* [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump()
@ 2024-11-11 16:17 Lee Jones
2024-11-11 16:33 ` Lee Jones
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Lee Jones @ 2024-11-11 16:17 UTC (permalink / raw)
To: lee; +Cc: stable, Dmitry Antipov, Vinicius Costa Gomes, Paolo Abeni,
Sasha Levin
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 ]
Fix possible use-after-free in 'taprio_dump()' by adding RCU
read-side critical section there. Never seen on x86 but
found on a KASAN-enabled arm64 system when investigating
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
[T15862]
[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
[T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
[T15862] Call trace:
[T15862] dump_backtrace+0x20c/0x220
[T15862] show_stack+0x2c/0x40
[T15862] dump_stack_lvl+0xf8/0x174
[T15862] print_report+0x170/0x4d8
[T15862] kasan_report+0xb8/0x1d4
[T15862] __asan_report_load4_noabort+0x20/0x2c
[T15862] taprio_dump+0xa0c/0xbb0
[T15862] tc_fill_qdisc+0x540/0x1020
[T15862] qdisc_notify.isra.0+0x330/0x3a0
[T15862] tc_modify_qdisc+0x7b8/0x1838
[T15862] rtnetlink_rcv_msg+0x3c8/0xc20
[T15862] netlink_rcv_skb+0x1f8/0x3d4
[T15862] rtnetlink_rcv+0x28/0x40
[T15862] netlink_unicast+0x51c/0x790
[T15862] netlink_sendmsg+0x79c/0xc20
[T15862] __sock_sendmsg+0xe0/0x1a0
[T15862] ____sys_sendmsg+0x6c0/0x840
[T15862] ___sys_sendmsg+0x1ac/0x1f0
[T15862] __sys_sendmsg+0x110/0x1d0
[T15862] __arm64_sys_sendmsg+0x74/0xb0
[T15862] invoke_syscall+0x88/0x2e0
[T15862] el0_svc_common.constprop.0+0xe4/0x2a0
[T15862] do_el0_svc+0x44/0x60
[T15862] el0_svc+0x50/0x184
[T15862] el0t_64_sync_handler+0x120/0x12c
[T15862] el0t_64_sync+0x190/0x194
[T15862]
[T15862] Allocated by task 15857:
[T15862] kasan_save_stack+0x3c/0x70
[T15862] kasan_save_track+0x20/0x3c
[T15862] kasan_save_alloc_info+0x40/0x60
[T15862] __kasan_kmalloc+0xd4/0xe0
[T15862] __kmalloc_cache_noprof+0x194/0x334
[T15862] taprio_change+0x45c/0x2fe0
[T15862] tc_modify_qdisc+0x6a8/0x1838
[T15862] rtnetlink_rcv_msg+0x3c8/0xc20
[T15862] netlink_rcv_skb+0x1f8/0x3d4
[T15862] rtnetlink_rcv+0x28/0x40
[T15862] netlink_unicast+0x51c/0x790
[T15862] netlink_sendmsg+0x79c/0xc20
[T15862] __sock_sendmsg+0xe0/0x1a0
[T15862] ____sys_sendmsg+0x6c0/0x840
[T15862] ___sys_sendmsg+0x1ac/0x1f0
[T15862] __sys_sendmsg+0x110/0x1d0
[T15862] __arm64_sys_sendmsg+0x74/0xb0
[T15862] invoke_syscall+0x88/0x2e0
[T15862] el0_svc_common.constprop.0+0xe4/0x2a0
[T15862] do_el0_svc+0x44/0x60
[T15862] el0_svc+0x50/0x184
[T15862] el0t_64_sync_handler+0x120/0x12c
[T15862] el0t_64_sync+0x190/0x194
[T15862]
[T15862] Freed by task 6192:
[T15862] kasan_save_stack+0x3c/0x70
[T15862] kasan_save_track+0x20/0x3c
[T15862] kasan_save_free_info+0x4c/0x80
[T15862] poison_slab_object+0x110/0x160
[T15862] __kasan_slab_free+0x3c/0x74
[T15862] kfree+0x134/0x3c0
[T15862] taprio_free_sched_cb+0x18c/0x220
[T15862] rcu_core+0x920/0x1b7c
[T15862] rcu_core_si+0x10/0x1c
[T15862] handle_softirqs+0x2e8/0xd64
[T15862] __do_softirq+0x14/0x20
Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 5d282467245f267c0b9ada3f7f309ff838521536)
[Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts]
Signed-off-by: Lee Jones <lee@kernel.org>
---
