[PATCH net 0/1] net: hsr: fix node-table UAF on device teardown

[Michael Bommarito]

Hi,

HSR generic-netlink node-list/status readers walk hsr->node_db under
rcu_read_lock(), but RTM_DELLINK teardown frees the same node table
immediately via plain list_del() + kfree(). A reader that has already
obtained a struct hsr_node can race hsr_dellink() and dereference
freed node memory.

The patch below uses list_del_rcu() and the existing
hsr_free_node_rcu() callback in hsr_del_nodes(). The HSR prune paths
already use this lifetime rule for the same node_db.

Reproduction.

  The natural reader window between hsr_get_next_node() acquiring
  a node and ether_addr_copy() consuming it is short, so I widened
  it with a temporary udelay() in hsr_get_next_node() and
  hsr_get_node_data() (debug-only, not in this submission). Under
  x86_64 KVM with KASAN, an in-netns RTM_NEWLINK / parallel-readers
  / RTM_DELLINK loop then produces:

    BUG: KASAN: slab-use-after-free in hsr_get_next_node+0x1db/0x350
    Read of size 6 at addr ffff888009e6f290 by task hsr_genl_spam/...
    Freed by task ip:
      hsr_del_nodes+0x144/0x250
      hsr_dellink+0x6c/0x90
      rtnl_dellink+...

  The reader walks node_db under rcu_read_lock() while hsr_dellink()
  -> hsr_del_nodes() removes and immediately frees the entries.

  Without the artificial widening the race is still real but the
  observable window is ns-to-us scale, which is presumably why
  syzbot has not flagged it in the open. The fix is the same
  either way: honour the RCU lifetime that the prune paths
  already use.

Testing.

  - net/hsr/hsr_framereg.o builds clean on an x86_64 KASAN config.
  - With the widening patch applied on top of this fix, 50 rounds
    of the RTM_NEWLINK / parallel-readers / RTM_DELLINK harness
    run KASAN-silent. The same harness fires the splat above on
    the unpatched tree in the first round.
  - Without the widening, 100 rounds of the same harness in
    list-readers mode run clean on the patched kernel.
  - tools/testing/selftests/net/hsr/{hsr_ping,prp_ping,hsr_redbox}.sh
    -4 all pass on both stock and patched kernels, diff-clean.
  - scripts/checkpatch.pl --strict is clean.

A separate status-path NULL deref in hsr_get_node_data() shows up
when the same harness runs with status readers and the widening
patch. That predates this fix and is not addressed here; I will
send it as its own patch once the primitive is characterised.

This targets net and carries a stable tag back to the dellink
cleanup commit b9a1e627405d.

Michael Bommarito (1):
  net: hsr: defer node table free until after RCU readers

 net/hsr/hsr_framereg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


base-commit: 8d90b09e6741f5103ccc81a53bf2391ea09419a7
--
2.53.0