Re: [PATCH] net: sched: use-after-free in tcf_action_destroy

From: Willy Tarreau
Date: Fri Aug 16 2024 - 01:04:02 EST


On Fri, Aug 16, 2024 at 12:06:25AM -0400, Jamal Hadi Salim wrote:
> On Thu, Aug 15, 2024 at 9:54 PM yangzhuorao <alex000young@xxxxxxxxx> wrote:
> >
> > There is a uaf bug in net/sched/act_api.c.
> > When Thread1 call [1] tcf_action_init_1 to alloc act which saves
> > in actions array. If allocation failed, it will go to err path.
> > Meanwhile thread2 call tcf_del_walker to delete action in idr.
> > So thread 1 in err path [3] tcf_action_destroy will cause
> > use-after-free read bug.
> >
> > Thread1 Thread2
> > tcf_action_init
> > for(i;i<TCA_ACT_MAX_PRIO;i++)
> > act=tcf_action_init_1 //[1]
> > if(IS_ERR(act))
> > goto err
> > actions[i] = act
> > tcf_del_walker
> > idr_for_each_entry_ul(idr,p,id)
> > __tcf_idr_release(p,false,true)
> > free_tcf(p) //[2]
> > err:
> > tcf_action_destroy
> > a=actions[i]
> > ops = a->ops //[3]
> >
> > We add lock and unlock in tcf_action_init and tcf_del_walker function
> > to aviod race condition.
> >
> > ==================================================================
> > BUG: KASAN: use-after-free in tcf_action_destroy+0x138/0x150
> > Read of size 8 at addr ffff88806543e100 by task syz-executor156/295
> >
>
> Since this is syzkaller induced, do you have a repro?
> Also what kernel (trying to see if it was before/after Eric's netlink changes).
>
> cheers,
> jamal

In addition, please note that since this is public, there's no point in
CCing security@k.o (which I've dropped from the CC list) since there's
no coordination needed anymore.

Thanks!
Willy