Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp10438331ybi; Wed, 24 Jul 2019 23:13:08 -0700 (PDT) X-Google-Smtp-Source: APXvYqyAVAKCg/VQnsFWYkL2LNeKTtgl6nb2eRsbctufcdhARQiOoVERBJVQn8X4C4sYY0pitX9d X-Received: by 2002:a62:ae01:: with SMTP id q1mr14626717pff.219.1564035187946; Wed, 24 Jul 2019 23:13:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564035187; cv=none; d=google.com; s=arc-20160816; b=M8PPuwK6dQyA+CqhQGMu3mKLNT1LwhJPL1E2tbp42jVmTVrGylShtNfFZKBV02+hZI QK8zxj1SQ1Olaqr6Ezw2D2Y9X45wRQ66T+fh/6wPshTmuJ2lBMBvadtWOsmXYRnVZRD5 OtlJ/tDMBvLsP7Xuqe3VUdcJAQACUCqr6Sm+4XfCFM9IKaZROpJyvK42XtD6T+mst+Nr ye2dY6YcCgDz2yiiaKRcqGhMcvVi5DIK8q3EYz6WtTMgxqjl7LCDdoRN6tCxwSX21ESt GIB5V3R//s4nvBjYcO17r7YfNDJm1CWuCZmqaczg4sS+s2O4Tvr/Mz2EE+SB2vsgk5LC EwMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=QYtHe/juw+qSwErTpfUpxki8QTWE+LtyzquE1Kji27Y=; b=kmU6zIybRscmivccoNoCQF66mwdD/UYlPzPr5RyLCRFb4OvtLFH6TMTv7yAkmoMR62 ZAjc8ukEEAHsLtkTaRL54qXGNo9VugOpPC5e6f8hjfuMgVM1nE1dayka2jpj1u11A9lv a9ZMNbYSYv8ljj6M3bdKJvk8iNQTEwQrmAE6uhsK+qEByRhtaB2R/+aO3dKrQW8Y0pap cNa0dx+9F4676UBO/OWigpA2MCjGAZZ5fOb/l8VBsxdJILg4cZ6LHoFxn9hSSKuyrFHW 4KndQixejBaLcTQL6hbwRBH4i3qEkQq0z6Gl8ITg/TW/5NYO9ezVeaHwQw4bwtMER6Do FqvQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Kw1AKDpZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h189si15796207pgc.236.2019.07.24.23.12.53; Wed, 24 Jul 2019 23:13:07 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Kw1AKDpZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404632AbfGYFlZ (ORCPT + 99 others); Thu, 25 Jul 2019 01:41:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:56182 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404617AbfGYFlY (ORCPT ); Thu, 25 Jul 2019 01:41:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6C3E82054F; Thu, 25 Jul 2019 05:41:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564033282; bh=IEE+22g5OQ2To3AmLiJfIHdoE2uP0WmmHaHP3ulGDuo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Kw1AKDpZV6Zrq10JHTLuUr+FTIHVc6tHL/YB7sceW1ArGEmL7+SjGJjwLpWxFk30v mmYsllblePBZqbo/IySVSsypbi+DlpiRqZ+DT2kwzEwmmiZOX8kZZAEas7Mmenxm4c Vm6pB0TkK5YeU/TvuSAf8T+CEFR7+I++F4uFVGTI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 154/271] gtp: fix suspicious RCU usage Date: Wed, 24 Jul 2019 21:20:23 +0200 Message-Id: <20190724191708.397340523@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190724191655.268628197@linuxfoundation.org> References: <20190724191655.268628197@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ] gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 83488f2bf7a0..f45a806b6c06 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -293,12 +293,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -800,7 +802,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -816,6 +819,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.20.1