net/sched/sch_taprio.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 212fef2b72f5..1d5cdc987abd 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1995,9 +1995,6 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)
struct nlattr *nest, *sched_nest;
unsigned int i;
- oper = rtnl_dereference(q->oper_sched);
- admin = rtnl_dereference(q->admin_sched);
-
opt.num_tc = netdev_get_num_tc(dev);
memcpy(opt.prio_tc_map, dev->prio_tc_map, sizeof(opt.prio_tc_map));
@@ -2024,18 +2021,23 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)
nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay))
goto options_error;
+ rcu_read_lock();
+
+ oper = rtnl_dereference(q->oper_sched);
+ admin = rtnl_dereference(q->admin_sched);
+
if (taprio_dump_tc_entries(q, skb))
- goto options_error;
+ goto options_error_rcu;
if (oper && dump_schedule(skb, oper))
- goto options_error;
+ goto options_error_rcu;
if (!admin)
goto done;
sched_nest = nla_nest_start_noflag(skb, TCA_TAPRIO_ATTR_ADMIN_SCHED);
if (!sched_nest)
- goto options_error;
+ goto options_error_rcu;
if (dump_schedule(skb, admin))
goto admin_error;
@@ -2043,11 +2045,15 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)
nla_nest_end(skb, sched_nest);
done:
+ rcu_read_unlock();
return nla_nest_end(skb, nest);
admin_error:
nla_nest_cancel(skb, sched_nest);
+options_error_rcu:
+ rcu_read_unlock();
+
options_error:
nla_nest_cancel(skb, nest);
--
2.47.0.277.g8800431eea-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump()
2024-11-11 16:17 [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump() Lee Jones
@ 2024-11-11 16:33 ` Lee Jones
2024-11-11 19:39 ` Harshit Mogalapalli
2024-11-12 8:32 ` Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Lee Jones @ 2024-11-11 16:33 UTC (permalink / raw)
To: stable, Dmitry Antipov, Vinicius Costa Gomes, Paolo Abeni,
Sasha Levin
On Mon, 11 Nov 2024, Lee Jones wrote:
> From: Dmitry Antipov <dmantipov@yandex.ru>
>
> [ Upstream commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 ]
>
> Fix possible use-after-free in 'taprio_dump()' by adding RCU
> read-side critical section there. Never seen on x86 but
> found on a KASAN-enabled arm64 system when investigating
> https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
>
> [T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
> [T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
> [T15862]
> [T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
> [T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
> [T15862] Call trace:
> [T15862] dump_backtrace+0x20c/0x220
> [T15862] show_stack+0x2c/0x40
> [T15862] dump_stack_lvl+0xf8/0x174
> [T15862] print_report+0x170/0x4d8
> [T15862] kasan_report+0xb8/0x1d4
> [T15862] __asan_report_load4_noabort+0x20/0x2c
> [T15862] taprio_dump+0xa0c/0xbb0
> [T15862] tc_fill_qdisc+0x540/0x1020
> [T15862] qdisc_notify.isra.0+0x330/0x3a0
> [T15862] tc_modify_qdisc+0x7b8/0x1838
> [T15862] rtnetlink_rcv_msg+0x3c8/0xc20
> [T15862] netlink_rcv_skb+0x1f8/0x3d4
> [T15862] rtnetlink_rcv+0x28/0x40
> [T15862] netlink_unicast+0x51c/0x790
> [T15862] netlink_sendmsg+0x79c/0xc20
> [T15862] __sock_sendmsg+0xe0/0x1a0
> [T15862] ____sys_sendmsg+0x6c0/0x840
> [T15862] ___sys_sendmsg+0x1ac/0x1f0
> [T15862] __sys_sendmsg+0x110/0x1d0
> [T15862] __arm64_sys_sendmsg+0x74/0xb0
