WARNING: proc registration bug in clusterip_tg_check

[syzbot <syzbot+03218bcdba6aa76441a3@syzkaller.appspotmail.com>]

[-- Attachment #1: Type: text/plain, Size: 11387 bytes --]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

kernel build failed: failed to run /usr/bin/make [make bzImage -j 32  
CC=/syzkaller/gcc/bin/gcc]: exit status 2
scripts/kconfig/conf  --silentoldconfig Kconfig
   CHK     include/config/kernel.release
   CHK     include/generated/uapi/linux/version.h
   CHK     include/generated/utsrelease.h
   CHK     scripts/mod/devicetable-offsets.h
   CHK     include/generated/bounds.h
   CHK     include/generated/timeconst.h
   CHK     include/generated/asm-offsets.h
   CALL    scripts/checksyscalls.sh
   CHK     include/generated/compile.h
   CC      net/psample/psample.o
   CC      net/packet/af_packet.o
   CC      net/strparser/strparser.o
   CC      net/switchdev/switchdev.o
   CC      net/rfkill/core.o
   CC      net/compat.o
   CC      net/rfkill/input.o
   CC      net/sysctl_net.o
   CC      net/tls/tls_main.o
   CC      net/tls/tls_sw.o
   CC      net/unix/af_unix.o
   CC      net/wimax/id-table.o
   CC      net/unix/garbage.o
   CC      net/wimax/op-msg.o
   CC      net/unix/sysctl_net_unix.o
   CC      net/wimax/op-reset.o
   CC      net/wimax/op-rfkill.o
   CC      net/wimax/op-state-get.o
   AR      net/ipv4/netfilter/nf_conntrack_ipv4.o
   AR      net/ipv4/netfilter/nf_nat_ipv4.o
   CC      net/vmw_vsock/af_vsock.o
   AR      net/ipv4/netfilter/nf_nat_snmp_basic.o
   CC      net/tipc/addr.o
   CC      net/xfrm/xfrm_policy.o
   CC      net/ipv4/netfilter/ipt_CLUSTERIP.o
   CC      net/tipc/bcast.o
   CC      net/wireless/core.o
   CC      net/sunrpc/clnt.o
   CC      net/rds/af_rds.o
   CC      net/ipv4/netfilter/ipt_ECN.o
   CC      net/sched/sch_generic.o
   CC      net/sched/sch_mq.o
   CC      net/sctp/sm_statetable.o
   CC      net/sctp/sm_statefuns.o
   CC      net/wimax/stack.o
   CC      net/wimax/debugfs.o
   CC      net/sctp/sm_sideeffect.o
   CC      net/sctp/protocol.o
   AR      net/psample/built-in.o
   CC      net/sctp/endpointola.o
   CC      net/rds/bind.o
   CC      net/sunrpc/xprt.o
   CC      net/rds/cong.o
   AR      net/switchdev/built-in.o
   CC      net/sched/sch_api.o
   AR      net/rfkill/rfkill.o
net/ipv4/netfilter/ipt_CLUSTERIP.c: In function ‘clusterip_config_init’:
net/ipv4/netfilter/ipt_CLUSTERIP.c:253:22: error: expected ‘;’ before ‘:’  
token
    goto err_remove_pte:
                       ^
   AR      net/rfkill/built-in.o
   CC      net/rds/connection.o
scripts/Makefile.build:316: recipe for  
target 'net/ipv4/netfilter/ipt_CLUSTERIP.o' failed
make[3]: *** [net/ipv4/netfilter/ipt_CLUSTERIP.o] Error 1
make[3]: *** Waiting for unfinished jobs....
   CC      net/rds/info.o
   CC      net/sctp/associola.o
   CC      net/sctp/transport.o
   AR      net/strparser/built-in.o
   CC      net/sctp/chunk.o
   CC      net/sunrpc/socklib.o
   CC      net/tipc/bearer.o
scripts/Makefile.build:575: recipe for target 'net/ipv4/netfilter' failed
make[2]: *** [net/ipv4/netfilter] Error 2
scripts/Makefile.build:575: recipe for target 'net/ipv4' failed
make[1]: *** [net/ipv4] Error 2
make[1]: *** Waiting for unfinished jobs....
   CC      net/tipc/core.o
   CC      net/sctp/sm_make_chunk.o
   CC      net/wireless/sysfs.o
   CC      net/wireless/radiotap.o
   AR      net/tls/tls.o
   AR      net/tls/built-in.o
   CC      net/sched/sch_blackhole.o
   CC      net/sched/cls_api.o
   CC      net/sctp/ulpevent.o
   AR      net/wimax/wimax.o
   AR      net/wimax/built-in.o
   CC      net/wireless/util.o
   CC      net/rds/message.o
   CC      net/sunrpc/xprtsock.o
