From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224JS1eW99oeC3E7S/88adMmV6Y2zzAsi14PG8M/ARO4YUd0xOqGAJ3Wo8a4nt1ocQVkAdJ0 ARC-Seal: i=1; a=rsa-sha256; t=1518707926; cv=none; d=google.com; s=arc-20160816; b=ayykgMf17QgA92I6Rp+/tnmA6ftZVMzxZjpcnfCv0QMAtZLfKZmLnksUsvtQMi7IEn xWcqAwlvmMTHHoV67gTpvGQaagcV0l5uIexgQQB5ljuh08CJ0D6t45/NMf+C/Xp6WsJy 3nzGMQUWW/2HfOmquSds7omD/4xzV9ZK3jAiBLAqMkj2p/V+n6Am6VXWG3hLMFZMNukL apR/NK3mgJIsiZ9M6fgd4SYCCTdSDIcdqqp2ckux5QIG+2qJ4JTIr0NCHyBabthk4v3o hKy/No/YnJXGG+kl5ZE8yk7tC1ZBawfgnDXBDqwtP7DNGWSbR3uSgdI2Fq6eqjmJo/ON tRSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=LmPPWHCxZCrzkkvs0KUnANzUXcpqJ5toowhq9xBrcXM=; b=yvrtC+C2gYMDIs8Dd1QWNYbfIQwx7r3fqGGr9PSs3czHS/4cUun9dbeSHuXFSwlsJl KnlofN1mD54x1JJab3/zzLw3WHpPH/c3NularAqJvsj/kYlqpErn5G3Y3z5gl9Y7zwKU yW2XN2A/10fymEDX5wat0LsYvjg9uEKpoWKvkEjz1SRb07Fwiur+Wev/G5d211j1doJa 3j0YRJhReAiydPmCL6mZNB60E4h45sYnJIdbU2YUybhWxM5vuuBXkgo+adPUwrnPjVVW 9Bcd+qNOpJCBIXa4+T+/86783YHE9gqa9ZQD32gIwWe4RoIl4rSgTKdWRIYPhjRmd/hc lD8Q== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 3.18 03/45] net: igmp: add a missing rcu locking section Date: Thu, 15 Feb 2018 16:16:54 +0100 Message-Id: <20180215144116.595763805@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180215144115.863307741@linuxfoundation.org> References: <20180215144115.863307741@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1592480683023025749?= X-GMAIL-MSGID: =?utf-8?q?1592480683023025749?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit e7aadb27a5415e8125834b84a74477bfbee4eff5 ] Newly added igmpv3_get_srcaddr() needs to be called under rcu lock. Timer callbacks do not ensure this locking. ============================= WARNING: suspicious RCU usage 4.15.0+ #200 Not tainted ----------------------------- ./include/linux/inetdevice.h:216 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by syzkaller616973/4074: #0: (&mm->mmap_sem){++++}, at: [<00000000bfce669e>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1355 #1: ((&im->timer)){+.-.}, at: [<00000000619d2f71>] lockdep_copy_map include/linux/lockdep.h:178 [inline] #1: ((&im->timer)){+.-.}, at: [<00000000619d2f71>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1316 #2: (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] spin_lock_bh include/linux/spinlock.h:315 [inline] #2: (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] igmpv3_send_report+0x98/0x5b0 net/ipv4/igmp.c:600 stack backtrace: CPU: 0 PID: 4074 Comm: syzkaller616973 Not tainted 4.15.0+ #200 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 __in_dev_get_rcu include/linux/inetdevice.h:216 [inline] igmpv3_get_srcaddr net/ipv4/igmp.c:329 [inline] igmpv3_newpack+0xeef/0x12e0 net/ipv4/igmp.c:389 add_grhead.isra.27+0x235/0x300 net/ipv4/igmp.c:432 add_grec+0xbd3/0x1170 net/ipv4/igmp.c:565 igmpv3_send_report+0xd5/0x5b0 net/ipv4/igmp.c:605 igmp_send_report+0xc43/0x1050 net/ipv4/igmp.c:722 igmp_timer_expire+0x322/0x5c0 net/ipv4/igmp.c:831 call_timer_fn+0x228/0x820 kernel/time/timer.c:1326 expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:541 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938 Fixes: a46182b00290 ("net: igmp: Use correct source address on IGMPv3 reports") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/igmp.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -384,7 +384,11 @@ static struct sk_buff *igmpv3_newpack(st pip->frag_off = htons(IP_DF); pip->ttl = 1; pip->daddr = fl4.daddr; + + rcu_read_lock(); pip->saddr = igmpv3_get_srcaddr(dev, &fl4); + rcu_read_unlock(); + pip->protocol = IPPROTO_IGMP; pip->tot_len = 0; /* filled in later */ ip_select_ident(skb, NULL);