cve/published/2022/CVE-2022-49871.mbox

From bippy-1.1.0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@kernel.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49871: net: tun: Fix memory leaks of napi_get_frags

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix memory leaks of napi_get_frags

kmemleak reports after running test_progs:

unreferenced object 0xffff8881b1672dc0 (size 232):
  comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s)
  hex dump (first 32 bytes):
    e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff  .........,g.....
    00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............
  backtrace:
    [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150
    [<0000000041c7fc09>] __napi_build_skb+0x15/0x50
    [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540
    [<000000003ecfa30e>] napi_get_frags+0x59/0x140
    [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun]
    [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun]
    [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320
    [<000000008f338ea2>] do_iter_write+0x135/0x630
    [<000000008a3377a4>] vfs_writev+0x12e/0x440
    [<00000000a6b5639a>] do_writev+0x104/0x280
    [<00000000ccf065d8>] do_syscall_64+0x3b/0x90
    [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue occurs in the following scenarios:
tun_get_user()
  napi_gro_frags()
    napi_frags_finish()
      case GRO_NORMAL:
        gro_normal_one()
          list_add_tail(&skb->list, &napi->rx_list);
          <-- While napi->rx_count < READ_ONCE(gro_normal_batch),
          <-- gro_normal_list() is not called, napi->rx_list is not empty
  <-- not ask to complete the gro work, will cause memory leaks in
  <-- following tun_napi_del()
...
tun_napi_del()
  netif_napi_del()
    __netif_napi_del()
    <-- &napi->rx_list is not empty, which caused memory leaks

To fix, add napi_complete() after napi_gro_frags().

The Linux kernel CVE team has assigned CVE-2022-49871 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 4.19.267 with commit 223ef6a94e52331a6a7ef31e59921e0e82d2d40a
	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 5.4.225 with commit a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755
	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 5.10.155 with commit 3401f964028ac941425b9b2c8ff8a022539ef44a
	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 5.15.79 with commit d7569302a7a52a9305d2fb054df908ff985553bb
	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 6.0.9 with commit 8b12a020b20a78f62bedc50f26db3bf4fadf8cb9
	Issue introduced in 4.15 with commit 90e33d45940793def6f773b2d528e9f3c84ffdc7 and fixed in 6.1 with commit 1118b2049d77ca0b505775fc1a8d1909cf19a7ec

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49871
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/tun.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a
	https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755
	https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a
	https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb
	https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9
	https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec