1 From foo@baz Mon Apr 15 09:15:08 CEST 2019
2 From: Jiri Slaby <jslaby@suse.cz>
3 Date: Fri, 29 Mar 2019 12:19:46 +0100
4 Subject: kcm: switch order of device registration to fix a crash
6 From: Jiri Slaby <jslaby@suse.cz>
8 [ Upstream commit 3c446e6f96997f2a95bf0037ef463802162d2323 ]
10 When kcm is loaded while many processes try to create a KCM socket, a
12 BUG: unable to handle kernel NULL pointer dereference at 000000000000000e
13 IP: mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
14 PGD 8000000016ef2067 P4D 8000000016ef2067 PUD 3d6e9067 PMD 0
15 Oops: 0002 [#1] SMP KASAN PTI
16 CPU: 0 PID: 7005 Comm: syz-executor.5 Not tainted 4.12.14-396-default #1 SLE15-SP1 (unreleased)
17 RIP: 0010:mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
18 RSP: 0018:ffff88000d487a00 EFLAGS: 00010246
19 RAX: 0000000000000000 RBX: 000000000000000e RCX: 1ffff100082b0719
21 CR2: 000000000000000e CR3: 000000004b1bc003 CR4: 0000000000060ef0
23 kcm_create+0x600/0xbf0 [kcm]
24 __sock_create+0x324/0x750 net/socket.c:1272
27 This is due to race between sock_create and unfinished
28 register_pernet_device. kcm_create tries to do "net_generic(net,
29 kcm_net_id)". but kcm_net_id is not initialized yet.
31 So switch the order of the two to close the race.
33 This can be reproduced with mutiple processes doing socket(PF_KCM, ...)
34 and one process doing module removal.
36 Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
37 Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
38 Signed-off-by: Jiri Slaby <jslaby@suse.cz>
39 Signed-off-by: David S. Miller <davem@davemloft.net>
40 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
42 net/kcm/kcmsock.c | 16 ++++++++--------
43 1 file changed, 8 insertions(+), 8 deletions(-)
45 --- a/net/kcm/kcmsock.c
46 +++ b/net/kcm/kcmsock.c
47 @@ -2058,14 +2058,14 @@ static int __init kcm_init(void)
51 - err = sock_register(&kcm_family_ops);
53 - goto sock_register_fail;
55 err = register_pernet_device(&kcm_net_ops);
59 + err = sock_register(&kcm_family_ops);
61 + goto sock_register_fail;
63 err = kcm_proc_init();
66 @@ -2073,12 +2073,12 @@ static int __init kcm_init(void)
70 - unregister_pernet_device(&kcm_net_ops);
73 sock_unregister(PF_KCM);
76 + unregister_pernet_device(&kcm_net_ops);
79 proto_unregister(&kcm_proto);
82 @@ -2094,8 +2094,8 @@ fail:
83 static void __exit kcm_exit(void)
86 - unregister_pernet_device(&kcm_net_ops);
87 sock_unregister(PF_KCM);
88 + unregister_pernet_device(&kcm_net_ops);
89 proto_unregister(&kcm_proto);
90 destroy_workqueue(kcm_wq);