From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8787EFA3741 for ; Wed, 26 Oct 2022 13:39:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233318AbiJZNjK (ORCPT ); Wed, 26 Oct 2022 09:39:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56268 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233546AbiJZNjH (ORCPT ); Wed, 26 Oct 2022 09:39:07 -0400 Received: from us-smtp-delivery-44.mimecast.com (us-smtp-delivery-44.mimecast.com [205.139.111.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 02383BBF25 for ; Wed, 26 Oct 2022 06:39:05 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-8-3mY7VsqLMXexof_X3L_guA-1; Wed, 26 Oct 2022 09:39:02 -0400 X-MC-Unique: 3mY7VsqLMXexof_X3L_guA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 71E1738107B8; Wed, 26 Oct 2022 13:39:00 +0000 (UTC) Received: from hog (unknown [10.39.192.185]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4630C4022C2; Wed, 26 Oct 2022 13:38:57 +0000 (UTC) Date: Wed, 26 Oct 2022 15:38:23 +0200 From: Sabrina Dubroca To: Herbert Xu Cc: Eric Dumazet , syzbot , davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, steffen.klassert@secunet.com, syzkaller-bugs@googlegroups.com Subject: Re: [v3 PATCH] af_key: Fix send_acquire race with pfkey_register Message-ID: References: <000000000000fd9a4005ebbeac67@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org 2022-10-25, 14:06:48 +0800, Herbert Xu wrote: > On Mon, Oct 24, 2022 at 09:20:00AM +0200, Sabrina Dubroca wrote: > > 2022-10-24, 14:06:12 +0800, Herbert Xu wrote: > > > @@ -1697,11 +1699,11 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad > > > pfk->registered |= (1<sadb_msg_satype); > > > } > > > > > > - mutex_lock(&pfkey_mutex); > > > + spin_lock_bh(&pfkey_alg_lock); > > > xfrm_probe_algs(); > > > > I don't think we can do that: > > > > void xfrm_probe_algs(void) > > { > > int i, status; > > > > BUG_ON(in_softirq()); > > Indeed. I was also wrong in stating that this bug was created by > namespaces. This race has always existed since this code was first > added. > > ---8<--- > The function pfkey_send_acquire may race with pfkey_register > (which could even be in a different name space). This may result > in a buffer overrun. > > Allocating the maximum amount of memory that could be used prevents > this. > > Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Herbert Xu LGTM, thanks. Reviewed-by: Sabrina Dubroca -- Sabrina