> [T15862] invoke_syscall+0x88/0x2e0
> [T15862] el0_svc_common.constprop.0+0xe4/0x2a0
> [T15862] do_el0_svc+0x44/0x60
> [T15862] el0_svc+0x50/0x184
> [T15862] el0t_64_sync_handler+0x120/0x12c
> [T15862] el0t_64_sync+0x190/0x194
> [T15862]
> [T15862] Allocated by task 15857:
> [T15862] kasan_save_stack+0x3c/0x70
> [T15862] kasan_save_track+0x20/0x3c
> [T15862] kasan_save_alloc_info+0x40/0x60
> [T15862] __kasan_kmalloc+0xd4/0xe0
> [T15862] __kmalloc_cache_noprof+0x194/0x334
> [T15862] taprio_change+0x45c/0x2fe0
> [T15862] tc_modify_qdisc+0x6a8/0x1838
> [T15862] rtnetlink_rcv_msg+0x3c8/0xc20
> [T15862] netlink_rcv_skb+0x1f8/0x3d4
> [T15862] rtnetlink_rcv+0x28/0x40
> [T15862] netlink_unicast+0x51c/0x790
> [T15862] netlink_sendmsg+0x79c/0xc20
> [T15862] __sock_sendmsg+0xe0/0x1a0
> [T15862] ____sys_sendmsg+0x6c0/0x840
> [T15862] ___sys_sendmsg+0x1ac/0x1f0
> [T15862] __sys_sendmsg+0x110/0x1d0
> [T15862] __arm64_sys_sendmsg+0x74/0xb0
> [T15862] invoke_syscall+0x88/0x2e0
> [T15862] el0_svc_common.constprop.0+0xe4/0x2a0
> [T15862] do_el0_svc+0x44/0x60
> [T15862] el0_svc+0x50/0x184
> [T15862] el0t_64_sync_handler+0x120/0x12c
> [T15862] el0t_64_sync+0x190/0x194
> [T15862]
> [T15862] Freed by task 6192:
> [T15862] kasan_save_stack+0x3c/0x70
> [T15862] kasan_save_track+0x20/0x3c
> [T15862] kasan_save_free_info+0x4c/0x80
> [T15862] poison_slab_object+0x110/0x160
> [T15862] __kasan_slab_free+0x3c/0x74
> [T15862] kfree+0x134/0x3c0
> [T15862] taprio_free_sched_cb+0x18c/0x220
> [T15862] rcu_core+0x920/0x1b7c
> [T15862] rcu_core_si+0x10/0x1c
> [T15862] handle_softirqs+0x2e8/0xd64
> [T15862] __do_softirq+0x14/0x20
>
> Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
> Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> (cherry picked from commit 5d282467245f267c0b9ada3f7f309ff838521536)
> [Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts]
> Signed-off-by: Lee Jones <lee@kernel.org>
This patch should have made it into linux-6.1.y but there were
merge-conflicts. I fixed them and this is the result.
--
Lee Jones [李琼斯]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump()
2024-11-11 16:17 [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump() Lee Jones
2024-11-11 16:33 ` Lee Jones
@ 2024-11-11 19:39 ` Harshit Mogalapalli
2024-11-12 8:32 ` Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Harshit Mogalapalli @ 2024-11-11 19:39 UTC (permalink / raw)
To: Lee Jones
Cc: stable, Dmitry Antipov, Vinicius Costa Gomes, Paolo Abeni,
Sasha Levin, Vegard Nossum
Hi Lee,
On 11/11/24 21:47, Lee Jones wrote:
> From: Dmitry Antipov <dmantipov@yandex.ru>
>
> [ Upstream commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 ]
>
> Fix possible use-after-free in 'taprio_dump()' by adding RCU
> read-side critical section there. Never seen on x86 but
> found on a KASAN-enabled arm64 system when investigating
> https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
<snip>
>
> Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
> Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> (cherry picked from commit 5d282467245f267c0b9ada3f7f309ff838521536)
> [Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts]
Conflict resolution for the backport to 6.1.y looks good to me.
