4.20-stable patches

added patches:
	bpf-stop-the-psock-parser-before-canceling-its-work.patch
	sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch

diff --git a/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch b/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch
new file mode 100644 (file)
index 0000000..c9c11c3
--- /dev/null
+++ b/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch
@@ -0,0 +1,63 @@
+From e8e3437762ad938880dd48a3c52d702e7cf3c124 Mon Sep 17 00:00:00 2001
+From: Jakub Sitnicki <jakub@cloudflare.com>
+Date: Thu, 7 Mar 2019 11:35:43 +0100
+Subject: bpf: Stop the psock parser before canceling its work
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+commit e8e3437762ad938880dd48a3c52d702e7cf3c124 upstream.
+
+We might have never enabled (started) the psock's parser, in which case it
+will not get stopped when destroying the psock. This leads to a warning
+when trying to cancel parser's work from psock's deferred destructor:
+
+[  405.325769] WARNING: CPU: 1 PID: 3216 at net/strparser/strparser.c:526 strp_done+0x3c/0x40
+[  405.326712] Modules linked in: [last unloaded: test_bpf]
+[  405.327359] CPU: 1 PID: 3216 Comm: kworker/1:164 Tainted: G        W         5.0.0 #42
+[  405.328294] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180531_142017-buildhw-08.phx2.fedoraproject.org-1.fc28 04/01/2014
+[  405.329712] Workqueue: events sk_psock_destroy_deferred
+[  405.330254] RIP: 0010:strp_done+0x3c/0x40
+[  405.330706] Code: 28 e8 b8 d5 6b ff 48 8d bb 80 00 00 00 e8 9c d5 6b ff 48 8b 7b 18 48 85 ff 74 0d e8 1e a5 e8 ff 48 c7 43 18 00 00 00 00 5b c3 <0f> 0b eb cf 66 66 66 66 90 55 89 f5 53 48 89 fb 48 83 c7 28 e8 0b
+[  405.332862] RSP: 0018:ffffc900026bbe50 EFLAGS: 00010246
+[  405.333482] RAX: ffffffff819323e0 RBX: ffff88812cb83640 RCX: ffff88812cb829e8
+[  405.334228] RDX: 0000000000000001 RSI: ffff88812cb837e8 RDI: ffff88812cb83640
+[  405.335366] RBP: ffff88813fd22680 R08: 0000000000000000 R09: 000073746e657665
+[  405.336472] R10: 8080808080808080 R11: 0000000000000001 R12: ffff88812cb83600
+[  405.337760] R13: 0000000000000000 R14: ffff88811f401780 R15: ffff88812cb837e8
+[  405.338777] FS:  0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000
+[  405.339903] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  405.340821] CR2: 00007fb11489a6b8 CR3: 000000012d4d6000 CR4: 00000000000406e0
+[  405.341981] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  405.343131] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  405.344415] Call Trace:
+[  405.344821]  sk_psock_destroy_deferred+0x23/0x1b0
+[  405.345585]  process_one_work+0x1ae/0x3e0
+[  405.346110]  worker_thread+0x3c/0x3b0
+[  405.346576]  ? pwq_unbound_release_workfn+0xd0/0xd0
+[  405.347187]  kthread+0x11d/0x140
+[  405.347601]  ? __kthread_parkme+0x80/0x80
+[  405.348108]  ret_from_fork+0x35/0x40
+[  405.348566] ---[ end trace a4a3af4026a327d4 ]---
+
+Stop psock's parser just before canceling its work.
+
+Fixes: 1d79895aef18 ("sk_msg: Always cancel strp work before freeing the psock")
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/skmsg.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -545,6 +545,7 @@ static void sk_psock_destroy_deferred(st
+       struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
+ 
+       /* No sk_callback_lock since already detached. */
++      strp_stop(&psock->parser.strp);
+       strp_done(&psock->parser.strp);
+ 
+       cancel_work_sync(&psock->work);

diff --git a/queue-4.20/series b/queue-4.20/series
index fce752dee0c4c94db239d66cbb02009644b45b6f..c1749a08c9b6dfbbc794e0864ac298879b3b43ca 100644 (file)
--- a/queue-4.20/series
+++ b/queue-4.20/series
@@ -160,3 +160,5 @@ arm-dts-exynos-fix-max-voltage-for-buck8-regulator-on-odroid-xu3-xu4.patch
 drm-disable-uncached-dma-optimization-for-arm-and-ar.patch
 media-revert-media-rc-some-events-are-dropped-by-userspace.patch
 revert-pci-pme-implement-runtime-pm-callbacks.patch
+sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch
+bpf-stop-the-psock-parser-before-canceling-its-work.patch

diff --git a/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch b/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch
new file mode 100644 (file)
index 0000000..ddb5915
--- /dev/null
+++ b/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch
@@ -0,0 +1,95 @@
+From 1d79895aef18fa05789995d86d523c9b2ee58a02 Mon Sep 17 00:00:00 2001
+From: Jakub Sitnicki <jakub@cloudflare.com>
+Date: Mon, 28 Jan 2019 10:13:35 +0100
+Subject: sk_msg: Always cancel strp work before freeing the psock
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+commit 1d79895aef18fa05789995d86d523c9b2ee58a02 upstream.
+
+Despite having stopped the parser, we still need to deinitialize it
+by calling strp_done so that it cancels its work. Otherwise the worker
+thread can run after we have freed the parser, and attempt to access
+its workqueue resulting in a use-after-free:
+
+==================================================================
+BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0
+Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93
+
+CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
+Workqueue:            (null) (kstrp)
+Call Trace:
+ print_address_description+0x6e/0x2b0
+ ? pwq_activate_delayed_work+0x1b/0x1d0
+ kasan_report+0xfd/0x177
+ ? pwq_activate_delayed_work+0x1b/0x1d0
+ ? pwq_activate_delayed_work+0x1b/0x1d0
+ pwq_activate_delayed_work+0x1b/0x1d0
+ ? process_one_work+0x4aa/0x660
+ pwq_dec_nr_in_flight+0x9b/0x100
+ worker_thread+0x82/0x680
+ ? process_one_work+0x660/0x660
+ kthread+0x1b9/0x1e0
+ ? __kthread_create_on_node+0x250/0x250
+ ret_from_fork+0x1f/0x30
+
+Allocated by task 111:
+ sk_psock_init+0x3c/0x1b0
+ sock_map_link.isra.2+0x103/0x4b0
+ sock_map_update_common+0x94/0x270
+ sock_map_update_elem+0x145/0x160
+ __se_sys_bpf+0x152e/0x1e10
+ do_syscall_64+0xb2/0x3e0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Freed by task 112:
+ kfree+0x7f/0x140
+ process_one_work+0x40b/0x660
+ worker_thread+0x82/0x680
+ kthread+0x1b9/0x1e0
+ ret_from_fork+0x1f/0x30
+
+The buggy address belongs to the object at ffff888069975180
+ which belongs to the cache kmalloc-512 of size 512
+The buggy address is located 192 bytes inside of
+ 512-byte region [ffff888069975180, ffff888069975380)
+The buggy address belongs to the page:
+page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0
+flags: 0x4000000000010200(slab|head)
+raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280
+raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+                                           ^
+ ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+Reported-by: Marek Majkowski <marek@cloudflare.com>
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/skmsg.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(st
+       struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
+ 
+       /* No sk_callback_lock since already detached. */
+-      if (psock->parser.enabled)
+-              strp_done(&psock->parser.strp);
++      strp_done(&psock->parser.strp);
+ 
+       cancel_work_sync(&psock->work);
+