   CC      net/sctp/inqueue.o
   CC      net/vmw_vsock/af_vsock_tap.o
   CC      net/rds/recv.o
   CC      net/wireless/reg.o
   CC      net/rds/send.o
   CC      net/tipc/link.o
   CC      net/sctp/outqueue.o
   CC      net/sched/act_api.o
   CC      net/sched/act_police.o
   CC      net/sctp/ulpqueue.o
   CC      net/rds/stats.o
   CC      net/rds/sysctl.o
   CC      net/sctp/tsnmap.o
   CC      net/sched/act_sample.o
   CC      net/vmw_vsock/vsock_addr.o
   CC      net/wireless/scan.o
   CC      net/sctp/bind_addr.o
   CC      net/rds/threads.o
   CC      net/rds/transport.o
   CC      net/sctp/socket.o
   CC      net/sunrpc/sched.o
   AR      net/unix/unix.o
   CC      net/tipc/discover.o
   AR      net/unix/built-in.o
   CC      net/tipc/msg.o
   CC      net/wireless/nl80211.o
   CC      net/sched/act_nat.o
   CC      net/rds/loop.o
   CC      net/rds/page.o
   CC      net/sctp/primitive.o
   CC      net/sched/act_pedit.o
   CC      net/sctp/output.o
   CC      net/vmw_vsock/diag.o
   CC      net/sctp/input.o
   CC      net/vmw_vsock/virtio_transport.o
   CC      net/sched/act_simple.o
   CC      net/rds/rdma.o
   CC      net/sched/act_bpf.o
   CC      net/tipc/name_distr.o
   CC      net/rds/tcp.o
   CC      net/sctp/debug.o
net/sctp/outqueue.c: In function ‘sctp_outq_flush’:
net/sctp/outqueue.c:1205:1: warning: the frame size of 2144 bytes is larger  
than 2048 bytes [-Wframe-larger-than=]
  }
  ^
   CC      net/sctp/stream.o
   CC      net/rds/tcp_connect.o
   CC      net/sctp/auth.o
   CC      net/rds/tcp_listen.o
   CC      net/sched/sch_fifo.o
   CC      net/rds/tcp_recv.o
   CC      net/sctp/offload.o
   CC      net/tipc/subscr.o
   CC      net/vmw_vsock/virtio_transport_common.o
   CC      net/wireless/mlme.o
   CC      net/sched/sch_cbq.o
   CC      net/sched/sch_htb.o
   CC      net/sunrpc/auth.o
   CC      net/sctp/stream_sched.o
   CC      net/sunrpc/auth_null.o
net/wireless/scan.c: In function ‘cfg80211_bss_update’:
net/wireless/scan.c:1059:1: warning: the frame size of 2120 bytes is larger  
than 2048 bytes [-Wframe-larger-than=]
  }
  ^
   CC      net/sctp/stream_sched_prio.o
   AR      net/vmw_vsock/vsock.o
   AR      net/vmw_vsock/vsock_diag.o
   AR      net/vmw_vsock/vmw_vsock_virtio_transport.o
   CC      net/sched/sch_hfsc.o
   CC      net/sunrpc/auth_unix.o
   CC      net/xfrm/xfrm_state.o
   CC      net/wireless/ibss.o
   CC      net/sctp/stream_sched_rr.o
   AR      net/packet/built-in.o
   CC      net/sctp/stream_interleave.o
   CC      net/tipc/monitor.o
   CC      net/rds/tcp_send.o
   CC      net/rds/tcp_stats.o
   CC      net/xfrm/xfrm_hash.o
   CC      net/sctp/proc.o
   AR      net/rds/rds.o
   CC      net/sctp/sysctl.o
   CC      net/sctp/ipv6.o
   CC      net/tipc/name_table.o
   CC      net/wireless/sme.o
   CC      net/wireless/chan.o
   CC      net/wireless/ethtool.o
   CC      net/sunrpc/auth_generic.o
   CC      net/sunrpc/svc.o
   CC      net/tipc/net.o
   CC      net/sunrpc/svcsock.o
   CC      net/sunrpc/svcauth.o
   CC      net/wireless/mesh.o
   CC      net/xfrm/xfrm_input.o
   CC      net/xfrm/xfrm_output.o
   CC      net/sunrpc/svcauth_unix.o
   CC      net/sunrpc/addr.o
   CC      net/sunrpc/rpcb_clnt.o
   CC      net/xfrm/xfrm_sysctl.o
   AR      net/rds/rds_tcp.o
   AR      net/rds/built-in.o
   CC      net/xfrm/xfrm_replay.o
   AR      net/vmw_vsock/vmw_vsock_virtio_transport_common.o
   AR      net/vmw_vsock/built-in.o
   CC      net/xfrm/xfrm_device.o
   CC      net/sunrpc/timer.o
   CC      net/tipc/netlink.o
   CC      net/tipc/netlink_compat.o
   CC      net/sunrpc/xdr.o
   CC      net/tipc/node.o
   CC      net/sunrpc/sunrpc_syms.o
