From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E9C71A317D for ; Tue, 22 Apr 2025 12:28:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745324917; cv=none; b=XYwSuBPaYJM7u0PsDT/d3XlXsdHcYirDCb5Nc2vK6ympXr38EoRIaJqO2TPPKZtPdWwpPfNV7ZCbrpFikVJNW7CGDDxAQnF3dcO+j1NLI3nYXHjSlvRQQSLnQ50bPfBp7oW6jlc5TWF0xC+fw4PRsvmEtp1QX6Ypzr0dFdO6wAo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745324917; c=relaxed/simple; bh=9o4Ct5oPQcRAvUtHbnEvgyXCjeAY+3bYihDGYD4aows=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=rOIj/d8Pmt+8rP8HujilVMgrWHPRM1ujYsYUNyVATA0K101yAD55OnqqzeKKuWgXKslQioilHJNqGkg1tWJodd466MMLuNnB+3CkWNpv4TNRLNgPeVQ4Acs6PT/fT3ENcLR86QINy7FWtJJWwkg+ff49R3CtkWgaKxLYLJAwiIU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=D58kUsBc; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="D58kUsBc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12F11C4CEE9; Tue, 22 Apr 2025 12:28:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1745324917; bh=9o4Ct5oPQcRAvUtHbnEvgyXCjeAY+3bYihDGYD4aows=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=D58kUsBcroX5/pBlshXIWywZdrDk8k/KuOlM19ll8C/6A79X6dznwni1weXUiGp6l 6RJqzGGKMi7MTKrSCH4uklyMgkzqLvzLfoHVNQX77yVtBPCjlQ+nTT2T49DEwk7ODl NoqrVVFgON1dqGbApiM0eqHr+fqp8TWMhP07sYabjbeI5RoxsMrFhsKnk+utozjlll NmBpYXTHpSH1C3RB1T9NMqsqh3JgOVa3RokI6urtrP5mBjgu/BMdtkt0MMD2OYGB13 mRFKLwd6ljfIzVkwA7p8YVSdf18v3+VxeDGhUnpIh+tCaUCOAf1okcwUe2bUIK4fsi lUC97apFMRs3g== Date: Tue, 22 Apr 2025 13:28:32 +0100 From: Simon Horman To: Tung Nguyen Cc: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org, edumazet@google.com, pabeni@redhat.com, jmaloy@redhat.com, syzbot+ed60da8d686dc709164c@syzkaller.appspotmail.com, Hoang Le , tipc-discussion@lists.sourceforge.net Subject: Re: [PATCH net] tipc: fix NULL pointer dereference in tipc_mon_reinit_self() Message-ID: <20250422122832.GE2843373@horms.kernel.org> References: <20250417074826.578115-1-tung.quang.nguyen@est.tech> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250417074826.578115-1-tung.quang.nguyen@est.tech> + Hoang Le, tipc-discussion On Thu, Apr 17, 2025 at 02:47:15PM +0700, Tung Nguyen wrote: > syzbot reported: > > tipc: Node number set to 1055423674 > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > CPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > Workqueue: events tipc_net_finalize_work > RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 > ... > RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba > RDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010 > RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 > R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010 > FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > > tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140 > process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 > process_scheduled_works kernel/workqueue.c:3319 [inline] > worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 > kthread+0x3c2/0x780 kernel/kthread.c:464 > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > > ... > RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 > ... > RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba > RDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010 > RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 > R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010 > FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > There is a racing condition between workqueue created when enabling > bearer and another thread created when disabling bearer right after > that as follow: > > enabling_bearer | disabling_bearer > --------------- | ---------------- > tipc_disc_timeout() | > { | bearer_disable() > ... | { > schedule_work(&tn->work); | tipc_mon_delete() > ... | { > } | ... > | write_lock_bh(&mon->lock); > | mon->self = NULL; > | write_unlock_bh(&mon->lock); > | ... > | } > tipc_net_finalize_work() | } > { | > ... | > tipc_net_finalize() | > { | > ... | > tipc_mon_reinit_self() | > { | > ... | > write_lock_bh(&mon->lock); | > mon->self->addr = tipc_own_addr(net); | > write_unlock_bh(&mon->lock); | > ... | > } | > ... | > } | > ... | > } | > > 'mon->self' is set to NULL in disabling_bearer thread and dereferenced > later in enabling_bearer thread. > > This commit fixes this issue by validating 'mon->self' before assigning > node address to it. > > Reported-by: syzbot+ed60da8d686dc709164c@syzkaller.appspotmail.com > Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated") > Signed-off-by: Tung Nguyen Reviewed-by: Simon Horman > --- > net/tipc/monitor.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c > index e2f19627e43d..b45c5b91bc7a 100644 > --- a/net/tipc/monitor.c > +++ b/net/tipc/monitor.c > @@ -716,7 +716,8 @@ void tipc_mon_reinit_self(struct net *net) > if (!mon) > continue; > write_lock_bh(&mon->lock); > - mon->self->addr = tipc_own_addr(net); > + if (mon->self) > + mon->self->addr = tipc_own_addr(net); > write_unlock_bh(&mon->lock); > } > } > -- > 2.43.0 > >