Skip to contentSkip to conversation

Patch "vxlan: fix use-after-free on deletion" has been added to the 4.11-stable tree

PATCH [email protected] 1 participant 1 message Jun 8, 2017

Subsystems (2)
Network drivers Stable branch
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

vxlan: fix use-after-free on deletion

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
vxlan-fix-use-after-free-on-deletion.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Jun 8 08:58:08 CEST 2017

From: Mark Bloch <[email protected]>
Date: Fri, 2 Jun 2017 03:24:08 +0300
Subject: vxlan: fix use-after-free on deletion

From: Mark Bloch <[email protected]>

[ Upstream commit a53cb29b0af346af44e4abf13d7e59f807fba690 ]

Adding a vxlan interface to a socket isn't symmetrical, while adding is done in vxlan_open() the deletion is done in vxlan_dellink(). This can cause a use-after-free error when we close the vxlan interface before deleting it.

We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call it from vxlan_stop() to match the call from vxlan_open().

Fixes 56ef9c909b40 ("vxlan: Move socket initialization to within rtnl scope")
Acked-by Jiri Benc <[email protected]>
Tested-by Roi Dayan <[email protected]>
Signed-off-by Mark Bloch <[email protected]>
Acked-by Roopa Prabhu <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/vxlan.c |   19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/vxlan.c +13 -6
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN +
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
 	struct list_head  vxlan_list;

@@ -1081,6 +1083,8 @@ static void vxlan_sock_release(struct vx
 	rcu_assign_pointer(vxlan->vn4_sock, NULL);
 	synchronize_net();
 
+	vxlan_vs_del_dev(vxlan);
+
 	if (__vxlan_sock_release_prep(sock4)) {
 		udp_tunnel_sock_release(sock4->sock);
 		kfree(sock4);

@@ -2352,6 +2356,15 @@ static void vxlan_cleanup(unsigned long
 	mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+	spin_lock(&vn->sock_lock);
+	hlist_del_init_rcu(&vxlan->hlist);
+	spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
 	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);

@@ -3289,15 +3302,9 @@ static int vxlan_changelink(struct net_d
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
 	struct vxlan_dev *vxlan = netdev_priv(dev);
-	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
 	vxlan_flush(vxlan, true);
 
-	spin_lock(&vn->sock_lock);
-	if (!hlist_unhashed(&vxlan->hlist))
-		hlist_del_rcu(&vxlan->hlist);
-	spin_unlock(&vn->sock_lock);
-
 	gro_cells_destroy(&vxlan->gro_cells);
 	list_del(&vxlan->next);
 	unregister_netdevice_queue(dev, head);

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/vxlan-fix-use-after-free-on-deletion.patch