   CC      net/wireless/ap.o
net/wireless/nl80211.c: In function ‘nl80211_add_commands_unsplit’:
net/wireless/nl80211.c:1444:1: warning: the frame size of 2224 bytes is  
larger than 2048 bytes [-Wframe-larger-than=]
  }
  ^
   CC      net/sched/sch_red.o
   CC      net/tipc/socket.o
   CC      net/wireless/trace.o
   CC      net/wireless/ocb.o
   CC      net/xfrm/xfrm_proc.o
   CC      net/sched/sch_gred.o
   CC      net/xfrm/xfrm_algo.o
   CC      net/tipc/eth_media.o
   CC      net/sunrpc/cache.o
   CC      net/sched/sch_ingress.o
   CC      net/xfrm/xfrm_user.o
   CC      net/sunrpc/rpc_pipe.o
   CC      net/tipc/server.o
   CC      net/wireless/shipped-certs.o
   CC      net/sunrpc/svc_xprt.o
   CC      net/xfrm/xfrm_ipcomp.o
   CC      net/sched/sch_dsmark.o
   CC      net/sunrpc/xprtmultipath.o
   CC      net/sunrpc/stats.o
   CC      net/sunrpc/sysctl.o
   CC      net/sched/sch_sfb.o
   CC      net/tipc/group.o
   CC      net/tipc/udp_media.o
   CC      net/tipc/sysctl.o
   CC      net/sched/sch_sfq.o
   CC      net/sched/sch_tbf.o
   CC      net/sched/sch_teql.o
   CC      net/sunrpc/auth_gss/auth_gss.o
   CC      net/sunrpc/auth_gss/gss_generic_token.o
   CC      net/sched/sch_prio.o
   CC      net/sunrpc/auth_gss/gss_mech_switch.o
   CC      net/sched/sch_multiq.o
   CC      net/sunrpc/auth_gss/svcauth_gss.o
   CC      net/sched/sch_atm.o
   CC      net/sched/sch_netem.o
   CC      net/sunrpc/auth_gss/gss_rpc_upcall.o
   CC      net/sched/sch_cbs.o
   CC      net/sched/cls_u32.o
   CC      net/sunrpc/auth_gss/gss_rpc_xdr.o
   CC      net/sched/cls_route.o
   CC      net/sched/cls_fw.o
   CC      net/sunrpc/auth_gss/gss_krb5_mech.o
   CC      net/sched/cls_rsvp.o
   CC      net/sched/cls_tcindex.o
   CC      net/sched/cls_rsvp6.o
   CC      net/sched/cls_basic.o
   CC      net/sched/cls_flow.o
   CC      net/sunrpc/auth_gss/gss_krb5_seal.o
   CC      net/sched/cls_bpf.o
   CC      net/sched/cls_flower.o
   CC      net/sunrpc/auth_gss/gss_krb5_unseal.o
   CC      net/sunrpc/auth_gss/gss_krb5_seqnum.o
   CC      net/sched/ematch.o
   CC      net/sched/em_cmp.o
   CC      net/sched/em_nbyte.o
   CC      net/sunrpc/auth_gss/gss_krb5_wrap.o
   CC      net/sched/em_u32.o
   CC      net/sched/em_meta.o
   CC      net/sched/em_text.o
   CC      net/sunrpc/auth_gss/gss_krb5_crypto.o
   CC      net/sunrpc/auth_gss/gss_krb5_keys.o
   CC      net/sched/em_ipset.o
   AR      net/sunrpc/sunrpc.o
net/sctp/socket.c: In function ‘sctp_getsockopt’:
net/sctp/socket.c:7271:1: warning: the frame size of 3120 bytes is larger  
than 2048 bytes [-Wframe-larger-than=]
  }
  ^
   AR      net/sctp/sctp.o
   AR      net/sctp/built-in.o
   AR      net/sunrpc/auth_gss/auth_rpcgss.o
   AR      net/xfrm/built-in.o
   AR      net/sunrpc/auth_gss/rpcsec_gss_krb5.o
   AR      net/sunrpc/auth_gss/built-in.o
   AR      net/sunrpc/built-in.o
   AR      net/tipc/tipc.o
   AR      net/tipc/built-in.o
   AR      net/sched/built-in.o
net/wireless/nl80211.c: In function ‘nl80211_get_mesh_config’:
net/wireless/nl80211.c:5855:1: warning: the frame size of 2336 bytes is  
larger than 2048 bytes [-Wframe-larger-than=]
  }
  ^
net/wireless/nl80211.c: In function ‘nl80211_send_station.isra.61’:
net/wireless/nl80211.c:4547:1: warning: the frame size of 2232 bytes is  
larger than 2048 bytes [-Wframe-larger-than=]
  }
  ^
net/wireless/nl80211.c: In function ‘nl80211_send_wiphy’:
net/wireless/nl80211.c:1938:1: warning: the frame size of 4240 bytes is  
larger than 2048 bytes [-Wframe-larger-than=]
  }
  ^
   AR      net/wireless/cfg80211.o
   AR      net/wireless/built-in.o
Makefile:1020: recipe for target 'net' failed
make: *** [net] Error 2



