Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3507650pxf; Mon, 15 Mar 2021 11:04:50 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz9yeqacTg4Mp5Iwjfk1myUbmK4Fj0OHHbCfsm0OVNBtPZB3y0nizGpNDN0Jp6P2Pfjvydj X-Received: by 2002:a05:6402:27d3:: with SMTP id c19mr31825561ede.129.1615831490340; Mon, 15 Mar 2021 11:04:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615831490; cv=none; d=google.com; s=arc-20160816; b=bpFsIIq5CiJK8GAfP6/8YuCywD7UQv8L+vnVrvWNXS+s6hKTPQRD553G6cdJ5M4/l3 L0fOou5FImYECxMwps2f9J096AwaqL4v+O6CXdaaic5b0AVJArpdbnppXpFhElXSpZUQ diITbCEGRDg9q+w43CM2GnYMTpqFSBBqv2EV6uN+6OLN9nBqP5UtHcXeEiGkDgi4mfra jUb9ymTK6CNTJ1jLqXBakM8QS4VjVOnu0nSFbyUWseCAP4vB/84GTpkpSlqPO+gO5O2C /LrtF6gdXeJGnT2gDXxKbqfnXTKxo3HjgEN1/twcvyP3OpLBuhtPvTWBun+XoSLjk0b1 ZLqQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=b/tOOeZ1DdFM/FYXv1NSrEwGdg/mq7WEMZp7PouqWRg=; b=gOw+phrDM0GiQmXAVo0kTQrou5KJe5oU8PevDqKfkk8AWETHnfPocIAuLddJ7rzNPs 3lZjf+pk9KhOaULfqk4K4/nJA228KskQiKk1ISRsB9YbQCwV8CXctABBD7Ez17GqK8E6 24iS9Yq+Tf70yLcgcsOOxYpjD1vBiFqg36wS4MvtaRkZjQhUUr6nMpCUq18Sz4HAofgA yU64FORWoDkfBorha3zRGPmXMv36+6EPEXUoSuJjD9EFo3N0Gmy38YcHmRYx41pwL5qp cmDik0nx4MCAiU6UcpEmEaPFUHel7hZfAfpbcP1LojkXVWJNqZ8uonnUUSROZeTKlURu /u8Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="hf/FHChu"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a7si13303161edb.607.2021.03.15.11.04.27; Mon, 15 Mar 2021 11:04:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="hf/FHChu"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235052AbhCOOHC (ORCPT + 99 others); Mon, 15 Mar 2021 10:07:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:35610 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232198AbhCON5z (ORCPT ); Mon, 15 Mar 2021 09:57:55 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 01AFF64F16; Mon, 15 Mar 2021 13:57:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816664; bh=d4rfcoWz0mdYhPVDiWZkY387rotkC6Hrp5EMs2A8oZ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hf/FHChuhy395d+F979gnUDDP62HYgVVBX3mFZgiZWyHZlCxs4YKCyYKhjpyzeS6J CMM6OfdCtJO79FZehJackQLUABSfPcQQb7VdhLYrwaqlSr4sFE/BPAPG52cN/IUugW Se5i7H71WrtqFKCUJVO0IaQuHJJr8Z8IDCJATQ2Q= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com, Paul Moore , "David S. Miller" Subject: [PATCH 5.4 033/168] cipso,calipso: resolve a number of problems with the DOI refcounts Date: Mon, 15 Mar 2021 14:54:25 +0100 Message-Id: <20210315135551.436027530@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135550.333963635@linuxfoundation.org> References: <20210315135550.333963635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Paul Moore commit ad5d07f4a9cd671233ae20983848874731102c08 upstream. The current CIPSO and CALIPSO refcounting scheme for the DOI definitions is a bit flawed in that we: 1. Don't correctly match gets/puts in netlbl_cipsov4_list(). 2. Decrement the refcount on each attempt to remove the DOI from the DOI list, only removing it from the list once the refcount drops to zero. This patch fixes these problems by adding the missing "puts" to netlbl_cipsov4_list() and introduces a more conventional, i.e. not-buggy, refcounting mechanism to the DOI definitions. Upon the addition of a DOI to the DOI list, it is initialized with a refcount of one, removing a DOI from the list removes it from the list and drops the refcount by one; "gets" and "puts" behave as expected with respect to refcounts, increasing and decreasing the DOI's refcount by one. Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence counts") Fixes: d7cce01504a0 ("netlabel: Add support for removing a CALIPSO DOI.") Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com Signed-off-by: Paul Moore Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/cipso_ipv4.c | 11 +---------- net/ipv6/calipso.c | 14 +++++--------- net/netlabel/netlabel_cipso_v4.c | 3 +++ 3 files changed, 9 insertions(+), 19 deletions(-) --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -519,16 +519,10 @@ int cipso_v4_doi_remove(u32 doi, struct ret_val = -ENOENT; goto doi_remove_return; } - if (!refcount_dec_and_test(&doi_def->refcount)) { - spin_unlock(&cipso_v4_doi_list_lock); - ret_val = -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&cipso_v4_doi_list_lock); - cipso_v4_cache_invalidate(); - call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); + cipso_v4_doi_putdef(doi_def); ret_val = 0; doi_remove_return: @@ -585,9 +579,6 @@ void cipso_v4_doi_putdef(struct cipso_v4 if (!refcount_dec_and_test(&doi_def->refcount)) return; - spin_lock(&cipso_v4_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&cipso_v4_doi_list_lock); cipso_v4_cache_invalidate(); call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -83,6 +83,9 @@ struct calipso_map_cache_entry { static struct calipso_map_cache_bkt *calipso_cache; +static void calipso_cache_invalidate(void); +static void calipso_doi_putdef(struct calipso_doi *doi_def); + /* Label Mapping Cache Functions */ @@ -444,15 +447,10 @@ static int calipso_doi_remove(u32 doi, s ret_val = -ENOENT; goto doi_remove_return; } - if (!refcount_dec_and_test(&doi_def->refcount)) { - spin_unlock(&calipso_doi_list_lock); - ret_val = -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&calipso_doi_list_lock); - call_rcu(&doi_def->rcu, calipso_doi_free_rcu); + calipso_doi_putdef(doi_def); ret_val = 0; doi_remove_return: @@ -508,10 +506,8 @@ static void calipso_doi_putdef(struct ca if (!refcount_dec_and_test(&doi_def->refcount)) return; - spin_lock(&calipso_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&calipso_doi_list_lock); + calipso_cache_invalidate(); call_rcu(&doi_def->rcu, calipso_doi_free_rcu); } --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c @@ -575,6 +575,7 @@ list_start: break; } + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); genlmsg_end(ans_skb, data); @@ -583,12 +584,14 @@ list_start: list_retry: /* XXX - this limit is a guesstimate */ if (nlsze_mult < 4) { + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); kfree_skb(ans_skb); nlsze_mult *= 2; goto list_start; } list_failure_lock: + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); list_failure: kfree_skb(ans_skb);