* Re: Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree [not found] <20190311191742.5406D2087F@mail.kernel.org> @ 2019-03-12 9:41 ` Jakub Sitnicki 2019-03-12 12:05 ` Greg KH 0 siblings, 1 reply; 5+ messages in thread From: Jakub Sitnicki @ 2019-03-12 9:41 UTC (permalink / raw) To: stable; +Cc: Sasha Levin, Daniel Borkmann Hi, On Mon, Mar 11, 2019 at 08:17 PM CET, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > sk_msg: Always cancel strp work before freeing the psock > > to the 4.20-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > > The filename of the patch is: > sk_msg-always-cancel-strp-work-before-freeing-the-ps.patch > and it can be found in the queue-4.20 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable@vger.kernel.org> know about it. There is a follow-up fix for this change - e8e3437762ad ("bpf: Stop the psock parser before canceling its work") in bpf tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 I think this patch should not go to into stable without the follow-up fix. Otherwise kselftests for bpf will be noisy due to kernel warnings. Thanks, Jakub > > > > commit d3747ebdfd2fd5e12d8d04ad3f6261503ce52913 > Author: Jakub Sitnicki <jakub@cloudflare.com> > Date: Mon Jan 28 10:13:35 2019 +0100 > > sk_msg: Always cancel strp work before freeing the psock > > [ Upstream commit 1d79895aef18fa05789995d86d523c9b2ee58a02 ] > > Despite having stopped the parser, we still need to deinitialize it > by calling strp_done so that it cancels its work. Otherwise the worker > thread can run after we have freed the parser, and attempt to access > its workqueue resulting in a use-after-free: > > ================================================================== > BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0 > Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93 > > CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 > Workqueue: (null) (kstrp) > Call Trace: > print_address_description+0x6e/0x2b0 > ? pwq_activate_delayed_work+0x1b/0x1d0 > kasan_report+0xfd/0x177 > ? pwq_activate_delayed_work+0x1b/0x1d0 > ? pwq_activate_delayed_work+0x1b/0x1d0 > pwq_activate_delayed_work+0x1b/0x1d0 > ? process_one_work+0x4aa/0x660 > pwq_dec_nr_in_flight+0x9b/0x100 > worker_thread+0x82/0x680 > ? process_one_work+0x660/0x660 > kthread+0x1b9/0x1e0 > ? __kthread_create_on_node+0x250/0x250 > ret_from_fork+0x1f/0x30 > > Allocated by task 111: > sk_psock_init+0x3c/0x1b0 > sock_map_link.isra.2+0x103/0x4b0 > sock_map_update_common+0x94/0x270 > sock_map_update_elem+0x145/0x160 > __se_sys_bpf+0x152e/0x1e10 > do_syscall_64+0xb2/0x3e0 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Freed by task 112: > kfree+0x7f/0x140 > process_one_work+0x40b/0x660 > worker_thread+0x82/0x680 > kthread+0x1b9/0x1e0 > ret_from_fork+0x1f/0x30 > > The buggy address belongs to the object at ffff888069975180 > which belongs to the cache kmalloc-512 of size 512 > The buggy address is located 192 bytes inside of > 512-byte region [ffff888069975180, ffff888069975380) > The buggy address belongs to the page: > page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0 > flags: 0x4000000000010200(slab|head) > raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280 > raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > >ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ^ > ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ================================================================== > > Reported-by: Marek Majkowski <marek@cloudflare.com> > Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> > Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com > Acked-by: Song Liu <songliubraving@fb.com> > Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> > Signed-off-by: Sasha Levin <sashal@kernel.org> > > diff --git a/net/core/skmsg.c b/net/core/skmsg.c > index 54d854807630..4932861d7b88 100644 > --- a/net/core/skmsg.c > +++ b/net/core/skmsg.c > @@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc) > struct sk_psock *psock = container_of(gc, struct sk_psock, gc); > > /* No sk_callback_lock since already detached. */ > - if (psock->parser.enabled) > - strp_done(&psock->parser.strp); > + strp_done(&psock->parser.strp); > > cancel_work_sync(&psock->work); > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree 2019-03-12 9:41 ` Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree Jakub Sitnicki @ 2019-03-12 12:05 ` Greg KH 2019-03-12 12:12 ` Daniel Borkmann 0 siblings, 1 reply; 5+ messages in thread From: Greg KH @ 2019-03-12 12:05 UTC (permalink / raw) To: Jakub Sitnicki; +Cc: stable, Sasha Levin, Daniel Borkmann On Tue, Mar 12, 2019 at 10:41:26AM +0100, Jakub Sitnicki wrote: > Hi, > > On Mon, Mar 11, 2019 at 08:17 PM CET, Sasha Levin wrote: > > This is a note to let you know that I've just added the patch titled > > > > sk_msg: Always cancel strp work before freeing the psock > > > > to the 4.20-stable tree which can be found at: > > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > > > > The filename of the patch is: > > sk_msg-always-cancel-strp-work-before-freeing-the-ps.patch > > and it can be found in the queue-4.20 subdirectory. > > > > If you, or anyone else, feels it should not be added to the stable tree, > > please let <stable@vger.kernel.org> know about it. > > There is a follow-up fix for this change - e8e3437762ad ("bpf: Stop the > psock parser before canceling its work") in bpf tree: > > https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 > > I think this patch should not go to into stable without the follow-up > fix. Otherwise kselftests for bpf will be noisy due to kernel warnings. Thanks, I've dropped this now. We can add this back when the original patch hits Linus's tree. greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree 2019-03-12 12:05 ` Greg KH @ 2019-03-12 12:12 ` Daniel Borkmann 2019-03-12 12:18 ` Greg KH 0 siblings, 1 reply; 5+ messages in thread From: Daniel Borkmann @ 2019-03-12 12:12 UTC (permalink / raw) To: Greg KH, Jakub Sitnicki; +Cc: stable, Sasha Levin On 03/12/2019 01:05 PM, Greg KH wrote: > On Tue, Mar 12, 2019 at 10:41:26AM +0100, Jakub Sitnicki wrote: >> Hi, >> >> On Mon, Mar 11, 2019 at 08:17 PM CET, Sasha Levin wrote: >>> This is a note to let you know that I've just added the patch titled >>> >>> sk_msg: Always cancel strp work before freeing the psock >>> >>> to the 4.20-stable tree which can be found at: >>> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary >>> >>> The filename of the patch is: >>> sk_msg-always-cancel-strp-work-before-freeing-the-ps.patch >>> and it can be found in the queue-4.20 subdirectory. >>> >>> If you, or anyone else, feels it should not be added to the stable tree, >>> please let <stable@vger.kernel.org> know about it. >> >> There is a follow-up fix for this change - e8e3437762ad ("bpf: Stop the >> psock parser before canceling its work") in bpf tree: >> >> https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 >> >> I think this patch should not go to into stable without the follow-up >> fix. Otherwise kselftests for bpf will be noisy due to kernel warnings. > > Thanks, I've dropped this now. We can add this back when the original > patch hits Linus's tree. This is already in Linus tree here, so we should be able to proceed with queueing both of them: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 Thanks, Daniel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree 2019-03-12 12:12 ` Daniel Borkmann @ 2019-03-12 12:18 ` Greg KH 2019-03-12 12:20 ` Daniel Borkmann 0 siblings, 1 reply; 5+ messages in thread From: Greg KH @ 2019-03-12 12:18 UTC (permalink / raw) To: Daniel Borkmann; +Cc: Jakub Sitnicki, stable, Sasha Levin On Tue, Mar 12, 2019 at 01:12:51PM +0100, Daniel Borkmann wrote: > On 03/12/2019 01:05 PM, Greg KH wrote: > > On Tue, Mar 12, 2019 at 10:41:26AM +0100, Jakub