[PATCH net] wireguard: fix use-after-free in root_remove_peer_lists

[Eric Dumazet]

On 2/3/20 10:17 AM, Eric Dumazet wrote:
> 
> 
> On 2/3/20 9:29 AM, Jason A. Donenfeld wrote:
>> Hi Eric,
>>
>> On Mon, Feb 3, 2020 at 6:19 PM Eric Dumazet <edumazet at google.com> wrote:
>>> diff --git a/drivers/net/wireguard/allowedips.c b/drivers/net/wireguard/allowedips.c
>>> index 121d9ea0f13584f801ab895753e936c0a12f0028..3725e9cd85f4f2797afd59f42af454acc107aa9a 100644
>>> --- a/drivers/net/wireguard/allowedips.c
>>> +++ b/drivers/net/wireguard/allowedips.c
>>> @@ -263,6 +263,7 @@ static int add(struct allowedips_node __rcu **trie, u8 bits, const u8 *key,
>>>         } else {
>>>                 node = kzalloc(sizeof(*node), GFP_KERNEL);
>>>                 if (unlikely(!node)) {
>>> +                       list_del(&newnode->peer_list);
>>>                         kfree(newnode);
>>>                         return -ENOMEM;
>>>                 }
>>> --
>>> 2.25.0.341.g760bfbb309-goog
>>
>> Thanks, nice catch. I remember switching that code over to using the
>> peer_list somewhat recently and embarrassed I missed this. Glad to see
>> WireGuard is hooked up to syzkaller.
>>
> 
> I will let you work on a lockdep issue that syzbot found :)
> 

BTW wireguard at lists.zx2c4.com  seems to be a moderated list...

You might document this.

diff --git a/MAINTAINERS b/MAINTAINERS
index 0ae68fb8d38f167ae4a4b8ab49e27946393641e5..890d1f3e698e4c2475eadcd4a462768391328dd7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -18040,7 +18040,7 @@ M:      Jason A. Donenfeld <Jason at zx2c4.com>
 S:     Maintained
 F:     drivers/net/wireguard/
 F:     tools/testing/selftests/wireguard/
-L:     wireguard at lists.zx2c4.com
+L:     wireguard at lists.zx2c4.com (moderated for non-subscribers)
 L:     netdev at vger.kernel.org
 
 WISTRON LAPTOP BUTTON DRIVER