Hoang Huu Le 604ac10d9d tipc: fix use-after-free in tipc_bcast_get_mode ... commit fdeba99b1e upstream. Syzbot has reported those issues as: ================================================================== BUG: KASAN: use-after-free in tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 Read of size 1 at addr ffff88805e6b3571 by task kworker/0:6/3850 CPU: 0 PID: 3850 Comm: kworker/0:6 Not tainted 5.8.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Thread 1's call trace: [...] kfree+0x103/0x2c0 mm/slab.c:3757 <- bcbase releasing tipc_bcast_stop+0x1b0/0x2f0 net/tipc/bcast.c:721 tipc_exit_net+0x24/0x270 net/tipc/core.c:112 [...] Thread 2's call trace: [...] tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 <- bcbase has already been freed by Thread 1 tipc_node_broadcast+0x9e/0xcc0 net/tipc/node.c:1744 tipc_nametbl_publish+0x60b/0x970 net/tipc/name_table.c:752 tipc_net_finalize net/tipc/net.c:141 [inline] tipc_net_finalize+0x1fa/0x310 net/tipc/net.c:131 tipc_net_finalize_work+0x55/0x80 net/tipc/net.c:150 [...] ================================================================== BUG: KASAN: use-after-free in tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 Read of size 8 at addr ffff888052ab2000 by task kworker/0:13/30628 CPU: 0 PID: 30628 Comm: kworker/0:13 Not tainted 5.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1f0/0x31e lib/dump_stack.c:118 print_address_description+0x66/0x5a0 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report+0x132/0x1d0 mm/kasan/report.c:530 tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 tipc_net_finalize+0x85/0xe0 net/tipc/net.c:138 tipc_net_finalize_work+0x50/0x70 net/tipc/net.c:150 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 [...] Freed by task 14058: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x220 mm/slab.c:3757 tipc_exit_net+0x29/0x50 net/tipc/core.c:113 ops_exit_list net/core/net_namespace.c:186 [inline] cleanup_net+0x708/0xba0 net/core/net_namespace.c:603 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Fix it by calling flush_scheduled_work() to make sure the tipc_net_finalize_work() stopped before releasing bcbase object. Reported-by: syzbot+6ea1f7a8df64596ef4d7@syzkaller.appspotmail.com Reported-by: syzbot+e9cc557752ab126c1b99@syzkaller.appspotmail.com Acked-by: Jon Maloy <jmaloy@redhat.com> Signed-off-by: Hoang Huu Le <hoang.h.le@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-11-10 12:35:53 +01:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-11-05 11:08:44 +01:00
802
8021q	vlan: vlan_changelink() should propagate errors	2020-01-12 12:17:28 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-13 08:52:59 +01:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:14:43 +02:00
ax25	AX.25: Prevent integer overflows in connect and sendmsg	2020-07-31 18:37:48 +02:00
batman-adv	batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh	2020-10-01 13:14:52 +02:00
bluetooth	Bluetooth: Only mark socket zapped after unlocking	2020-10-30 10:38:30 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	net: bridge: enfore alignment for ethernet address	2020-06-30 23:17:03 -04:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: gw: Fix error path of cgw_module_init	2019-08-29 08:28:30 +02:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:08:53 +01:00
core	bpf: Fix clobbering of r2 in bpf_gen_ld_abs	2020-10-01 13:14:52 +02:00
dcb	net: DCB: Validate DCB_ATTR_DCB_BUFFER argument	2020-09-26 18:01:29 +02:00
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-04-29 16:31:16 +02:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:13:37 +01:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:30:24 +02:00
dsa	dsa: Allow forwarding of redirected IGMP traffic	2020-09-23 12:10:56 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:19:09 +01:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-21 09:03:03 +02:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-18 07:14:15 +01:00
ife
ipv4	tcp: Prevent low rmem stalls with SO_RCVLOWAT.	2020-11-05 11:08:33 +01:00
ipv6	netfilter: nf_log: missing vlan offload tag and proto	2020-10-29 09:55:15 +01:00
iucv	net/af_iucv: always register net_device notifier	2020-01-27 14:50:56 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: pfkey_dump needs parameter validation	2020-09-26 18:01:28 +02:00
l2tp	l2tp: remove skb_dst_set() from l2tp_xmit_skb()	2020-07-22 09:31:59 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	net: silence data-races on sk_backlog.tail	2020-10-01 13:14:26 +02:00
mac80211	mac80211: handle lack of sband->bitrates in rates	2020-10-30 10:38:28 +01:00
mac802154	mac802154: tx: fix use-after-free	2020-10-01 13:14:51 +02:00
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-04-29 16:31:17 +02:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	ipvs: Fix uninit-value in do_ip_vs_set_ctl()	2020-10-30 10:38:31 +01:00
netlabel	netlabel: fix problems with mapping removal	2020-09-12 13:40:22 +02:00
netlink	genetlink: remove genl_bind	2020-07-22 09:31:58 +02:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-04-29 16:31:21 +02:00
nfc	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()	2020-10-29 09:54:58 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: handle DNAT tuple collision	2020-10-14 10:31:24 +02:00
packet	net/packet: fix overflow in tpacket_rcv	2020-10-07 08:00:08 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 09:21:30 +01:00
qrtr	net: qrtr: check skb_put_padto() return value	2020-09-26 18:01:30 +02:00
rds	rds: Prevent kernel-infoleak in rds_notify_queue_get()	2020-08-05 10:06:01 +02:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:17:17 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix server keyring leak	2020-10-14 10:31:26 +02:00
sched	netem: fix zero division in tabledist	2020-11-05 11:08:33 +01:00
sctp	sctp: fix sctp_auth_init_hmacs() error path	2020-10-14 10:31:23 +02:00
smc	net/smc: fix valid DMBE buffer sizes	2020-10-29 09:54:55 +01:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()	2020-10-30 10:38:23 +01:00
switchdev
tipc	tipc: fix use-after-free in tipc_bcast_get_mode	2020-11-10 12:35:53 +01:00
tls	net/tls: sendfile fails with ktls offload	2020-10-29 09:54:56 +01:00
unix	skbuff: fix a data race in skb_queue_len()	2020-10-01 13:14:32 +02:00
vmw_vsock	net: virtio_vsock: Enhance connection semantics	2020-10-07 08:00:05 +02:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	nl80211: fix non-split wiphy information	2020-10-29 09:55:13 +01:00
x25	net/x25: Fix null-ptr-deref in x25_disconnect	2020-08-05 10:06:02 +02:00
xdp	xdp: Fix xsk_generic_xmit errno	2020-06-25 15:33:05 +02:00
xfrm	xfrm: Use correct address family in xfrm_state_find	2020-10-14 10:31:25 +02:00
compat.c	net/compat: Add missing sock updates for SCM_RIGHTS	2020-08-21 11:05:32 +02:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-19 08:15:03 +02:00
sysctl_net.c