links	2021-01-23 16:03:59 +01:00
fs	nfsd4: readdirplus shouldn't return parent of export	2021-01-23 16:03:58 +01:00
include	rcu-tasks: Move RCU-tasks initialization to before early_initcall()	2021-01-19 18:27:28 +01:00
init	rcu-tasks: Move RCU-tasks initialization to before early_initcall()	2021-01-19 18:27:28 +01:00
ipc	ipc: adjust proc_ipc_sem_dointvec definition to match prototype	2020-09-05 12:14:29 -07:00
kernel	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 16:03:59 +01:00
lib	lib/raid6: Let $(UNROLL) rules work with macOS userland	2021-01-19 18:27:25 +01:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	mm, slub: consider rest of partial list if acquire_slab() fails	2021-01-19 18:27:32 +01:00
net	net: fix use-after-free when UDP GRO with shared fraglist	2021-01-23 16:03:59 +01:00
samples	samples/bpf: Fix possible hang in xdpsock with multiple threads	2020-12-30 11:53:49 +01:00
scripts	Revert "kconfig: remove 'kvmconfig' and 'xenconfig' shorthands"	2021-01-23 16:03:57 +01:00
security	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-19 18:27:29 +01:00
sound	ALSA: firewire-tascam: Fix integer overflow in midi_port_work()	2021-01-19 18:27:33 +01:00
tools	bpf: Fix selftest compilation on clang 11	2021-01-23 16:03:57 +01:00
usr	Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-08-07 13:29:39 -07:00
virt	kvm: check tlbs_dirty directly	2021-01-12 20:18:22 +01:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	.gitignore: docs: ignore sphinx_*/ directories	2020-09-10 10:44:31 -06:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-12-10 15:30:13 -08:00
Makefile	Linux 5.10.9	2021-01-19 18:27:34 +01:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.