CVE-2024-47711

In the Linux kernel, the following vulnerability has been resolved:

afunix: Don't return OOB skb in manageoob().

syzbot reported use-after-free in unixstreamrecv_urg(). [0]

The scenario is

1. send(MSG_OOB)
2. recv(MSG_OOB) -> The consumed OOB remains in recv queue
3. send(MSG_OOB)
4. recv() -> manageoob() returns the next skb of the consumed OOB -> This is also OOB, but unixsk(sk)->oob_skb is not cleared
5. recv(MSGOOB) -> unixsk(sk)->oob_skb is used but already freed

The recent commit 8594d9b85c07 ("afunix: Don't call skbget() for OOB skb.") uncovered the issue.

If the OOB skb is consumed and the next skb is peeked in manage_oob(), we still need to check if the skb is OOB.

Let's do so by falling back to the following checks in manage_oob() and add the test case in selftest.

Note that we need to add a similar check for SIOCATMARK.

Read of size 4 at addr ffff8880326abcc4 by task syz-executor178/5235

CPU: 0 UID: 0 PID: 5235 Comm: syz-executor178 Not tainted 6.11.0-rc5-syzkaller-00742-gfbdaffe41adc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:93 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:119 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 unixstreamreadactor+0xa6/0xb0 net/unix/afunix.c:2959 unixstreamrecvurg+0x1df/0x320 net/unix/afunix.c:2640 unixstreamreadgeneric+0x2456/0x2520 net/unix/afunix.c:2778 unixstreamrecvmsg+0x22b/0x2c0 net/unix/afunix.c:2996 sockrecvmsgnosec net/socket.c:1046 [inline] sockrecvmsg+0x22f/0x280 net/socket.c:1068 _sysrecvmsg+0x1db/0x470 net/socket.c:2816 _sysrecvmsg net/socket.c:2858 [inline] _sysrecvmsg+0x2f0/0x3e0 net/socket.c:2888 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f5360d6b4e9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff29b3a458 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007fff29b3a638 RCX: 00007f5360d6b4e9 RDX: 0000000000002001 RSI: 0000000020000640 RDI: 0000000000000003 RBP: 00007f5360dde610 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff29b3a628 R14: 0000000000000001 R15: 0000000000000001 </TASK>

Allocated by task 5235: kasansavestack mm/kasan/common.c:47 [inline] kasansavetrack+0x3f/0x80 mm/kasan/common.c:68 unpoisonslabobject mm/kasan/common.c:312 [inline] kasanslaballoc+0x66/0x80 mm/kasan/common.c:338 kasanslaballoc include/linux/kasan.h:201 [inline] slabpostallochook mm/slub.c:3988 [inline] slaballocnode mm/slub.c:4037 [inline] kmemcacheallocnodenoprof+0x16b/0x320 mm/slub.c:4080 _allocskb+0x1c3/0x440 net/core/skbuff.c:667 allocskb include/linux/skbuff.h:1320 [inline] allocskbwithfrags+0xc3/0x770 net/core/skbuff.c:6528 sockallocsendpskb+0x91a/0xa60 net/core/sock.c:2815 sockallocsendskb include/net/sock.h:1778 [inline] queueoob+0x108/0x680 net/unix/afunix.c:2198 unixstreamsendmsg+0xd24/0xf80 net/unix/afunix.c:2351 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x221/0x270 net/socket.c:745 syssendmsg+0x525/0x7d0 net/socket.c:2597 _syssendmsg net/socket.c:2651 [inline] _syssendmsg+0x2b0/0x3a0 net/socket.c:2680 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f

Freed by task 5235: kasansavestack mm/kasan/common.c:47 ---truncated---