Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp3992545ybi; Mon, 29 Jul 2019 17:03:52 -0700 (PDT) X-Google-Smtp-Source: APXvYqyzjkW7Un4XZeJH1iNBPqFothW/jAsVC/UrTQC1j+OnNB9SGE754tcdIla1WuJnn1wEKVQA X-Received: by 2002:a65:44cb:: with SMTP id g11mr60579075pgs.288.1564445032676; Mon, 29 Jul 2019 17:03:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564445032; cv=none; d=google.com; s=arc-20160816; b=O8p/oxOPqCHI1FRHWZrZk6oeV5Q88HxA+5JfAyJTOf+d4VylSwwzhiO8cSRyA3WEAB 0By+QyZI0xLFMp+bQVJmFITGDQJC9olKV1VRNQmHHcURTaiuQKmuO4/6g46X2L/dyVt/ v4l4JVybb/xSgxv+0buninYvkcreqvdS59nUbTzeAtGuJYTcNl/AMfOsapMvH+zNTX4j 0PhhydLRN9ZPtdLLq4YOsCq5NVrk/2FI6+Y3HQfqX3otDUNF9g0+OaMdBxB26aclg2Ua xCU/X0miUno9pkMb6Dn50Dq0zlprLSNLEYu57J9NNmJleusxh+tTctWVMeOD6+df/U2T NMlQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=9+S9VhMxS48a7BvTNnq95Skb/1mr3BYaDB0RKlUavTI=; b=ginwTWcAVSoIYb41UfLA7hpaiViKyuI13PhkLxy+G/rUBted2YvD5pXYPAKavJRkzZ C181a1lCHehIDji68P+fXBegLT1nvATM7ACmlcgks0nxbr5GPciCs3uyeUS668yzHWoF 7jNjBhscaBzNY9H5VzFc8C4alKXnymJonNFXu4Rogum/OpHtIyuXayTqF0E+MpiYeKb1 oQEWJFGGKavBPdjrh6cxLticVh6jb/8jO1J/XIQWRmEy5p9X8ZsemwTyHfdzDgVYoyZR TyTwFBAwX2Tp5jcJFeEWUrt4G8q8ovoDzA1gBYI0r7Bv8KUF+VW5BSjmfQSP/LNIeNsS mUCA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=s1a084XK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c18si27152553plo.316.2019.07.29.17.03.34; Mon, 29 Jul 2019 17:03:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=s1a084XK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728452AbfG2T3g (ORCPT + 99 others); Mon, 29 Jul 2019 15:29:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:42196 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387545AbfG2T3c (ORCPT ); Mon, 29 Jul 2019 15:29:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 927152171F; Mon, 29 Jul 2019 19:29:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564428571; bh=/JwY3h9nUS0LG/9eBVEMdwzjPajL0hD0NRE551e2B1k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s1a084XKqDhePyu8RnIi+yurtCbTBkSMD+2DYDUBS5ZLWFNxuzuGRvn4SDhyXvhah Xo82N/1/hDilgdTUpWfIH9AV1ecAt9HHJUzImKMEj+kX5TNXVqhfTwCK7TjIoKM7Za yuzA59VRLzGE60qknfLUsOZ/CbLQjOaEcgqjkv8k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 101/293] gtp: fix suspicious RCU usage Date: Mon, 29 Jul 2019 21:19:52 +0200 Message-Id: <20190729190832.381864907@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190729190820.321094988@linuxfoundation.org> References: <20190729190820.321094988@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ] gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index dba3869b61be..2756edd84abc 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -293,12 +293,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -798,7 +800,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -814,6 +817,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.20.1