In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash [1] in nettxaction() which made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute.
qdisccreate() has to destroy the just initialized taprio qdisc, and tapriodestroy() is called.
However, the hrtimer used by taprio had already fired, therefore advancesched() called _netif_schedule().
Then nettxaction was trying to use a destroyed qdisc.
We can not undo the _netifschedule(), so we must wait until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1] BUG: KMSAN: uninit-value in queuedspintrylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value in dorawspintrylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in _rawspintrylock include/linux/spinlockapismp.h:89 [inline] BUG: KMSAN: uninit-value in rawspintrylock+0x92/0xa0 kernel/locking/spinlock.c:138 queuedspintrylock include/asm-generic/qspinlock.h:94 [inline] dorawspintrylock include/linux/spinlock.h:191 [inline] _rawspintrylock include/linux/spinlockapismp.h:89 [inline] _rawspintrylock+0x92/0xa0 kernel/locking/spinlock.c:138 spintrylock include/linux/spinlock.h:359 [inline] qdiscrunbegin include/net/schgeneric.h:187 [inline] qdiscrun+0xee/0x540 include/net/pktsched.h:125 nettxaction+0x77c/0x9a0 net/core/dev.c:5086 _dosoftirq+0x1cc/0x7fb kernel/softirq.c:571 runksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpbootthreadfn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 retfromfork+0x1f/0x30
Uninit was created at: slabpostallochook mm/slab.h:732 [inline] slaballocnode mm/slub.c:3258 [inline] kmallocnodetrackcaller+0x814/0x1250 mm/slub.c:4970 kmallocreserve net/core/skbuff.c:358 [inline] _allocskb+0x346/0xcf0 net/core/skbuff.c:430 allocskb include/linux/skbuff.h:1257 [inline] nlmsgnew include/net/netlink.h:953 [inline] netlinkack+0x5f3/0x12b0 net/netlink/afnetlink.c:2436 netlinkrcvskb+0x55d/0x6c0 net/netlink/afnetlink.c:2507 rtnetlinkrcv+0x30/0x40 net/core/rtnetlink.c:6108 netlinkunicastkernel net/netlink/afnetlink.c:1319 [inline] netlinkunicast+0xf3b/0x1270 net/netlink/afnetlink.c:1345 netlinksendmsg+0x1288/0x1440 net/netlink/afnetlink.c:1921 socksendmsgnosec net/socket.c:714 [inline] socksendmsg net/socket.c:734 [inline] _syssendmsg+0xabc/0xe90 net/socket.c:2482 _syssendmsg+0x2a1/0x3f0 net/socket.c:2536 _syssendmsg net/socket.c:2565 [inline] _dosyssendmsg net/socket.c:2574 [inline] _sesyssendmsg net/socket.c:2572 [inline] _x64syssendmsg+0x367/0x540 net/socket.c:2572 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"target": {
"file": "include/net/sch_generic.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-118a830a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"98295454283547836948882898972269461673"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"target": {
"function": "taprio_destroy",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-1da1a00f",
"digest": {
"length": 677.0,
"function_hash": "287326553825580861450655244599233573018"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b2d2820a005e43855fa71b80c4a4b194201c60",
"target": {
"function": "taprio_destroy",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-28e32338",
"digest": {
"length": 652.0,
"function_hash": "324094273978664928755599944182071287257"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53acbf2facfdfabdc6e6984a1a38f5d38b606a1",
"target": {
"function": "taprio_destroy",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-29153626",
"digest": {
"length": 677.0,
"function_hash": "287326553825580861450655244599233573018"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b2d2820a005e43855fa71b80c4a4b194201c60",
"target": {
"function": "taprio_reset",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-39fc9bf3",
"digest": {
"length": 308.0,
"function_hash": "224127896447649954211783179105353906439"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-3add5816",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"165208610166839847279642903357842517404",
"250235304839350660294155220760290173367",
"65574757442712922750091417593499561763",
"153620021877415985403523800096027464249",
"182844235977671408198179800129172022848",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53acbf2facfdfabdc6e6984a1a38f5d38b606a1",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-5fa10ca8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"136103812384858114477933260552053218613",
"115471165163878267193391645109842101678",
"65574757442712922750091417593499561763",
"153620021877415985403523800096027464249",
"182844235977671408198179800129172022848",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60fe70078d6e515f424cb868d07e00411b27fbc",
"target": {
"function": "taprio_reset",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-73e92b89",
"digest": {
"length": 308.0,
"function_hash": "224127896447649954211783179105353906439"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a415d59c1dbec9d772dbfab2d2520d98360caae",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-8da7e54a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"136103812384858114477933260552053218613",
"115471165163878267193391645109842101678",
"100964468227630076686288519911412453402",
"190164895675736489262042080382210198699",
"123783289489799472752454889712567209870",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53acbf2facfdfabdc6e6984a1a38f5d38b606a1",
"target": {
"file": "include/net/sch_generic.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-8dfee10c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139663346128255834691691572382405833874"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60fe70078d6e515f424cb868d07e00411b27fbc",
"target": {
"file": "include/net/sch_generic.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-8f97c66b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69213866375628201252897867452112179320"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"target": {
"function": "taprio_reset",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-9081aa47",
"digest": {
"length": 362.0,
"function_hash": "238940254640301470041361902093778995294"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b2d2820a005e43855fa71b80c4a4b194201c60",
"target": {
"file": "include/net/sch_generic.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-9970e5f5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192509655825836170951238305115121297167"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60fe70078d6e515f424cb868d07e00411b27fbc",
"target": {
"function": "taprio_destroy",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-bf681f8f",
"digest": {
"length": 677.0,
"function_hash": "287326553825580861450655244599233573018"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60fe70078d6e515f424cb868d07e00411b27fbc",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-caa77adc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"136103812384858114477933260552053218613",
"115471165163878267193391645109842101678",
"65574757442712922750091417593499561763",
"153620021877415985403523800096027464249",
"182844235977671408198179800129172022848",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b2d2820a005e43855fa71b80c4a4b194201c60",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-d244c068",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"136103812384858114477933260552053218613",
"115471165163878267193391645109842101678",
"100964468227630076686288519911412453402",
"190164895675736489262042080382210198699",
"123783289489799472752454889712567209870",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53acbf2facfdfabdc6e6984a1a38f5d38b606a1",
"target": {
"function": "taprio_reset",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-ddd88d82",
"digest": {
"length": 308.0,
"function_hash": "224127896447649954211783179105353906439"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a415d59c1dbec9d772dbfab2d2520d98360caae",
"target": {
"function": "taprio_reset",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-de18a086",
"digest": {
"length": 308.0,
"function_hash": "224127896447649954211783179105353906439"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a415d59c1dbec9d772dbfab2d2520d98360caae",
"target": {
"function": "taprio_destroy",
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-e3304ded",
"digest": {
"length": 652.0,
"function_hash": "324094273978664928755599944182071287257"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a415d59c1dbec9d772dbfab2d2520d98360caae",
"target": {
"file": "include/net/sch_generic.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53021-ed1948e8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192509655825836170951238305115121297167"
]
},
"signature_type": "Line"
}
]