All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	Gerrit Renker <gerrit@erg.abdn.ac.uk>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 03/53] dccp: defer ccid_hc_tx_delete() at dismantle time
Date: Mon, 28 Aug 2017 10:05:08 +0200	[thread overview]
Message-ID: <20170828080517.758420940@linuxfoundation.org> (raw)
In-Reply-To: <20170828080517.599193891@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 120e9dabaf551c6dc03d3a10a1f026376cb1811c ]

syszkaller team reported another problem in DCCP [1]

Problem here is that the structure holding RTO timer
(ccid2_hc_tx_rto_expire() handler) is freed too soon.

We can not use del_timer_sync() to cancel the timer
since this timer wants to grab socket lock (that would risk a dead lock)

Solution is to defer the freeing of memory when all references to
the socket were released. Socket timers do own a reference, so this
should fix the issue.

[1]

==================================================================
BUG: KASAN: use-after-free in ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144
Read of size 4 at addr ffff8801d2660540 by task kworker/u4:7/3365

CPU: 1 PID: 3365 Comm: kworker/u4:7 Not tainted 4.13.0-rc4+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x24e/0x340 mm/kasan/report.c:409
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
 ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144
 call_timer_fn+0x233/0x830 kernel/time/timer.c:1268
 expire_timers kernel/time/timer.c:1307 [inline]
 __run_timers+0x7fd/0xb90 kernel/time/timer.c:1601
 run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
 __do_softirq+0x2f5/0xba3 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1cc/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:1044
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:702
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:824 [inline]
RIP: 0010:__raw_write_unlock_irq include/linux/rwlock_api_smp.h:267 [inline]
RIP: 0010:_raw_write_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:343
RSP: 0018:ffff8801cd50eaa8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffffffff85a090c0 RCX: 0000000000000006
RDX: 1ffffffff0b595f3 RSI: 1ffff1003962f989 RDI: ffffffff85acaf98
RBP: ffff8801cd50eab0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cc96ea60
R13: dffffc0000000000 R14: ffff8801cc96e4c0 R15: ffff8801cc96e4c0
 </IRQ>
 release_task+0xe9e/0x1a40 kernel/exit.c:220
 wait_task_zombie kernel/exit.c:1162 [inline]
 wait_consider_task+0x29b8/0x33c0 kernel/exit.c:1389
 do_wait_thread kernel/exit.c:1452 [inline]
 do_wait+0x441/0xa90 kernel/exit.c:1523
 kernel_wait4+0x1f5/0x370 kernel/exit.c:1665
 SYSC_wait4+0x134/0x140 kernel/exit.c:1677
 SyS_wait4+0x2c/0x40 kernel/exit.c:1673
 call_usermodehelper_exec_sync kernel/kmod.c:286 [inline]
 call_usermodehelper_exec_work+0x1a0/0x2c0 kernel/kmod.c:323
 process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097
 worker_thread+0x223/0x1860 kernel/workqueue.c:2231
 kthread+0x35e/0x430 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425

Allocated by task 21267:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 kmem_cache_alloc+0x127/0x750 mm/slab.c:3561
 ccid_new+0x20e/0x390 net/dccp/ccid.c:151
 dccp_hdlr_ccid+0x27/0x140 net/dccp/feat.c:44
 __dccp_feat_activate+0x142/0x2a0 net/dccp/feat.c:344
 dccp_feat_activate_values+0x34e/0xa90 net/dccp/feat.c:1538
 dccp_rcv_request_sent_state_process net/dccp/input.c:472 [inline]
 dccp_rcv_state_process+0xed1/0x1620 net/dccp/input.c:677
 dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679
 sk_backlog_rcv include/net/sock.h:911 [inline]
 __release_sock+0x124/0x360 net/core/sock.c:2269
 release_sock+0xa4/0x2a0 net/core/sock.c:2784
 inet_wait_for_connect net/ipv4/af_inet.c:557 [inline]
 __inet_stream_connect+0x671/0xf00 net/ipv4/af_inet.c:643
 inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:682
 SYSC_connect+0x204/0x470 net/socket.c:1642
 SyS_connect+0x24/0x30 net/socket.c:1623
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 3049:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kmem_cache_free+0x77/0x280 mm/slab.c:3763
 ccid_hc_tx_delete+0xc5/0x100 net/dccp/ccid.c:190
 dccp_destroy_sock+0x1d1/0x2b0 net/dccp/proto.c:225
 inet_csk_destroy_sock+0x166/0x3f0 net/ipv4/inet_connection_sock.c:833
 dccp_done+0xb7/0xd0 net/dccp/proto.c:145
 dccp_time_wait+0x13d/0x300 net/dccp/minisocks.c:72
 dccp_rcv_reset+0x1d1/0x5b0 net/dccp/input.c:160
 dccp_rcv_state_process+0x8fc/0x1620 net/dccp/input.c:663
 dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679
 sk_backlog_rcv include/net/sock.h:911 [inline]
 __sk_receive_skb+0x33e/0xc00 net/core/sock.c:521
 dccp_v4_rcv+0xef1/0x1c00 net/dccp/ipv4.c:871
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:248 [inline]
 ip_local_deliver+0x1ce/0x6d0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:477 [inline]
 ip_rcv_finish+0x8db/0x19c0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:248 [inline]
 ip_rcv+0xc3f/0x17d0 net/ipv4/ip_input.c:488
 __netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4417
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4455
 process_backlog+0x203/0x740 net/core/dev.c:5130
 napi_poll net/core/dev.c:5527 [inline]
 net_rx_action+0x792/0x1910 net/core/dev.c:5593
 __do_softirq+0x2f5/0xba3 kernel/softirq.c:284