[ I am not a net/ developer, but reviewed it from a backporting point of
view]
Thanks,
Harshit
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump()
2024-11-11 16:17 [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump() Lee Jones
2024-11-11 16:33 ` Lee Jones
2024-11-11 19:39 ` Harshit Mogalapalli
@ 2024-11-12 8:32 ` Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2024-11-12 8:32 UTC (permalink / raw)
To: Lee Jones
Cc: stable, Dmitry Antipov, Vinicius Costa Gomes, Paolo Abeni,
Sasha Levin
On Mon, Nov 11, 2024 at 04:17:01PM +0000, Lee Jones wrote:
> From: Dmitry Antipov <dmantipov@yandex.ru>
>
> [ Upstream commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 ]
>
> Fix possible use-after-free in 'taprio_dump()' by adding RCU
> read-side critical section there. Never seen on x86 but
> found on a KASAN-enabled arm64 system when investigating
> https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
>
> [T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
> [T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
> [T15862]
> [T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
> [T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
> [T15862] Call trace:
> [T15862] dump_backtrace+0x20c/0x220
> [T15862] show_stack+0x2c/0x40
> [T15862] dump_stack_lvl+0xf8/0x174
> [T15862] print_report+0x170/0x4d8
> [T15862] kasan_report+0xb8/0x1d4
> [T15862] __asan_report_load4_noabort+0x20/0x2c
> [T15862] taprio_dump+0xa0c/0xbb0
> [T15862] tc_fill_qdisc+0x540/0x1020
> [T15862] qdisc_notify.isra.0+0x330/0x3a0
> [T15862] tc_modify_qdisc+0x7b8/0x1838
> [T15862] rtnetlink_rcv_msg+0x3c8/0xc20
> [T15862] netlink_rcv_skb+0x1f8/0x3d4
> [T15862] rtnetlink_rcv+0x28/0x40
> [T15862] netlink_unicast+0x51c/0x790
> [T15862] netlink_sendmsg+0x79c/0xc20
> [T15862] __sock_sendmsg+0xe0/0x1a0
> [T15862] ____sys_sendmsg+0x6c0/0x840
> [T15862] ___sys_sendmsg+0x1ac/0x1f0
> [T15862] __sys_sendmsg+0x110/0x1d0
> [T15862] __arm64_sys_sendmsg+0x74/0xb0
> [T15862] invoke_syscall+0x88/0x2e0
> [T15862] el0_svc_common.constprop.0+0xe4/0x2a0
> [T15862] do_el0_svc+0x44/0x60
> [T15862] el0_svc+0x50/0x184
> [T15862] el0t_64_sync_handler+0x120/0x12c
> [T15862] el0t_64_sync+0x190/0x194
> [T15862]
> [T15862] Allocated by task 15857:
> [T15862] kasan_save_stack+0x3c/0x70
> [T15862] kasan_save_track+0x20/0x3c
> [T15862] kasan_save_alloc_info+0x40/0x60
> [T15862] __kasan_kmalloc+0xd4/0xe0
> [T15862] __kmalloc_cache_noprof+0x194/0x334
> [T15862] taprio_change+0x45c/0x2fe0
> [T15862] tc_modify_qdisc+0x6a8/0x1838
> [T15862] rtnetlink_rcv_msg+0x3c8/0xc20
> [T15862] netlink_rcv_skb+0x1f8/0x3d4
> [T15862] rtnetlink_rcv+0x28/0x40
> [T15862] netlink_unicast+0x51c/0x790
> [T15862] netlink_sendmsg+0x79c/0xc20
> [T15862] __sock_sendmsg+0xe0/0x1a0
> [T15862] ____sys_sendmsg+0x6c0/0x840
> [T15862] ___sys_sendmsg+0x1ac/0x1f0
> [T15862] __sys_sendmsg+0x110/0x1d0
> [T15862] __arm64_sys_sendmsg+0x74/0xb0
> [T15862] invoke_syscall+0x88/0x2e0
> [T15862] el0_svc_common.constprop.0+0xe4/0x2a0
> [T15862] do_el0_svc+0x44/0x60
> [T15862] el0_svc+0x50/0x184
> [T15862] el0t_64_sync_handler+0x120/0x12c
> [T15862] el0t_64_sync+0x190/0x194
> [T15862]
> [T15862] Freed by task 6192:
> [T15862] kasan_save_stack+0x3c/0x70
> [T15862] kasan_save_track+0x20/0x3c
> [T15862] kasan_save_free_info+0x4c/0x80
> [T15862] poison_slab_object+0x110/0x160
> [T15862] __kasan_slab_free+0x3c/0x74
> [T15862] kfree+0x134/0x3c0
> [T15862] taprio_free_sched_cb+0x18c/0x220
> [T15862] rcu_core+0x920/0x1b7c
> [T15862] rcu_core_si+0x10/0x1c
> [T15862] handle_softirqs+0x2e8/0xd64
> [T15862] __do_softirq+0x14/0x20
>
> Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
> Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> (cherry picked from commit 5d282467245f267c0b9ada3f7f309ff838521536)
> [Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts]
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
> net/sched/sch_taprio.c | 18 ++++++++++++------
> 1 file changed, 12 insertions(+), 6 deletions(-)
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-11-12 8:32 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-11 16:17 [PATCH v6.1 1/1] net: sched: use RCU read-side critical section in taprio_dump() Lee Jones
2024-11-11 16:33 ` Lee Jones
2024-11-11 19:39 ` Harshit Mogalapalli
2024-11-12 8:32 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox