From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Gerrit Renker <gerrit@erg.abdn.ac.uk>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 03/53] dccp: defer ccid_hc_tx_delete() at dismantle time
Date: Mon, 28 Aug 2017 10:05:08 +0200 [thread overview]
Message-ID: <20170828080517.758420940@linuxfoundation.org> (raw)
In-Reply-To: <20170828080517.599193891@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 120e9dabaf551c6dc03d3a10a1f026376cb1811c ]
syszkaller team reported another problem in DCCP [1]
Problem here is that the structure holding RTO timer
(ccid2_hc_tx_rto_expire() handler) is freed too soon.
We can not use del_timer_sync() to cancel the timer
since this timer wants to grab socket lock (that would risk a dead lock)
Solution is to defer the freeing of memory when all references to
the socket were released. Socket timers do own a reference, so this
should fix the issue.
[1]
==================================================================
BUG: KASAN: use-after-free in ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144
Read of size 4 at addr ffff8801d2660540 by task kworker/u4:7/3365
CPU: 1 PID: 3365 Comm: kworker/u4:7 Not tainted 4.13.0-rc4+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
print_address_description+0x73/0x250 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x24e/0x340 mm/kasan/report.c:409
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144
call_timer_fn+0x233/0x830 kernel/time/timer.c:1268
expire_timers kernel/time/timer.c:1307 [inline]
__run_timers+0x7fd/0xb90 kernel/time/timer.c:1601
run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
__do_softirq+0x2f5/0xba3 kernel/softirq.c:284
invoke_softirq kernel/softirq.c:364 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:1044
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:702
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:824 [inline]
RIP: 0010:__raw_write_unlock_irq include/linux/rwlock_api_smp.h:267 [inline]
RIP: 0010:_raw_write_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:343
RSP: 0018:ffff8801cd50eaa8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffffffff85a090c0 RCX: 0000000000000006
RDX: 1ffffffff0b595f3 RSI: 1ffff1003962f989 RDI: ffffffff85acaf98
RBP: ffff8801cd50eab0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cc96ea60
R13: dffffc0000000000 R14: ffff8801cc96e4c0 R15: ffff8801cc96e4c0
</IRQ>
release_task+0xe9e/0x1a40 kernel/exit.c:220
wait_task_zombie kernel/exit.c:1162 [inline]
wait_consider_task+0x29b8/0x33c0 kernel/exit.c:1389
do_wait_thread kernel/exit.c:1452 [inline]
do_wait+0x441/0xa90 kernel/exit.c:1523
kernel_wait4+0x1f5/0x370 kernel/exit.c:1665
SYSC_wait4+0x134/0x140 kernel/exit.c:1677
SyS_wait4+0x2c/0x40 kernel/exit.c:1673
call_usermodehelper_exec_sync kernel/kmod.c:286 [inline]
call_usermodehelper_exec_work+0x1a0/0x2c0 kernel/kmod.c:323
process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097
worker_thread+0x223/0x1860 kernel/workqueue.c:2231
kthread+0x35e/0x430 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425
Allocated by task 21267:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc+0x127/0x750 mm/slab.c:3561
ccid_new+0x20e/0x390 net/dccp/ccid.c:151
dccp_hdlr_ccid+0x27/0x140 net/dccp/feat.c:44
__dccp_feat_activate+0x142/0x2a0 net/dccp/feat.c:344
dccp_feat_activate_values+0x34e/0xa90 net/dccp/feat.c:1538
dccp_rcv_request_sent_state_process net/dccp/input.c:472 [inline]
dccp_rcv_state_process+0xed1/0x1620 net/dccp/input.c:677
dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679
sk_backlog_rcv include/net/sock.h:911 [inline]
__release_sock+0x124/0x360 net/core/sock.c:2269
release_sock+0xa4/0x2a0 net/core/sock.c:2784
inet_wait_for_connect net/ipv4/af_inet.c:557 [inline]
__inet_stream_connect+0x671/0xf00 net/ipv4/af_inet.c:643
inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:682
SYSC_connect+0x204/0x470 net/socket.c:1642
SyS_connect+0x24/0x30 net/socket.c:1623
entry_SYSCALL_64_fastpath+0x1f/0xbe
Freed by task 3049:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x77/0x280 mm/slab.c:3763
ccid_hc_tx_delete+0xc5/0x100 net/dccp/ccid.c:190
dccp_destroy_sock+0x1d1/0x2b0 net/dccp/proto.c:225
inet_csk_destroy_sock+0x166/0x3f0 net/ipv4/inet_connection_sock.c:833
dccp_done+0xb7/0xd0 net/dccp/proto.c:145
dccp_time_wait+0x13d/0x300 net/dccp/minisocks.c:72
dccp_rcv_reset+0x1d1/0x5b0 net/dccp/input.c:160
dccp_rcv_state_process+0x8fc/0x1620 net/dccp/input.c:663
dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679
sk_backlog_rcv include/net/sock.h:911 [inline]
__sk_receive_skb+0x33e/0xc00 net/core/sock.c:521
dccp_v4_rcv+0xef1/0x1c00 net/dccp/ipv4.c:871
ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:248 [inline]
ip_local_deliver+0x1ce/0x6d0 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:477 [inline]
ip_rcv_finish+0x8db/0x19c0 net/ipv4/ip_input.c:397
NF_HOOK include/linux/netfilter.h:248 [inline]
ip_rcv+0xc3f/0x17d0 net/ipv4/ip_input.c:488
__netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4417
__netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4455
process_backlog+0x203/0x740 net/core/dev.c:5130
napi_poll net/core/dev.c:5527 [inline]
net_rx_action+0x792/0x1910 net/core/dev.c:5593
__do_softirq+0x2f5/0xba3 kernel/softirq.c:284
The buggy address belongs to the object at ffff8801d2660100
which belongs to the cache ccid2_hc_tx_sock of size 1240
The buggy address is located 1088 bytes inside of
1240-byte region [ffff8801d2660100, ffff8801d26605d8)
The buggy address belongs to the page:
page:ffffea0007499800 count:1 mapcount:0 mapping:ffff8801d2660100 index:0x0 compound_mapcount: 0
flags: 0x200000000008100(slab|head)
raw: 0200000000008100 ffff8801d2660100 0000000000000000 0000000100000005
raw: ffffea00075271a0 ffffea0007538820 ffff8801d3aef9c0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801d2660400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801d2660480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d2660500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801d2660580: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff8801d2660600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/proto.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
#include <net/checksum.h>
#include <net/inet_sock.h>
+#include <net/inet_common.h>
#include <net/sock.h>
#include <net/xfrm.h>
