Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <20210401093545.4055-1-lyl2019@mail.ustc.edu.cn>
References: <20210401093545.4055-1-lyl2019@mail.ustc.edu.cn>
To:     Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc:     dhowells@redhat.com, davem@davemloft.net, kuba@kernel.org,
        linux-afs@lists.infradead.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] net/rxrpc: Fix a use after free in rxrpc_input_packet
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3723091.1617281658.1@warthog.procyon.org.uk>
Date:   Thu, 01 Apr 2021 13:54:18 +0100
Message-ID: <3723092.1617281658@warthog.procyon.org.uk>
Precedence: bulk

Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote:

> In the case RXRPC_PACKET_TYPE_DATA of rxrpc_input_packet, if
> skb_unshare(skb,..) failed, it will free the skb and return NULL.
> But if skb_unshare() return NULL, the freed skb will be used by
> rxrpc_eaten_skb(skb,..).

That's not precisely the case:

	void rxrpc_eaten_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
	{
		const void *here = __builtin_return_address(0);
		int n = atomic_inc_return(&rxrpc_n_rx_skbs);
		trace_rxrpc_skb(skb, op, 0, n, 0, here);
	}

The only thing that happens to skb here is that it's passed to
trace_rxrpc_skb(), but that doesn't dereference it either.  The *address* is
used for display purposes, but that's all.

> I see that rxrpc_eaten_skb() is used to drop a ref of skb.

It isn't.

> As the skb is already freed in skb_unshare() on error, my patch removes the
> rxrpc_eaten_skb() to avoid the uaf.

But you remove the accounting, which might lead to an assertion failure in
af_rxrpc_exit().

That said, rxrpc_eaten_skb() should probably decrement rxrpc_n_rx_skbs, not
increment it...

David