sctp: cache netns in sctp_ep_common

[ Upstream commit 312434617cb16be5166316cf9d08ba760b1042a1 ]

This patch is to fix a data-race reported by syzbot:

  BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj

  write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1:
    sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091
    sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465
    sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916
    inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734
    __sys_accept4+0x224/0x430 net/socket.c:1754
    __do_sys_accept net/socket.c:1795 [inline]
    __se_sys_accept net/socket.c:1792 [inline]
    __x64_sys_accept+0x4e/0x60 net/socket.c:1792
    do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

  read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0:
    sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894
    rht_key_get_hash include/linux/rhashtable.h:133 [inline]
    rht_key_hashfn include/linux/rhashtable.h:159 [inline]
    rht_head_hashfn include/linux/rhashtable.h:174 [inline]
    head_hashfn lib/rhashtable.c:41 [inline]
    rhashtable_rehash_one lib/rhashtable.c:245 [inline]
    rhashtable_rehash_chain lib/rhashtable.c:276 [inline]
    rhashtable_rehash_table lib/rhashtable.c:316 [inline]
    rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420
    process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
    worker_thread+0xa0/0x800 kernel/workqueue.c:2415
    kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate
is changing its value. However, what rhashtable wants is netns from asoc
base.sk, and for an asoc, its netns won't change once set. So we can
simply fix it by caching netns since created.

Fixes: d6c0256a60e6 ("sctp: add the rhashtable apis for sctp global transport hashtable")
Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 94c775773f58c95156c6986e306b55b3e4862307..c1f71dd464d3b2bb4a6859d0c39c05c14951b603 100644 (file)
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1181,6 +1181,9 @@ struct sctp_ep_common {
        /* What socket does this endpoint belong to?  */
        struct sock *sk;
 
+       /* Cache netns and it won't change once set */
+       struct net *net;
+
        /* This is where we receive inbound chunks.  */
        struct sctp_inq   inqueue;
 

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 23fec3817e0cc13e78476452bcdd266c67572b08..dd1a3bd80be5f0ed5036ac28db238f082f4e0637 100644 (file)
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -80,6 +80,7 @@ static struct sctp_association *sctp_association_init(
        /* Discarding const is appropriate here.  */
        asoc->ep = (struct sctp_endpoint *)ep;
        asoc->base.sk = (struct sock *)sk;
+       asoc->base.net = sock_net(sk);
 
        sctp_endpoint_hold(asoc->ep);
        sock_hold(asoc->base.sk);

diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 5d4079ef3de67da362d90686201fd9fc6b969c34..c71b4191df1e7dfd9753dbbae8e2510e72d815d5 100644 (file)
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -165,6 +165,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
 
        /* Remember who we are attached to.  */
        ep->base.sk = sk;
+       ep->base.net = sock_net(sk);
        sock_hold(ep->base.sk);
 
        return ep;

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0247cc432e0293f2881a594367e79c666e9b9f4d..3c0affecf2726085ce7d5bdd8e75f81c153f75b1 100644 (file)
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -813,7 +813,7 @@ static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
        if (!sctp_transport_hold(t))
                return err;
 
-       if (!net_eq(sock_net(t->asoc->base.sk), x->net))
+       if (!net_eq(t->asoc->base.net, x->net))
                goto out;
        if (x->lport != htons(t->asoc->base.bind_addr.port))
                goto out;
@@ -828,7 +828,7 @@ static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
 {
        const struct sctp_transport *t = data;
        const union sctp_addr *paddr = &t->ipaddr;
-       const struct net *net = sock_net(t->asoc->base.sk);
+       const struct net *net = t->asoc->base.net;
        __be16 lport = htons(t->asoc->base.bind_addr.port);
        __u32 addr;