Commit d3e3c516 authored by Eric Dumazet's avatar Eric Dumazet Committed by Liu Jian
Browse files

net: do not delay dst_entries_add() in dst_release() 

stable inclusion
from stable-v6.6.57
commit eae7435b48ffc8e9be0ff9cfeae40af479a609dd
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ8
CVE: CVE-2024-50036

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=eae7435b48ffc8e9be0ff9cfeae40af479a609dd

-------------------------------------------------

[ Upstream commit ac888d58869bb99753e7652be19a151df9ecb35d ]

dst_entries_add() uses per-cpu data that might be freed at netns
dismantle from ip6_route_net_exit() calling dst_entries_destroy()

Before ip6_route_net_exit() can be called, we release all
the dsts associated with this netns, via calls to dst_release(),
which waits an rcu grace period before calling dst_destroy()

dst_entries_add() use in dst_destroy() is racy, because
dst_entries_destroy() could have been called already.

Decrementing the number of dsts must happen sooner.

Notes:

1) in CONFIG_XFRM case, dst_destroy() can call
   dst_release_immediate(child), this might also cause UAF
   if the child does not have DST_NOCOUNT set.
   IPSEC maintainers might take a look and see how to address this.

2) There is also discussion about removing this count of dst,
   which might happen in future kernels.

Fixes: f8864972 ("ipv4: fix dst race in sk_dst_get()")
Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnkjaL=w@mail.gmail.com/T/


Reported-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
Tested-by: default avatarLinux Kernel Functional Testing <lkft@linaro.org>
Tested-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20241008143110.1064899-1-edumazet@google.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent a42fc9da

net/core/dst.c

+12 −5
Original line number Diff line number Diff line
@@ -109,9 +109,6 @@ struct dst_entry *dst_destroy(struct dst_entry * dst) 
		child = xdst->child;

	}

#endif

	if (!(dst->flags & DST_NOCOUNT))

		dst_entries_add(dst->ops, -1);



	if (dst->ops->destroy)

		dst->ops->destroy(dst);

	netdev_put(dst->dev, &dst->dev_tracker);
@@ -161,18 +158,28 @@ void dst_dev_put(struct dst_entry *dst) 
}

EXPORT_SYMBOL(dst_dev_put);



static void dst_count_dec(struct dst_entry *dst)

{

	if (!(dst->flags & DST_NOCOUNT))

		dst_entries_add(dst->ops, -1);

}



void dst_release(struct dst_entry *dst)

{

	if (dst && rcuref_put(&dst->__rcuref))

	if (dst && rcuref_put(&dst->__rcuref)) {

		dst_count_dec(dst);

		call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);

	}

}

EXPORT_SYMBOL(dst_release);



void dst_release_immediate(struct dst_entry *dst)

{

	if (dst && rcuref_put(&dst->__rcuref))

	if (dst && rcuref_put(&dst->__rcuref)) {

		dst_count_dec(dst);

		dst_destroy(dst);

	}

}

EXPORT_SYMBOL(dst_release_immediate);



u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)