Patch "wireguard: netlink: check for dangling peer via is_dead instead of empty list" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wireguard: netlink: check for dangling peer via is_dead instead of empty list

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wireguard-netlink-check-for-dangling-peer-via-is_dea.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 54f5e69c716530b09a24c8c888619459b478c8ee
Author: Jason A. Donenfeld <Jason@xxxxxxxxx>
Date:   Thu Mar 14 16:49:09 2024 -0600

    wireguard: netlink: check for dangling peer via is_dead instead of empty list
    
    [ Upstream commit 55b6c738673871c9b0edae05d0c97995c1ff08c4 ]
    
    If all peers are removed via wg_peer_remove_all(), rather than setting
    peer_list to empty, the peer is added to a temporary list with a head on
    the stack of wg_peer_remove_all(). If a netlink dump is resumed and the
    cursored peer is one that has been removed via wg_peer_remove_all(), it
    will iterate from that peer and then attempt to dump freed peers.
    
    Fix this by instead checking peer->is_dead, which was explictly created
    for this purpose. Also move up the device_update_lock lockdep assertion,
    since reading is_dead relies on that.
    
    It can be reproduced by a small script like:
    
        echo "Setting config..."
        ip link add dev wg0 type wireguard
        wg setconf wg0 /big-config
        (
                while true; do
                        echo "Showing config..."
                        wg showconf wg0 > /dev/null
                done
        ) &
        sleep 4
        wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n")
    
    Resulting in:
    
        BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
        Read of size 8 at addr ffff88811956ec70 by task wg/59
        CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
        Call Trace:
         <TASK>
         dump_stack_lvl+0x47/0x70
         print_address_description.constprop.0+0x2c/0x380
         print_report+0xab/0x250
         kasan_report+0xba/0xf0
         __lock_acquire+0x182a/0x1b20
         lock_acquire+0x191/0x4b0
         down_read+0x80/0x440
         get_peer+0x140/0xcb0
         wg_get_device_dump+0x471/0x1130
    
    Cc: stable@xxxxxxxxxxxxxxx
    Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
    Reported-by: Lillian Berry <lillian@xxxxxxxxxxxx>
    Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
index dc09b75a32485..12d80306ff3bc 100644
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -255,17 +255,17 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb)
 	if (!peers_nest)
 		goto out;
 	ret = 0;
-	/* If the last cursor was removed via list_del_init in peer_remove, then
+	lockdep_assert_held(&wg->device_update_lock);
+	/* If the last cursor was removed in peer_remove or peer_remove_all, then
 	 * we just treat this the same as there being no more peers left. The
 	 * reason is that seq_nr should indicate to userspace that this isn't a
 	 * coherent dump anyway, so they'll try again.
 	 */
 	if (list_empty(&wg->peer_list) ||
-	    (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) {
+	    (ctx->next_peer && ctx->next_peer->is_dead)) {
 		nla_nest_cancel(skb, peers_nest);
 		goto out;
 	}
-	lockdep_assert_held(&wg->device_update_lock);
 	peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list);
 	list_for_each_entry_continue(peer, &wg->peer_list, peer_list) {
 		if (get_peer(peer, skb, ctx)) {




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux