CVE-2023-54193

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: cls_api: remove block_cb from driver_list before freeing<br /> <br /> Error handler of tcf_block_bind() frees the whole bo-&gt;cb_list on error.<br /> However, by that time the flow_block_cb instances are already in the driver<br /> list because driver ndo_setup_tc() callback is called before that up the<br /> call chain in tcf_block_offload_cmd(). This leaves dangling pointers to<br /> freed objects in the list and causes use-after-free[0]. Fix it by also<br /> removing flow_block_cb instances from driver_list before deallocating them.<br /> <br /> [0]:<br /> [ 279.868433] ==================================================================<br /> [ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0<br /> [ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963<br /> <br /> [ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4<br /> [ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014<br /> [ 279.876295] Call Trace:<br /> [ 279.876882] <br /> [ 279.877413] dump_stack_lvl+0x33/0x50<br /> [ 279.878198] print_report+0xc2/0x610<br /> [ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0<br /> [ 279.879994] kasan_report+0xae/0xe0<br /> [ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0<br /> [ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]<br /> [ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0<br /> [ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0<br /> [ 279.885037] ? tcf_block_setup+0x6b0/0x6b0<br /> [ 279.885901] ? mutex_lock+0x7d/0xd0<br /> [ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0<br /> [ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress]<br /> [ 279.888846] tcf_block_get_ext+0x61c/0x1200<br /> [ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress]<br /> [ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress]<br /> [ 279.891701] qdisc_create+0x401/0xea0<br /> [ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470<br /> [ 279.893473] tc_modify_qdisc+0x6f7/0x16d0<br /> [ 279.894344] ? tc_get_qdisc+0xac0/0xac0<br /> [ 279.895213] ? mutex_lock+0x7d/0xd0<br /> [ 279.896005] ? __mutex_lock_slowpath+0x10/0x10<br /> [ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0<br /> [ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0<br /> [ 279.898672] ? __sys_sendmsg+0xb5/0x140<br /> [ 279.899494] ? do_syscall_64+0x3d/0x90<br /> [ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0<br /> [ 279.901337] ? kasan_save_stack+0x2e/0x40<br /> [ 279.902177] ? kasan_save_stack+0x1e/0x40<br /> [ 279.903058] ? kasan_set_track+0x21/0x30<br /> [ 279.903913] ? kasan_save_free_info+0x2a/0x40<br /> [ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0<br /> [ 279.905741] ? kmem_cache_free+0x179/0x400<br /> [ 279.906599] netlink_rcv_skb+0x12c/0x360<br /> [ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0<br /> [ 279.908360] ? netlink_ack+0x1550/0x1550<br /> [ 279.909192] ? rhashtable_walk_peek+0x170/0x170<br /> [ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390<br /> [ 279.911086] ? _copy_from_iter+0x3d6/0xc70<br /> [ 279.912031] netlink_unicast+0x553/0x790<br /> [ 279.912864] ? netlink_attachskb+0x6a0/0x6a0<br /> [ 279.913763] ? netlink_recvmsg+0x416/0xb50<br /> [ 279.914627] netlink_sendmsg+0x7a1/0xcb0<br /> [ 279.915473] ? netlink_unicast+0x790/0x790<br /> [ 279.916334] ? iovec_from_user.part.0+0x4d/0x220<br /> [ 279.917293] ? netlink_unicast+0x790/0x790<br /> [ 279.918159] sock_sendmsg+0xc5/0x190<br /> [ 279.918938] ____sys_sendmsg+0x535/0x6b0<br /> [ 279.919813] ? import_iovec+0x7/0x10<br /> [ 279.920601] ? kernel_sendmsg+0x30/0x30<br /> [ 279.921423] ? __copy_msghdr+0x3c0/0x3c0<br /> [ 279.922254] ? import_iovec+0x7/0x10<br /> [ 279.923041] ___sys_sendmsg+0xeb/0x170<br /> [ 279.923854] ? copy_msghdr_from_user+0x110/0x110<br /> [ 279.924797] ? ___sys_recvmsg+0xd9/0x130<br /> [ 279.925630] ? __perf_event_task_sched_in+0x183/0x470<br /> [ 279.926656] ? ___sys_sendmsg+0x170/0x170<br /> [ 279.927529] ? ctx_sched_in+0x530/0x530<br /> [ 279.928369] ? update_curr+0x283/0x4f0<br /> [ 279.929185] ? perf_event_update_userpage+0x570/0x570<br /> [ 279.930201] ? __fget_light+0x57/0x520<br /> [ 279.931023] ? __switch_to+0x53d/0xe70<br /> [ 27<br /> ---truncated---