Sitnicki wrote: > >> Hi, > >> > >> On Mon, Mar 11, 2019 at 08:17 PM CET, Sasha Levin wrote: > >>> This is a note to let you know that I've just added the patch titled > >>> > >>> sk_msg: Always cancel strp work before freeing the psock > >>> > >>> to the 4.20-stable tree which can be found at: > >>> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > >>> > >>> The filename of the patch is: > >>> sk_msg-always-cancel-strp-work-before-freeing-the-ps.patch > >>> and it can be found in the queue-4.20 subdirectory. > >>> > >>> If you, or anyone else, feels it should not be added to the stable tree, > >>> please let <stable@vger.kernel.org> know about it. > >> > >> There is a follow-up fix for this change - e8e3437762ad ("bpf: Stop the > >> psock parser before canceling its work") in bpf tree: > >> > >> https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 > >> > >> I think this patch should not go to into stable without the follow-up > >> fix. Otherwise kselftests for bpf will be noisy due to kernel warnings. > > > > Thanks, I've dropped this now. We can add this back when the original > > patch hits Linus's tree. > > This is already in Linus tree here, so we should be able to proceed with > queueing both of them: > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 Ah, thanks, didn't catch that, no morning coffee yet :) I'll go queue up this patch for 5.0 now, and for 4.20 along with the original one. thanks again, greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree 2019-03-12 12:18 ` Greg KH @ 2019-03-12 12:20 ` Daniel Borkmann 0 siblings, 0 replies; 5+ messages in thread From: Daniel Borkmann @ 2019-03-12 12:20 UTC (permalink / raw) To: Greg KH; +Cc: Jakub Sitnicki, stable, Sasha Levin On 03/12/2019 01:18 PM, Greg KH wrote: > On Tue, Mar 12, 2019 at 01:12:51PM +0100, Daniel Borkmann wrote: >> On 03/12/2019 01:05 PM, Greg KH wrote: >>> On Tue, Mar 12, 2019 at 10:41:26AM +0100, Jakub Sitnicki wrote: >>>> Hi, >>>> >>>> On Mon, Mar 11, 2019 at 08:17 PM CET, Sasha Levin wrote: >>>>> This is a note to let you know that I've just added the patch titled >>>>> >>>>> sk_msg: Always cancel strp work before freeing the psock >>>>> >>>>> to the 4.20-stable tree which can be found at: >>>>> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary >>>>> >>>>> The filename of the patch is: >>>>> sk_msg-always-cancel-strp-work-before-freeing-the-ps.patch >>>>> and it can be found in the queue-4.20 subdirectory. >>>>> >>>>> If you, or anyone else, feels it should not be added to the stable tree, >>>>> please let <stable@vger.kernel.org> know about it. >>>> >>>> There is a follow-up fix for this change - e8e3437762ad ("bpf: Stop the >>>> psock parser before canceling its work") in bpf tree: >>>> >>>> https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 >>>> >>>> I think this patch should not go to into stable without the follow-up >>>> fix. Otherwise kselftests for bpf will be noisy due to kernel warnings. >>> >>> Thanks, I've dropped this now. We can add this back when the original >>> patch hits Linus's tree. >> >> This is already in Linus tree here, so we should be able to proceed with >> queueing both of them: >> >> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8e3437762ad938880dd48a3c52d702e7cf3c124 > > Ah, thanks, didn't catch that, no morning coffee yet :) > > I'll go queue up this patch for 5.0 now, and for 4.20 along with the > original one. Sounds good, thanks! ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-03-12 12:20 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20190311191742.5406D2087F@mail.kernel.org>
2019-03-12 9:41 ` Patch "sk_msg: Always cancel strp work before freeing the psock" has been added to the 4.20-stable tree Jakub Sitnicki
2019-03-12 12:05 ` Greg KH
2019-03-12 12:12 ` Daniel Borkmann
2019-03-12 12:18 ` Greg KH
2019-03-12 12:20 ` Daniel Borkmann
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.