unregister_ip_vs_app() removes each incarnation from its protocol list and
uses call_rcu() to defer freeing it, but frees the parent application
immediately. An RCU reader that already found an incarnation can still
access the parent through inc->app in ip_vs_app_inc_get().
During FTP helper module unload, the following interleaving is possible:
CPU 0 (RCU reader) CPU 1 (module unload)
tcp_app_conn_bind()
find inc in protocol list
unregister_ip_vs_app()
ip_vs_app_inc_release(inc)
list_del_rcu(&inc->p_list)
call_rcu(&inc->rcu_head, ...)
kfree(a)
ip_vs_app_inc_get(inc)
try_module_get(inc->app->module)
The helper module is already going away, so try_module_get() would fail,
but evaluating its argument first reads the freed parent. The subsequent
rcu_barrier() in pernet unregistration cannot protect this earlier free.
KASAN reported:
BUG: KASAN: slab-use-after-free in ip_vs_app_inc_get+0x7c/0x90
Call Trace:
ip_vs_app_inc_get+0x7c/0x90
tcp_app_conn_bind+0x1bc/0x290
ip_vs_conn_new+0x1915/0x20d0
ip_vs_schedule+0x697/0xea0
tcp_conn_schedule+0x489/0x820
ip_vs_in_hook+0x7bf/0x1f40
Allocated by task 88:
kmemdup_noprof+0x20/0x50
register_ip_vs_app+0x12d/0x2c0
__ip_vs_ftp_init+0x56/0x160 [ip_vs_ftp]
Freed by task 104:
kfree+0x131/0x3c0
unregister_ip_vs_app+0x2f4/0x5b0
unregister_pernet_operations+0x232/0x490
unregister_pernet_subsys+0x1c/0x30
__do_sys_delete_module+0x346/0x510
Use kfree_rcu() with the existing rcu_head to keep the parent alive until
these readers finish. Successful helper references already prevent normal
module unload, and incarnation RCU callbacks do not access the parent.
Fixes: 363c97d7435e ("ipvs: convert app locks")
Cc: [email protected]
Signed-off-by: Chengfeng Ye <[email protected]>
---
net/netfilter/ipvs/ip_vs_app.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 11cbdbaf561d..2c1b47702da2 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -242,7 +242,7 @@ void unregister_ip_vs_app(struct netns_ipvs *ipvs, struct
ip_vs_app *app)
}
list_del(&a->a_list);
- kfree(a);
+ kfree_rcu(a, rcu_head);
/* decrease the module use count */
ip_vs_use_count_dec();
--
2.43.0