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int t
EXPORT_SYMBOL_GPL(dccp_packet_name);
+static void dccp_sk_destruct(struct sock *sk)
+{
+ struct dccp_sock *dp = dccp_sk(sk);
+
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ dp->dccps_hc_tx_ccid = NULL;
+ inet_sock_destruct(sk);
+}
+
int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
{
struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, cons
icsk->icsk_syn_retries = sysctl_dccp_request_retries;
sk->sk_state = DCCP_CLOSED;
sk->sk_write_space = dccp_write_space;
+ sk->sk_destruct = dccp_sk_destruct;
icsk->icsk_sync_mss = dccp_sync_mss;
dp->dccps_mss_cache = 536;
dp->dccps_rate_last = jiffies;
@@ -219,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
dp->dccps_hc_rx_ackvec = NULL;
}
ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
- ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
- dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+ dp->dccps_hc_rx_ccid = NULL;
/* clean up feature negotiation state */
dccp_feat_list_purge(&dp->dccps_featneg);
next prev parent reply other threads:[~2017-08-28 8:14 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-28 8:05 [PATCH 4.4 00/53] 4.4.85-stable review Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 01/53] af_key: do not use GFP_KERNEL in atomic contexts Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 02/53] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman
2017-08-28 8:05 ` Greg Kroah-Hartman [this message]
2017-08-28 8:05 ` [PATCH 4.4 04/53] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 05/53] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 06/53] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 07/53] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 08/53] tipc: fix use-after-free Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 09/53] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 10/53] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 11/53] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 12/53] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 13/53] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 14/53] net_sched: fix order of queue length updates in qdisc_replace() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 15/53] mei: me: add broxton pci device ids Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 16/53] mei: me: add lewisburg " Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 17/53] Input: trackpoint - add new trackpoint firmware ID Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 18/53] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 19/53] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 20/53] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 21/53] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 22/53] i2c: designware: Fix system suspend Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 24/53] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 25/53] drm: rcar-du: lvds: Fix PLL frequency-related configuration Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 26/53] drm: rcar-du: lvds: Rename PLLEN bit to PLLON Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 27/53] drm: rcar-du: Fix crash in encoder failure error path Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 28/53] drm: rcar-du: Fix display timing controller parameter Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 29/53] drm: rcar-du: Fix H/V sync signal polarity configuration Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 30/53] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 31/53] cifs: Fix df output for users with quota limits Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 32/53] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman
2017-10-11 19:24 ` Ben Hutchings
2017-08-28 8:05 ` [PATCH 4.4 33/53] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 34/53] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 35/53] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman
2017-09-26 15:32 ` Ben Hutchings
2017-08-28 8:05 ` [PATCH 4.4 36/53] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 37/53] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 38/53] binder: use group leader instead of open thread Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 39/53] binder: Use wake up hint for synchronous transactions Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 40/53] ANDROID: binder: fix proc->tsk check Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 41/53] iio: imu: adis16480: Fix acceleration scale factor for adis16480 Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 42/53] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 43/53] staging: rtl8188eu: add RNX-N150NUB support Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 44/53] ASoC: simple-card: dont fail if sysclk setting is not supported Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 45/53] ASoC: rsnd: disable SRC.out only when stop timing Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 46/53] ASoC: rsnd: avoid pointless loop in rsnd_mod_interrupt() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 47/53] ASoC: rsnd: Add missing initialization of ADG req_rate Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 48/53] ASoC: rsnd: ssi: 24bit data needs right-aligned settings Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 49/53] ASoC: rsnd: dont call update callback if it was NULL Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 50/53] ntb_transport: fix qp count bug Greg Kroah-Hartman
2017-09-26 16:32 ` Ben Hutchings
2017-09-26 17:35 ` Logan Gunthorpe
2017-09-27 8:40 ` Greg Kroah-Hartman
2017-09-27 15:57 ` Logan Gunthorpe
2017-09-28 8:14 ` Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 51/53] ntb_transport: fix bug calculating num_qps_mw Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 52/53] ACPI: ioapic: Clear on-stack resource before using it Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 4.4 53/53] ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal Greg Kroah-Hartman
2017-08-28 19:39 ` [PATCH 4.4 00/53] 4.4.85-stable review Shuah Khan
2017-08-29 0:09 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170828080517.758420940@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=gerrit@erg.abdn.ac.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.