Skip to content

[lts-9.2] net/sched: cls_u32: Fix reference counter leak leading to overflow #274

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 22, 2025
Merged

[lts-9.2] net/sched: cls_u32: Fix reference counter leak leading to overflow #274

merged 1 commit into from
May 22, 2025

Conversation

dvdgomez
Copy link

jira VULN-6548
cve CVE-2023-3609

commit-author Lee Jones <[email protected]>
commit 04c55383fa5689357bcdd2c8036725a55ed632bc

In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter.  If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'.

In order to prevent this, move the point of possible failure above the point where the reference counter is incremented.  Also save any meaningful return values to be applied to the return data at the appropriate point in time.

This issue was caught with KASAN.

Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
	Suggested-by: Eric Dumazet <[email protected]>
	Signed-off-by: Lee Jones <[email protected]>
	Reviewed-by: Eric Dumazet <[email protected]>
	Acked-by: Jamal Hadi Salim <[email protected]>
	Signed-off-by: David S. Miller <[email protected]>
(cherry picked from commit 04c55383fa5689357bcdd2c8036725a55ed632bc)
	Signed-off-by: David Gomez <[email protected]>

Build Log

INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usb-audio.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usbmidi-lib.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-us122l.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-usx2y.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/misc/snd-ua101.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/virtio/virtio_snd.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usbmidi-lib.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/misc/snd-ua101.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-us122l.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-usx2y.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usb-audio.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/virtio/virtio_snd.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usbmidi-lib.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-us122l.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/usx2y/snd-usb-usx2y.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/virtio/virtio_snd.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/usb/snd-usb-audio.ko
  INSTALL /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/sound/xen/snd_xen_front.ko
  STRIP   /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+
[TIMER]{MODULES}: 14s
Making Install
sh ./arch/x86/boot/install.sh \
	5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 55s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+ and Index to 0
The default is /boot/loader/entries/4dff56aa51eb410080f2fadbace916a6-5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+
The default is /boot/loader/entries/4dff56aa51eb410080f2fadbace916a6-5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 23s
[TIMER]{BUILD}: 3243s
[TIMER]{MODULES}: 14s
[TIMER]{INSTALL}: 55s
[TIMER]{TOTAL} 3349s

Testing

Fixes a commit that is on the ciqlts9_2 branch 705c7091262d

5.14.0-284.30.1.el9_2.92ciq_lts.5.2.x86_64.log
5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+.log

# Before Fix
$ grep ^ok 5.14.0-284.30.1.el9_2.92ciq_lts.5.2.x86_64.log | wc -l
247
# After Fix
$ grep ^ok 5.14.0-dgomez-ciqlts9_2_VULN-6548-1e52cb1b676a+.log | wc -l
247

@dvdgomez
net/sched: cls_u32: Fix reference counter leak leading to overflow
1e52cb1 
jira VULN-6548
cve CVE-2023-3609
commit-author Lee Jones <[email protected]>
commit 04c5538

In the event of a failure in tcf_change_indev(), u32_set_parms() will
immediately return without decrementing the recently incremented
reference counter.  If this happens enough times, the counter will
rollover and the reference freed, leading to a double free which can be
used to do 'bad things'.

In order to prevent this, move the point of possible failure above the
point where the reference counter is incremented.  Also save any
meaningful return values to be applied to the return data at the
appropriate point in time.

This issue was caught with KASAN.

Fixes: 705c709 ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
	Suggested-by: Eric Dumazet <[email protected]>
	Signed-off-by: Lee Jones <[email protected]>
	Reviewed-by: Eric Dumazet <[email protected]>
	Acked-by: Jamal Hadi Salim <[email protected]>
	Signed-off-by: David S. Miller <[email protected]>
(cherry picked from commit 04c5538)
	Signed-off-by: David Gomez <[email protected]>
@dvdgomez dvdgomez self-assigned this May 20, 2025
bmastbergen
bmastbergen approved these changes May 20, 2025
View reviewed changes
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@dvdgomez dvdgomez mentioned this pull request May 20, 2025
Merged
PlaidCat
PlaidCat approved these changes May 21, 2025
View reviewed changes
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@dvdgomez dvdgomez merged commit ca6837f into ciqlts9_2 May 22, 2025
3 checks passed
@dvdgomez dvdgomez deleted the dgomez-ciqlts9_2/VULN-6548 branch May 22, 2025 17:42
@dvdgomez dvdgomez mentioned this pull request May 22, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PlaidCat PlaidCat PlaidCat approved these changes

@bmastbergen bmastbergen bmastbergen approved these changes

@kerneltoast kerneltoast Awaiting requested review from kerneltoast

Assignees

@dvdgomez dvdgomez

Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@dvdgomez @PlaidCat @bmastbergen