The buggy address belongs to the object at ffff8801d2660100
 which belongs to the cache ccid2_hc_tx_sock of size 1240
The buggy address is located 1088 bytes inside of
 1240-byte region [ffff8801d2660100, ffff8801d26605d8)
The buggy address belongs to the page:
page:ffffea0007499800 count:1 mapcount:0 mapping:ffff8801d2660100 index:0x0 compound_mapcount: 0
flags: 0x200000000008100(slab|head)
raw: 0200000000008100 ffff8801d2660100 0000000000000000 0000000100000005
raw: ffffea00075271a0 ffffea0007538820 ffff8801d3aef9c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d2660400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d2660480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d2660500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff8801d2660580: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
 ffff8801d2660600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/proto.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
+#include <net/inet_common.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int t
 
 EXPORT_SYMBOL_GPL(dccp_packet_name);
 
+static void dccp_sk_destruct(struct sock *sk)
+{
+	struct dccp_sock *dp = dccp_sk(sk);
+
+	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+	dp->dccps_hc_tx_ccid = NULL;
+	inet_sock_destruct(sk);
+}
+
 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 {
 	struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, cons
 	icsk->icsk_syn_retries	= sysctl_dccp_request_retries;
 	sk->sk_state		= DCCP_CLOSED;
 	sk->sk_write_space	= dccp_write_space;
+	sk->sk_destruct		= dccp_sk_destruct;
 	icsk->icsk_sync_mss	= dccp_sync_mss;
 	dp->dccps_mss_cache	= 536;
 	dp->dccps_rate_last	= jiffies;
@@ -219,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
 		dp->dccps_hc_rx_ackvec = NULL;
 	}
 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-	dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+	dp->dccps_hc_rx_ccid = NULL;
 
 	/* clean up feature negotiation state */
 	dccp_feat_list_purge(&dp->dccps_featneg);

  parent reply	other threads:[~2017-08-28  8:14 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-08-28  8:05 [PATCH 4.4 00/53] 4.4.85-stable review Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 01/53] af_key: do not use GFP_KERNEL in atomic contexts Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 02/53] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman
2017-08-28  8:05 ` Greg Kroah-Hartman [this message]
2017-08-28  8:05 ` [PATCH 4.4 04/53] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 05/53] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 06/53] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 07/53] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 08/53] tipc: fix use-after-free Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 09/53] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 10/53] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 11/53] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 12/53] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 13/53] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 14/53] net_sched: fix order of queue length updates in qdisc_replace() Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 15/53] mei: me: add broxton pci device ids Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 16/53] mei: me: add lewisburg " Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 17/53] Input: trackpoint - add new trackpoint firmware ID Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 18/53] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 19/53] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 20/53] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 21/53] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 22/53] i2c: designware: Fix system suspend Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 24/53] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 25/53] drm: rcar-du: lvds: Fix PLL frequency-related configuration Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 26/53] drm: rcar-du: lvds: Rename PLLEN bit to PLLON Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 27/53] drm: rcar-du: Fix crash in encoder failure error path Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 28/53] drm: rcar-du: Fix display timing controller parameter Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 29/53] drm: rcar-du: Fix H/V sync signal polarity configuration Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 30/53] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 31/53] cifs: Fix df output for users with quota limits Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 32/53] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman
2017-10-11 19:24   ` Ben Hutchings
2017-08-28  8:05 ` [PATCH 4.4 33/53] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 34/53] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 35/53] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman
2017-09-26 15:32   ` Ben Hutchings
2017-08-28  8:05 ` [PATCH 4.4 36/53] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 37/53] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 38/53] binder: use group leader instead of open thread Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 39/53] binder: Use wake up hint for synchronous transactions Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 40/53] ANDROID: binder: fix proc->tsk check Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 41/53] iio: imu: adis16480: Fix acceleration scale factor for adis16480 Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 42/53] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 43/53] staging: rtl8188eu: add RNX-N150NUB support Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 44/53] ASoC: simple-card: dont fail if sysclk setting is not supported Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 45/53] ASoC: rsnd: disable SRC.out only when stop timing Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 46/53] ASoC: rsnd: avoid pointless loop in rsnd_mod_interrupt() Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 47/53] ASoC: rsnd: Add missing initialization of ADG req_rate Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 48/53] ASoC: rsnd: ssi: 24bit data needs right-aligned settings Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 49/53] ASoC: rsnd: dont call update callback if it was NULL Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 50/53] ntb_transport: fix qp count bug Greg Kroah-Hartman
2017-09-26 16:32   ` Ben Hutchings
2017-09-26 17:35     ` Logan Gunthorpe
2017-09-27  8:40       ` Greg Kroah-Hartman
2017-09-27 15:57         ` Logan Gunthorpe
2017-09-28  8:14           ` Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 51/53] ntb_transport: fix bug calculating num_qps_mw Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 52/53] ACPI: ioapic: Clear on-stack resource before using it Greg Kroah-Hartman
2017-08-28  8:05 ` [PATCH 4.4 53/53] ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal Greg Kroah-Hartman
2017-08-28 19:39 ` [PATCH 4.4 00/53] 4.4.85-stable review Shuah Khan
2017-08-29  0:09 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170828080517.758420940@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=dvyukov@google.com \
    --cc=edumazet@google.com \
    --cc=gerrit@erg.abdn.ac.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.