Received: by 10.223.176.5 with SMTP id f5csp701261wra; Fri, 9 Feb 2018 05:56:48 -0800 (PST) X-Google-Smtp-Source: AH8x226gWmR7YLxawNmDygZxvP+aI1s87JPgPBZdSLO398nLOnwjGUmzRHb4aQqEtNPHX1YE0GhY X-Received: by 10.99.177.4 with SMTP id r4mr2440411pgf.245.1518184607885; Fri, 09 Feb 2018 05:56:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1518184607; cv=none; d=google.com; s=arc-20160816; b=xfIzoObHcddDQKdIaXZ+IgS0H72bO/YACw9yjN5l0EVk6wa02tinyInXSucoQVTqfY 9mujoWr0kWba3XChNTUhnTS/2yFvTvXrdOeQNaqlWHFGo69bkUq+EzK317FiDQvTUivT 4zdPE0bPs4i2nXuReoDpGDL0nxIU5Wg14f23ytbNReff9Hk8fDZ+OPks+yJXRe0Z/wsy FZkMkDnR3jtW3aZ2oFSJX6r9x9R1gUflUjwvkxtmCkyFZ/GCnR9Zdg1JOyDCKWBNJvI5 5iyzMaXMzBggIH9cU7QNaysdEnliW8NZWdgXLGQ8DvwPCC6QVCUFMJ66TrJzydjW9YJ1 XIlw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=o0X7OHthX46YuIhrXiBUTSp1gsU6H7de3lu3M3Su6/o=; b=q+zec/G630R/X1tFTBhq/mgsJwSl6/q4q0o4rIZhZhUockKaPOMH8HtGXN4w+LdKc2 ckEMdax1Lbu8Qq4JzVL2ucnFgPgVr165Ul/MKosDAeXS0x9caXLiWuJ4uzutcy31eEMO svLcTGbHJQ4+YZjLpeiyFLODqJIIQeMIMSCuiIXEUZdhV1ZPV7iMBGjQPKPrvvDeuQCS KO3kV5cTMQRsfSXfST4P6ltHOPWn492oi3Er5jvSAocUZCnFXXimFhHqkBL0EOSeDiUs ygSHF6gr51pohpo/0aa07egfjTGmydWWzcilVgTIGZkeTFhuQotk8kY+GVB2ZwS+UsGh putA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 99-v6si1607300plf.440.2018.02.09.05.56.33; Fri, 09 Feb 2018 05:56:47 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753022AbeBINyJ (ORCPT + 99 others); Fri, 9 Feb 2018 08:54:09 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:51978 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932117AbeBINpr (ORCPT ); Fri, 9 Feb 2018 08:45:47 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id CB94110FD; Fri, 9 Feb 2018 13:45:46 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 4.14 05/22] net: igmp: add a missing rcu locking section Date: Fri, 9 Feb 2018 14:39:54 +0100 Message-Id: <20180209133934.423549422@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180209133934.024795822@linuxfoundation.org> References: <20180209133934.024795822@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit e7aadb27a5415e8125834b84a74477bfbee4eff5 ] Newly added igmpv3_get_srcaddr() needs to be called under rcu lock. Timer callbacks do not ensure this locking. ============================= WARNING: suspicious RCU usage 4.15.0+ #200 Not tainted ----------------------------- ./include/linux/inetdevice.h:216 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by syzkaller616973/4074: #0: (&mm->mmap_sem){++++}, at: [<00000000bfce669e>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1355 #1: ((&im->timer)){+.-.}, at: [<00000000619d2f71>] lockdep_copy_map include/linux/lockdep.h:178 [inline] #1: ((&im->timer)){+.-.}, at: [<00000000619d2f71>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1316 #2: (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] spin_lock_bh include/linux/spinlock.h:315 [inline] #2: (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] igmpv3_send_report+0x98/0x5b0 net/ipv4/igmp.c:600 stack backtrace: CPU: 0 PID: 4074 Comm: syzkaller616973 Not tainted 4.15.0+ #200 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 __in_dev_get_rcu include/linux/inetdevice.h:216 [inline] igmpv3_get_srcaddr net/ipv4/igmp.c:329 [inline] igmpv3_newpack+0xeef/0x12e0 net/ipv4/igmp.c:389 add_grhead.isra.27+0x235/0x300 net/ipv4/igmp.c:432 add_grec+0xbd3/0x1170 net/ipv4/igmp.c:565 igmpv3_send_report+0xd5/0x5b0 net/ipv4/igmp.c:605 igmp_send_report+0xc43/0x1050 net/ipv4/igmp.c:722 igmp_timer_expire+0x322/0x5c0 net/ipv4/igmp.c:831 call_timer_fn+0x228/0x820 kernel/time/timer.c:1326 expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:541 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938 Fixes: a46182b00290 ("net: igmp: Use correct source address on IGMPv3 reports") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/igmp.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -386,7 +386,11 @@ static struct sk_buff *igmpv3_newpack(st pip->frag_off = htons(IP_DF); pip->ttl = 1; pip->daddr = fl4.daddr; + + rcu_read_lock(); pip->saddr = igmpv3_get_srcaddr(dev, &fl4); + rcu_read_unlock(); + pip->protocol = IPPROTO_IGMP; pip->tot_len = 0; /* filled in later */ ip_select_ident(net, skb, NULL);