CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer().

In the Linux kernel, the following vulnerability has been resolved:

tipc: Fix use-after-free of kernel socket in cleanupbearer().

syzkaller reported a use-after-free of UDP kernel socket in cleanupbearer() without repro. [0][1]

When bearerdisable() calls tipcudpdisable(), cleanup of the UDP kernel socket is deferred by work calling cleanupbearer().

tipcnetstop() waits for such works to finish by checking tipcnet(net)->wqcount. However, the work decrements the count too early before releasing the kernel socket, unblocking cleanupnet() and resulting in use-after-free.

Let's move the decrement after releasing the socket in cleanupbearer().

[0]: reftracker: net notrefcnt@000000009b3d1faf has 1/1 users at skalloc+0x438/0x608 inetcreate+0x4c8/0xcb0 sockcreate+0x350/0x6b8 sockcreatekern+0x58/0x78 udpsockcreate4+0x68/0x398 udpsockcreate+0x88/0xc8 tipcudpenable+0x5e8/0x848 tipcnlbearerenable+0x84c/0xed8 tipcnlbearerenable+0x38/0x60 genlfamilyrcvmsgdoit+0x170/0x248 genlrcvmsg+0x400/0x5b0 netlinkrcvskb+0x1dc/0x398 genlrcv+0x44/0x68 netlinkunicast+0x678/0x8b0 netlinksendmsg+0x5e4/0x898 syssendmsg+0x500/0x830

[1]: BUG: KMSAN: use-after-free in udphashslot include/net/udp.h:85 [inline] BUG: KMSAN: use-after-free in udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 udphashslot include/net/udp.h:85 [inline] udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 skcommonrelease+0xaf/0x3f0 net/core/sock.c:3820 inetrelease+0x1e0/0x260 net/ipv4/afinet.c:437 inet6release+0x6f/0xd0 net/ipv6/afinet6.c:489 sockrelease net/socket.c:658 [inline] sockrelease+0xa0/0x210 net/socket.c:686 cleanupbearer+0x42d/0x4c0 net/tipc/udpmedia.c:819 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:244

Uninit was created at: slabfreehook mm/slub.c:2269 [inline] slabfree mm/slub.c:4580 [inline] kmemcachefree+0x207/0xc40 mm/slub.c:4682 netfree net/core/netnamespace.c:454 [inline] cleanupnet+0x16f2/0x19d0 net/core/netnamespace.c:647 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:244

CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: events cleanupbearer

— Red Hat

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad