Received-SPF: pass (google.com: domain of linux-kernel+bounces-100283-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Tue, 12 Mar 2024 14:21:07 +0100
From: Florian Westphal <fw@strlen.de>
To: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>, xingwei lee <xrivendell7@gmail.com>,
	pabeni@redhat.com, davem@davemloft.net, kuba@kernel.org,
	linux-hams@vger.kernel.org, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, ralf@linux-mips.org,
	syzkaller-bugs@googlegroups.com, samsun1006219@gmail.com
Subject: Re: KASAN: slab-use-after-free Read in ip_finish_output
Message-ID: <20240312132107.GA1529@breakpoint.cc>
References: <CABOYnLwtfAxS7WoMw-1_uxVe3EYajXRuzZfwaQEk0+7m6-B+ug@mail.gmail.com>
 <CANn89i+qLwyPLztPt6Mavjimyv0H_UihVVNfJXWLjcwrqOudTw@mail.gmail.com>
 <20240306103632.GC4420@breakpoint.cc>
 <CANn89iLe0KGjbSim5Qxxr6o0AjJVs7-h79UvMMXKOgGKQUosiA@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CANn89iLe0KGjbSim5Qxxr6o0AjJVs7-h79UvMMXKOgGKQUosiA@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)

Eric Dumazet <edumazet@google.com> wrote:
> > so skb->sk gets propagated down to __ip_finish_output(), long
> > after connrack defrag has called skb_orphan().
> >
> > No idea yet how to fix it,
> 
> My plan was to refine "inet: frag: Always orphan skbs inside
> ip_defrag()" and only do the skb_orphan()
> for skb added to a frag_list.
> 
> The head skb would keep a reference to the socket.

I tried to follow this but its beyond my abilities.

Defrag messes with skb->truesize, and I do not know how to
fix that up safely so later calls to destructor won't underflow sk
accouting.

Furthermore, depending on delivery order, the skb that gets
passed to rest of stack might not be the head skb (the one with
full l4 header and sk reference), its always the last one that arrived.

Existing code skb_morphs() this, see inet_frag_reasm_prepare() and also
the ->truesize munging (which is fine only because all skbs are
orphans...).

So in order to not pass already-released sk to inet output somehow
the skb->sk reference needs to be stolen and moved from one sk
to another.

No idea how to do this, let alone do regression testing for this.
see e.g. 48cac18ecf1de82f76259a54402c3adb7839ad01 which added
unconditional orphaning in ipv6 netfilter defrag.

ATM the only "solution" I see is to completely remove netfilter defrag
support for outgoing packets.