Received: by 10.223.185.116 with SMTP id b49csp1086649wrg; Fri, 23 Feb 2018 11:41:20 -0800 (PST) X-Google-Smtp-Source: AH8x226HdbviJn3G+AXI47/pHrWzOknUhLlHPwe17KGU4s9MVcff5nthYXrd05yvlebv2i58Vlu3 X-Received: by 2002:a17:902:8c93:: with SMTP id t19-v6mr1877521plo.304.1519414880301; Fri, 23 Feb 2018 11:41:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414880; cv=none; d=google.com; s=arc-20160816; b=wzZb5QTbH5IbEISbv93at0xNWb2Ygqeg8rEG4kF4jYQn4q0aBhgl0lXQSlP7q2ApCE 3isRVyI4BynpKtVzLxOgc/pkTlwtsO7Awrz/LqQYg6hC/mxwactgTzaSOt86SHL6thPD lvWbJa7fWNXCJMgL9lyRRarD2r0CbYDHAgrqIWz4/Oq7pzi9KxhbHQFR1gtNirY8xkqG TcLDpSZ9tbZ/BDzhlngxnqo6Kt3gTW+IkhPniE0uZyz+fp5pydb+y3pK1VdD/WdCAdMm hi75pOgrinoHytkM2IvBHJ/uly9BHMOiP1lKEF8mnyOAci+b0p/28ZLB63kyawIh5+2D NSrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=iLtjd20SHaFlAZ3LR+oKKplS/mlOvvwjtZqi62p2R7E=; b=DRv0AlvSo6ccUyO1ZT2ItF9v7PYltKB+l7AqM8ybLJE6jaZFntqYc4dcasCDGHKXOz TxOaQZ3KoODFs+lMFGz5cmJKXvx3xbrQL4nx2nnMwxwFYG29dVEVvDIt8nbe4kxYtB+q BELZX7ypwD2ZZbFLGXG7TTpabwISd+zY9RUqTKzZguzbCI94QSk42zN0dObJxHKFP6DZ 2035fpKDMiky5tu+EEZCyPf5XxGzovTMCm8RMcR7Hv0TMvKkE1uITez86OLGB/WnfqTR +i5Q3PDr2T+O/RXDr/0t31kRpOYUGjDkh6LItbr80krAlXWcVDytOyKqp7zrbcK/qBYR digA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b5si2251866pfc.337.2018.02.23.11.41.05; Fri, 23 Feb 2018 11:41:20 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934535AbeBWStZ (ORCPT + 99 others); Fri, 23 Feb 2018 13:49:25 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45262 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934016AbeBWStX (ORCPT ); Fri, 23 Feb 2018 13:49:23 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 08F36118E; Fri, 23 Feb 2018 18:49:22 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+ca425f44816d749e8eb49755567a75ee48cf4a30@syzkaller.appspotmail.com, Sabrina Dubroca , Steffen Klassert Subject: [PATCH 4.14 010/159] xfrm: fix rcu usage in xfrm_get_type_offload Date: Fri, 23 Feb 2018 19:25:18 +0100 Message-Id: <20180223170744.432128760@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sabrina Dubroca commit 2f10a61cee8fdb9f8da90f5db687e1862b22cf06 upstream. request_module can sleep, thus we cannot hold rcu_read_lock() while calling it. The function also jumps back and takes rcu_read_lock() again (in xfrm_state_get_afinfo()), resulting in an imbalance. This codepath is triggered whenever a new offloaded state is created. Fixes: ffdb5211da1c ("xfrm: Auto-load xfrm offload modules") Reported-by: syzbot+ca425f44816d749e8eb49755567a75ee48cf4a30@syzkaller.appspotmail.com Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/xfrm/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -313,13 +313,14 @@ retry: if ((type && !try_module_get(type->owner))) type = NULL; + rcu_read_unlock(); + if (!type && try_load) { request_module("xfrm-offload-%d-%d", family, proto); try_load = 0; goto retry; } - rcu_read_unlock(); return type; }