Tested on net commit
176bfb406d735655f9a69d868a7af0c3da959d51 (Tue Feb 6 16:48:40 2018 +0000)
Merge branch 'be2net-patch-set'

compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.




[-- Attachment #2: patch.diff --]
[-- Type: text/plain, Size: 1263 bytes --]

--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -230,17 +230,6 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
 	refcount_set(&c->refcount, 1);
 	refcount_set(&c->entries, 1);
 
-	spin_lock_bh(&cn->lock);
-	if (__clusterip_config_find(net, ip)) {
-		spin_unlock_bh(&cn->lock);
-		kfree(c);
-
-		return ERR_PTR(-EBUSY);
-	}
-
-	list_add_rcu(&c->list, &cn->configs);
-	spin_unlock_bh(&cn->lock);
-
 #ifdef CONFIG_PROC_FS
 	{
 		char buffer[16];
@@ -257,20 +246,31 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
 	}
 #endif
 
+	spin_lock_bh(&cn->lock);
+	if (__clusterip_config_find(net, ip)) {
+		spin_unlock_bh(&cn->lock);
+		err = -EBUSY;
+		goto err_remove_pte:
+	}
+
+	list_add_rcu(&c->list, &cn->configs);
+	spin_unlock_bh(&cn->lock);
+
 	c->notifier.notifier_call = clusterip_netdev_event;
 	err = register_netdevice_notifier(&c->notifier);
 	if (!err)
 		return c;
 
+	spin_lock_bh(&cn->lock);
+	list_del_rcu(&c->list);
+	spin_unlock_bh(&cn->lock);
+
+err_remove_pte:
 #ifdef CONFIG_PROC_FS
 	proc_remove(c->pde);
 err:
 #endif
-	spin_lock_bh(&cn->lock);
-	list_del_rcu(&c->list);
-	spin_unlock_bh(&cn->lock);
 	kfree(c);
-
 	return ERR_PTR(err);
 }