Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3324319pxf; Mon, 15 Mar 2021 07:09:31 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzZkcQPy13gOMchiE6glW2eEsLLibhOzDYvKpCW599TmGMowXCMoWqtJZcsIYYp1AzF3rhn X-Received: by 2002:aa7:d385:: with SMTP id x5mr30484887edq.289.1615817371733; Mon, 15 Mar 2021 07:09:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615817371; cv=none; d=google.com; s=arc-20160816; b=rgw6seDwKZN/G+n3m+St71Q7RrGCo0FFoNfyG03m1F46eH2V9dLevjcIAJum11Fd8+ ONVf18MA2n1CAM2l49a25vAIQRngWG7LJKd/SAHfxCIPq5SA4QO9cLMC7r89DVRe8LuZ /8AJQ5mW6MnG4/pC0xONT5rxIsnIduycf1aESC+cCxW9cqNyxfNPUwhVgfNBfbF5SdQ+ N9NtduHGCOn4r5BO2j6AwecpvQHyUVhsFb4zSBfEW9CGEssffAeB/H9qRhWAMG0VC4x3 EscPDrzZfhZ1FSIhCNS8WiMnmGxQeHbRK6e5bu9V3ty85B7x578e6dVYssTO9BA7uVfK Ytpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=b/tOOeZ1DdFM/FYXv1NSrEwGdg/mq7WEMZp7PouqWRg=; b=kWJKmW60vU86IEErgfszneMx8G+KeIrJ3c0vHo8VFvUQFPAYn6kID2J7SVR2jflHO/ cs6UBSA/7exOBb9G7D5BDA1gXuPgBpsbQE/yJn+IZUS/wd3N3YVR5/IqCzhpgXzmdr9p K1jp5e88O5UMXNM6mP8TMPGLomNIsZ35a5XGPpZDthXk92BpAWYXke0E2+3KdGaYjSPC SxhcXMBfJiBKtLgbOtae4+6I1IuOnd74+etFtGo8ciaTDXZxbBw/SGoKHUq/AZUzhIcl wvCZ1XkoKSpvWralfXhWU36rb5/S3Dyu3+RmidALsalQq4gn2WvwfSbO2J6S/zQPdE+1 e3Dw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=zuo4zMyE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id hc17si11287826ejc.480.2021.03.15.07.09.08; Mon, 15 Mar 2021 07:09:31 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=zuo4zMyE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235339AbhCOOHa (ORCPT + 99 others); Mon, 15 Mar 2021 10:07:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:36622 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230147AbhCON6H (ORCPT ); Mon, 15 Mar 2021 09:58:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 35DDB64F34; Mon, 15 Mar 2021 13:58:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816687; bh=d4rfcoWz0mdYhPVDiWZkY387rotkC6Hrp5EMs2A8oZ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zuo4zMyE9cYeElkKVxhkuNrvKLms0/VvBQcXc+5EdmimLSYuLSNV6FpfnIvxdh3BA pIYUQyFy6fK7LcZKOFtAFJWZdU5rKXCxGsUcMZRZTQsBEIVI3J1tNd+MdOJsfw9Wiw L8jK3siX9W6zGyxHdBliuSHF4l5KSNMaANVrIE9g= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com, Paul Moore , "David S. Miller" Subject: [PATCH 5.11 064/306] cipso,calipso: resolve a number of problems with the DOI refcounts Date: Mon, 15 Mar 2021 14:52:07 +0100 Message-Id: <20210315135509.808403923@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135507.611436477@linuxfoundation.org> References: <20210315135507.611436477@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Paul Moore commit ad5d07f4a9cd671233ae20983848874731102c08 upstream. The current CIPSO and CALIPSO refcounting scheme for the DOI definitions is a bit flawed in that we: 1. Don't correctly match gets/puts in netlbl_cipsov4_list(). 2. Decrement the refcount on each attempt to remove the DOI from the DOI list, only removing it from the list once the refcount drops to zero. This patch fixes these problems by adding the missing "puts" to netlbl_cipsov4_list() and introduces a more conventional, i.e. not-buggy, refcounting mechanism to the DOI definitions. Upon the addition of a DOI to the DOI list, it is initialized with a refcount of one, removing a DOI from the list removes it from the list and drops the refcount by one; "gets" and "puts" behave as expected with respect to refcounts, increasing and decreasing the DOI's refcount by one. Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence counts") Fixes: d7cce01504a0 ("netlabel: Add support for removing a CALIPSO DOI.") Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com Signed-off-by: Paul Moore Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/cipso_ipv4.c | 11 +---------- net/ipv6/calipso.c | 14 +++++--------- net/netlabel/netlabel_cipso_v4.c | 3 +++ 3 files changed, 9 insertions(+), 19 deletions(-) --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -519,16 +519,10 @@ int cipso_v4_doi_remove(u32 doi, struct ret_val = -ENOENT; goto doi_remove_return; } - if (!refcount_dec_and_test(&doi_def->refcount)) { - spin_unlock(&cipso_v4_doi_list_lock); - ret_val = -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&cipso_v4_doi_list_lock); - cipso_v4_cache_invalidate(); - call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); + cipso_v4_doi_putdef(doi_def); ret_val = 0; doi_remove_return: @@ -585,9 +579,6 @@ void cipso_v4_doi_putdef(struct cipso_v4 if (!refcount_dec_and_test(&doi_def->refcount)) return; - spin_lock(&cipso_v4_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&cipso_v4_doi_list_lock); cipso_v4_cache_invalidate(); call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -83,6 +83,9 @@ struct calipso_map_cache_entry { static struct calipso_map_cache_bkt *calipso_cache; +static void calipso_cache_invalidate(void); +static void calipso_doi_putdef(struct calipso_doi *doi_def); + /* Label Mapping Cache Functions */ @@ -444,15 +447,10 @@ static int calipso_doi_remove(u32 doi, s ret_val = -ENOENT; goto doi_remove_return; } - if (!refcount_dec_and_test(&doi_def->refcount)) { - spin_unlock(&calipso_doi_list_lock); - ret_val = -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&calipso_doi_list_lock); - call_rcu(&doi_def->rcu, calipso_doi_free_rcu); + calipso_doi_putdef(doi_def); ret_val = 0; doi_remove_return: @@ -508,10 +506,8 @@ static void calipso_doi_putdef(struct ca if (!refcount_dec_and_test(&doi_def->refcount)) return; - spin_lock(&calipso_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&calipso_doi_list_lock); + calipso_cache_invalidate(); call_rcu(&doi_def->rcu, calipso_doi_free_rcu); } --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c @@ -575,6 +575,7 @@ list_start: break; } + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); genlmsg_end(ans_skb, data); @@ -583,12 +584,14 @@ list_start: list_retry: /* XXX - this limit is a guesstimate */ if (nlsze_mult < 4) { + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); kfree_skb(ans_skb); nlsze_mult *= 2; goto list_start; } list_failure_lock: + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); list_failure: kfree_skb(ans_skb);