linux/net/mctp
Jeremy Kerr 3a732b4673 mctp: prevent double key removal and unref
Currently, we have a bug where a simultaneous DROPTAG ioctl and socket
close may race, as we attempt to remove a key from lists twice, and
perform an unref for each removal operation. This may result in a uaf
when we attempt the second unref.

This change fixes the race by making __mctp_key_remove tolerant to being
called on a key that has already been removed from the socket/net lists,
and only performs the unref when we do the actual remove. We also need
to hold the list lock on the ioctl cleanup path.

This fix is based on a bug report and comprehensive analysis from
butt3rflyh4ck <butterflyhuangxx@gmail.com>, found via syzkaller.

Cc: stable@vger.kernel.org
Fixes: 63ed1aab3d ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-10-12 13:30:50 +01:00
..
test Networking changes for 5.19. 2022-05-25 12:22:58 -07:00
af_mctp.c mctp: prevent double key removal and unref 2022-10-12 13:30:50 +01:00
device.c mctp: defer the kfree of object mdev->addrs 2022-04-26 09:14:47 +02:00
Kconfig mctp: Add flow extension to skb 2021-10-29 13:23:51 +01:00
Makefile mctp: Add test utils 2021-10-03 14:35:41 +01:00
neigh.c mctp: replace mctp_address_ok with more fine-grained helpers 2022-02-18 21:24:28 -08:00
route.c mctp: prevent double key removal and unref 2022-10-12 13:30:50 +01:00