[PATCH net] net: nfc: llcp: Add lock when modifying device list

[PATCH net] net: nfc: llcp: Add lock when modifying device list

[Jeremy Cline]

The device list needs its associated lock held when modifying it, or the
list could become corrupted, as syzbot discovered.

Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
---
 net/nfc/llcp_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index f60e424e0607..6705bb895e23 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1636,7 +1636,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
 	timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0);
 	INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work);
 
+	spin_lock(&llcp_devices_lock);
 	list_add(&local->list, &llcp_devices);
+	spin_unlock(&llcp_devices_lock);
 
 	return 0;
 }
-- 
2.41.0

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[Simon Horman]

On Fri, Sep 08, 2023 at 07:58:53PM -0400, Jeremy Cline wrote:
> The device list needs its associated lock held when modifying it, or the
> list could become corrupted, as syzbot discovered.
> 
> Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> Signed-off-by: Jeremy Cline <jeremy@jcline.org>

Hi Jeremy,

thanks for your patch.

I don't think you need to resubmit for this,
I think this patch warrants a fixes tag:

Fixes: d646960f7986 ("NFC: Initial LLCP support")

Otherwise, this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[Jeremy Cline]

On Sun, Sep 10, 2023 at 05:28:12PM +0200, Simon Horman wrote:
> On Fri, Sep 08, 2023 at 07:58:53PM -0400, Jeremy Cline wrote:
> > The device list needs its associated lock held when modifying it, or the
> > list could become corrupted, as syzbot discovered.
> > 
> > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> > Signed-off-by: Jeremy Cline <jeremy@jcline.org>
> 
> Hi Jeremy,
> 
> thanks for your patch.
> 
> I don't think you need to resubmit for this,
> I think this patch warrants a fixes tag:
> 
> Fixes: d646960f7986 ("NFC: Initial LLCP support")
> 

My bad, indeed. The lock in question looks to have been added in
6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
nfc_llcp_find_local") which itself includes a couple fix tags, should
this reference that commit instead as it won't backport without that
one?

> Otherwise, this looks good to me.
> 
> Reviewed-by: Simon Horman <horms@kernel.org>
> 

Thanks,
Jeremy

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[Simon Horman]

On Sun, Sep 10, 2023 at 07:06:19PM -0400, Jeremy Cline wrote:
> On Sun, Sep 10, 2023 at 05:28:12PM +0200, Simon Horman wrote:
> > On Fri, Sep 08, 2023 at 07:58:53PM -0400, Jeremy Cline wrote:
> > > The device list needs its associated lock held when modifying it, or the
> > > list could become corrupted, as syzbot discovered.
> > > 
> > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> > > Signed-off-by: Jeremy Cline <jeremy@jcline.org>
> > 
> > Hi Jeremy,
> > 
> > thanks for your patch.
> > 
> > I don't think you need to resubmit for this,
> > I think this patch warrants a fixes tag:
> > 
> > Fixes: d646960f7986 ("NFC: Initial LLCP support")
> > 
> 
> My bad, indeed. The lock in question looks to have been added in
> 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
> nfc_llcp_find_local") which itself includes a couple fix tags, should
> this reference that commit instead as it won't backport without that
> one?

Yes, I think that is likely.
Sorry for not noticing that.

> > Otherwise, this looks good to me.
> > 
> > Reviewed-by: Simon Horman <horms@kernel.org>
> > 
> 
> Thanks,
> Jeremy
> 

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[Simon Horman]

On Mon, Sep 11, 2023 at 07:59:04AM +0200, Simon Horman wrote:
> On Sun, Sep 10, 2023 at 07:06:19PM -0400, Jeremy Cline wrote:
> > On Sun, Sep 10, 2023 at 05:28:12PM +0200, Simon Horman wrote:
> > > On Fri, Sep 08, 2023 at 07:58:53PM -0400, Jeremy Cline wrote:
> > > > The device list needs its associated lock held when modifying it, or the
> > > > list could become corrupted, as syzbot discovered.
> > > > 
> > > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> > > > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> > > > Signed-off-by: Jeremy Cline <jeremy@jcline.org>
> > > 
> > > Hi Jeremy,
> > > 
> > > thanks for your patch.
> > > 
> > > I don't think you need to resubmit for this,
> > > I think this patch warrants a fixes tag:
> > > 
> > > Fixes: d646960f7986 ("NFC: Initial LLCP support")
> > > 
> > 
> > My bad, indeed. The lock in question looks to have been added in
> > 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
> > nfc_llcp_find_local") which itself includes a couple fix tags, should
> > this reference that commit instead as it won't backport without that
> > one?
> 
> Yes, I think that is likely.
> Sorry for not noticing that.

And further, sorry for being vague in my previous email.
Having now looked over 6709d4b7bc2e I agree it is
the correct commit for a fixes tag for this patch.

> 
> > > Otherwise, this looks good to me.
> > > 
> > > Reviewed-by: Simon Horman <horms@kernel.org>
> > > 
> > 
> > Thanks,
> > Jeremy
> > 
> 

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[Jeremy Cline]

On Mon, Sep 11, 2023 at 02:52:51PM +0200, Simon Horman wrote:
> On Mon, Sep 11, 2023 at 07:59:04AM +0200, Simon Horman wrote:
> > On Sun, Sep 10, 2023 at 07:06:19PM -0400, Jeremy Cline wrote:
> > > On Sun, Sep 10, 2023 at 05:28:12PM +0200, Simon Horman wrote:
> > > > On Fri, Sep 08, 2023 at 07:58:53PM -0400, Jeremy Cline wrote:
> > > > > The device list needs its associated lock held when modifying it, or the
> > > > > list could become corrupted, as syzbot discovered.
> > > > > 
> > > > > Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> > > > > Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> > > > > Signed-off-by: Jeremy Cline <jeremy@jcline.org>
> > > > 
> > > > Hi Jeremy,
> > > > 
> > > > thanks for your patch.
> > > > 
> > > > I don't think you need to resubmit for this,
> > > > I think this patch warrants a fixes tag:
> > > > 
> > > > Fixes: d646960f7986 ("NFC: Initial LLCP support")
> > > > 
> > > 
> > > My bad, indeed. The lock in question looks to have been added in
> > > 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
> > > nfc_llcp_find_local") which itself includes a couple fix tags, should
> > > this reference that commit instead as it won't backport without that
> > > one?
> > 
> > Yes, I think that is likely.
> > Sorry for not noticing that.
> 
> And further, sorry for being vague in my previous email.
> Having now looked over 6709d4b7bc2e I agree it is
> the correct commit for a fixes tag for this patch.
> 

Super, thanks. If it's helpful I can re-roll the patch, otherwise I'll
just leave it as-is.

Thanks,
Jeremy

Re: [PATCH net] net: nfc: llcp: Add lock when modifying device list

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  8 Sep 2023 19:58:53 -0400 you wrote:
> The device list needs its associated lock held when modifying it, or the
> list could become corrupted, as syzbot discovered.
> 
> Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14
> Signed-off-by: Jeremy Cline <jeremy@jcline.org>
> 
> [...]

Here is the summary with links:
  - [net] net: nfc: llcp: Add lock when modifying device list
    https://git.kernel.org/netdev/net/c/dfc7f7a988da

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html