ACK: [SRU][F/J/N][PATCH v2 0/1] CVE-2024-56658

[Koichiro Den]

On Tue, Feb 18, 2025 at 02:14:26PM GMT, Massimiliano Pellizzer wrote:
> [Impact]
> 
> net: defer final 'struct net' free in netns dismantle
> 
> BUG: KASAN: slab-use-after-free in dst_destroy
> 
> Issue is in xfrm6_net_init() and xfrm4_net_init() :
> 
> They copy xfrm[46]_dst_ops_template into net->xfrm.xfrm[46]_dst_ops.
> 
> But net structure might be freed before all the dst callbacks are
> called. So when dst_destroy() calls later :
> 
> if (dst->ops->destroy)
>     dst->ops->destroy(dst);
> 
> dst->ops points to the old net->xfrm.xfrm[46]_dst_ops, which has been freed.
> 
> See a relevant issue fixed in :
> 
> ac888d58869b ("net: do not delay dst_entries_add() in dst_release()")
> 
> A fix is to queue the 'struct net' to be freed after one
> another cleanup_net() round (and existing rcu_barrier())
> 
> [Fix]
> 
> Oracular: Fixed via upstream stable updates (LP: #2097332)
> Noble: Cherry picked from mainline
> Jammy: Backported from mainline
> Focal: Applied Jammy patch
> 
> [Test case]
> 
> Compiled and boot tested.
> Tested basic net namespace functionalities:
> 
> $ sudo ip netns add client
> $ sudo ip netns add server
> $ sudo ip link add veth1 type veth peer name veth2
> $ sudo ip link set dev veth1 netns server
> $ sudo ip link set dev veth2 netns client
> $ sudo ip netns exec server ip addr add dev veth1 192.168.99.1/24
> $ sudo ip netns exec client ip addr add dev veth2 192.168.99.2/24
> $ sudo ip netns exec server ip link set dev veth1 up
> $ sudo ip netns exec client ip link set dev veth2 up
> $ sudo ip netns exec client ip a
> 3: veth2 at if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
>     link/ether 8a:06:9e:c4:14:d0 brd ff:ff:ff:ff:ff:ff link-netns server
>     inet 192.168.99.2/24 scope global veth2
>        valid_lft forever preferred_lft forever
> $ sudo ip netns exec server ip a
> 4: veth1 at if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
>     link/ether 42:3d:3b:37:38:93 brd ff:ff:ff:ff:ff:ff link-netns client
>     inet 192.168.99.1/24 scope global veth1
>        valid_lft forever preferred_lft forever
> $ sudo ip netns exec server iperf -s &
> $ sudo ip netns exec client iperf -c 192.168.99.1
> [  1] local 192.168.99.2 port 37994 connected with 192.168.99.1 port 5001 (icwnd/mss/irtt=14/1448/37)
> [ ID] Interval       Transfer     Bandwidth
> [  1] 0.0000-10.0029 sec  34.1 GBytes  29.3 Gbits/sec
> $ sudo ip netns exec server ip link set veth1 netns 1
> $ sudo ip netns exec client ip link set veth2 netns 1
> $ sudo ip netns delete client
> $ sudo ip netns delete server
> 
> [Where problems could occur]
> 
> The fix affects the network namespace subsystem. An issue with this fix
> may lead to incorrect handling of network namespace cleanup and resource
> deallocation. A user might experience problems such as unexpected
> crashes when deleting network namespaces and lingering network
> interfaces that are not properly released. Additionally, network
> isolation between namespaces may be compromised.
> 
> [Changes between v1 and v2]
> 
> Focal code base changed between the submission and the review.
> In particular, a recent upstream pull (LP: #2098439) backported the
> commit 41467d2ff4dfe ("net: net_namespace: Optimize the code").
> Adjusted Focal patch accordingly.
> 
> Eric Dumazet (1):
>   net: defer final 'struct net' free in netns dismantle
> 
>  include/net/net_namespace.h |  1 +
>  net/core/net_namespace.c    | 21 ++++++++++++++++++++-
>  2 files changed, 21 insertions(+), 1 deletion(-)
> 

Acked-by: Koichiro Den <koichiro.den at canonical.com>