[PATCH 3.16 032/294] netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry

[Ben Hutchings]

3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Sabrina Dubroca 

commit 3840538ad384fb7891adeeaf36624f870c51fc0e upstream.

When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is
called first, removing /proc/net/ipt_CLUSTERIP.
Then clusterip_config_entry_put() is called from clusterip_tg_destroy(),
and tries to remove its entry under /proc/net/ipt_CLUSTERIP/.

Fix this by checking that the parent directory of the entry to remove
hasn't already been deleted.

The following triggers a KASAN splat (stealing the reproducer from
202f59afd441, thanks to Jianlin Shi and Xin Long):

ip netns add test
ip link add veth0_in type veth peer name veth0_out
ip link set veth0_in netns test
ip netns exec test ip link set lo up
ip netns exec test ip link set veth0_in up
ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j \
CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \
--local-node 1 --hashmode sourceip-sourceport
ip netns del test

Fixes: ce4ff76c15a8 ("netfilter: ipt_CLUSTERIP: make proc directory per net 
namespace")
Signed-off-by: Sabrina Dubroca 
Reviewed-by: Xin Long 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/netfilter/ipt_CLUSTERIP.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -115,7 +115,8 @@ clusterip_config_entry_put(struct cluste
 * functions are also incrementing the refcount on their own,
 * so it's safe to remove the entry even if it's in use. */
 #ifdef CONFIG_PROC_FS
-   proc_remove(c->pde);
+   if (cn->procdir)
+   proc_remove(c->pde);
 #endif
return;
}
@@ -735,6 +736,7 @@ static void clusterip_net_exit(struct ne
 #ifdef CONFIG_PROC_FS
struct clusterip_net *cn = net_generic(net, clusterip_net_id);
proc_remove(cn->procdir);
+   cn->procdir = NULL;
 #endif
 }
 

[PATCH 3.16 032/294] netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry

[Ben Hutchings]

3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Sabrina Dubroca 

commit 3840538ad384fb7891adeeaf36624f870c51fc0e upstream.

When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is
called first, removing /proc/net/ipt_CLUSTERIP.
Then clusterip_config_entry_put() is called from clusterip_tg_destroy(),
and tries to remove its entry under /proc/net/ipt_CLUSTERIP/.

Fix this by checking that the parent directory of the entry to remove
hasn't already been deleted.

The following triggers a KASAN splat (stealing the reproducer from
202f59afd441, thanks to Jianlin Shi and Xin Long):

ip netns add test
ip link add veth0_in type veth peer name veth0_out
ip link set veth0_in netns test
ip netns exec test ip link set lo up
ip netns exec test ip link set veth0_in up
ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j \
CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \
--local-node 1 --hashmode sourceip-sourceport
ip netns del test

Fixes: ce4ff76c15a8 ("netfilter: ipt_CLUSTERIP: make proc directory per net 
namespace")
Signed-off-by: Sabrina Dubroca 
Reviewed-by: Xin Long 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/netfilter/ipt_CLUSTERIP.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -115,7 +115,8 @@ clusterip_config_entry_put(struct cluste
 * functions are also incrementing the refcount on their own,
 * so it's safe to remove the entry even if it's in use. */
 #ifdef CONFIG_PROC_FS
-   proc_remove(c->pde);
+   if (cn->procdir)
+   proc_remove(c->pde);
 #endif
return;
}
@@ -735,6 +736,7 @@ static void clusterip_net_exit(struct ne
 #ifdef CONFIG_PROC_FS
struct clusterip_net *cn = net_generic(net, clusterip_net_id);
proc_remove(cn->procdir);
+   cn->procdir = NULL;
 #endif
 }