--- /dev/null
+From 073d89808c065ac4c672c0a613a71b27a80691cb Mon Sep 17 00:00:00 2001
+From: Wang Liang <wangliang74@huawei.com>
+Date: Thu, 7 Nov 2024 10:34:05 +0800
+Subject: net: fix data-races around sk->sk_forward_alloc
+
+From: Wang Liang <wangliang74@huawei.com>
+
+commit 073d89808c065ac4c672c0a613a71b27a80691cb upstream.
+
+Syzkaller reported this warning:
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+ RIP: 0010:inet_sock_destruct+0x1c5/0x1e0
+ Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00
+ RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206
+ RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007
+ RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00
+ RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007
+ R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00
+ R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78
+ FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ ? __warn+0x88/0x130
+ ? inet_sock_destruct+0x1c5/0x1e0
+ ? report_bug+0x18e/0x1a0
+ ? handle_bug+0x53/0x90
+ ? exc_invalid_op+0x18/0x70
+ ? asm_exc_invalid_op+0x1a/0x20
+ ? inet_sock_destruct+0x1c5/0x1e0
+ __sk_destruct+0x2a/0x200
+ rcu_do_batch+0x1aa/0x530
+ ? rcu_do_batch+0x13b/0x530
+ rcu_core+0x159/0x2f0
+ handle_softirqs+0xd3/0x2b0
+ ? __pfx_smpboot_thread_fn+0x10/0x10
+ run_ksoftirqd+0x25/0x30
+ smpboot_thread_fn+0xdd/0x1d0
+ kthread+0xd3/0x100
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x34/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+ ---[ end trace 0000000000000000 ]---
+
+Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add()
+concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked,
+which triggers a data-race around sk->sk_forward_alloc:
+tcp_v6_rcv
+ tcp_v6_do_rcv
+ skb_clone_and_charge_r
+ sk_rmem_schedule
+ __sk_mem_schedule
+ sk_forward_alloc_add()
+ skb_set_owner_r
+ sk_mem_charge
+ sk_forward_alloc_add()
+ __kfree_skb
+ skb_release_all
+ skb_release_head_state
+ sock_rfree
+ sk_mem_uncharge
+ sk_forward_alloc_add()
+ sk_mem_reclaim
+ // set local var reclaimable
+ __sk_mem_reclaim
+ sk_forward_alloc_add()
+
+In this syzkaller testcase, two threads call
+tcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like
+this:
+ (cpu 1) | (cpu 2) | sk_forward_alloc
+ ... | ... | 0
+ __sk_mem_schedule() | | +4096 = 4096
+ | __sk_mem_schedule() | +4096 = 8192
+ sk_mem_charge() | | -768 = 7424
+ | sk_mem_charge() | -768 = 6656
+ ... | ... |
+ sk_mem_uncharge() | | +768 = 7424
+ reclaimable=7424 | |
+ | sk_mem_uncharge() | +768 = 8192
+ | reclaimable=8192 |
+ __sk_mem_reclaim() | | -4096 = 4096
+ | __sk_mem_reclaim() | -8192 = -4096 != 0
+
+The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when
+sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock().
+Fix the same issue in dccp_v6_do_rcv().
+
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Link: https://patch.msgid.link/20241107023405.889239-1-wangliang74@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Alva Lan <alvalan9@foxmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dccp/ipv6.c | 2 +-
+ net/ipv6/tcp_ipv6.c | 4 +---
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -602,7 +602,7 @@ static int dccp_v6_do_rcv(struct sock *s
+ by tcp. Feel free to propose better solution.
+ --ANK (980728)
+ */
+- if (np->rxopt.all)
++ if (np->rxopt.all && sk->sk_state != DCCP_LISTEN)
+ opt_skb = skb_clone_and_charge_r(skb, sk);
+
+ if (sk->sk_state == DCCP_OPEN) { /* Fast path */
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1484,7 +1484,7 @@ static int tcp_v6_do_rcv(struct sock *sk
+ by tcp. Feel free to propose better solution.
+ --ANK (980728)
+ */
+- if (np->rxopt.all)
++ if (np->rxopt.all && sk->sk_state != TCP_LISTEN)
+ opt_skb = skb_clone_and_charge_r(skb, sk);
+
+ if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+@@ -1521,8 +1521,6 @@ static int tcp_v6_do_rcv(struct sock *sk
+ if (nsk != sk) {
+ if (tcp_child_process(sk, nsk, skb))
+ goto reset;
+- if (opt_skb)
+- __kfree_skb(opt_skb);
+ return 0;
+ }
+ } else
--- /dev/null
+From f10593ad9bc36921f623361c9e3dd96bd52d85ee Mon Sep 17 00:00:00 2001
+From: Suraj Sonawane <surajsonawane0215@gmail.com>
+Date: Wed, 20 Nov 2024 18:29:44 +0530
+Subject: scsi: sg: Fix slab-use-after-free read in sg_release()
+
+From: Suraj Sonawane <surajsonawane0215@gmail.com>
+
+commit f10593ad9bc36921f623361c9e3dd96bd52d85ee upstream.
+
+Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
+
+BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30
+kernel/locking/lockdep.c:5838
+__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912
+sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407
+
+In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is
+called before releasing the open_rel_lock mutex. The kref_put() call may
+decrement the reference count of sfp to zero, triggering its cleanup
+through sg_remove_sfp(). This cleanup includes scheduling deferred work
+via sg_remove_sfp_usercontext(), which ultimately frees sfp.
+
+After kref_put(), sg_release() continues to unlock open_rel_lock and may
+reference sfp or sdp. If sfp has already been freed, this results in a
+slab-use-after-free error.
+
+Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the
+open_rel_lock mutex. This ensures:
+
+ - No references to sfp or sdp occur after the reference count is
+ decremented.
+
+ - Cleanup functions such as sg_remove_sfp() and
+ sg_remove_sfp_usercontext() can safely execute without impacting the
+ mutex handling in sg_release().
+
+The fix has been tested and validated by syzbot. This patch closes the
+bug reported at the following syzkaller link and ensures proper
+sequencing of resource cleanup and mutex operations, eliminating the
+risk of use-after-free errors in sg_release().
+
+Reported-by: syzbot+7efb5850a17ba6ce098b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=7efb5850a17ba6ce098b
+Tested-by: syzbot+7efb5850a17ba6ce098b@syzkaller.appspotmail.com
+Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling")
+Signed-off-by: Suraj Sonawane <surajsonawane0215@gmail.com>
+Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: BRUNO VERNAY <bruno.vernay@se.com>
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -390,7 +390,6 @@ sg_release(struct inode *inode, struct f
+
+ mutex_lock(&sdp->open_rel_lock);
+ scsi_autopm_put_device(sdp->device);
+- kref_put(&sfp->f_ref, sg_remove_sfp);
+ sdp->open_cnt--;
+
+ /* possibly many open()s waiting on exlude clearing, start many;
+@@ -402,6 +401,7 @@ sg_release(struct inode *inode, struct f
+ wake_up_interruptible(&sdp->open_wait);
+ }
+ mutex_unlock(&sdp->open_rel_lock);
++ kref_put(&sfp->f_ref, sg_remove_sfp);
+ return 0;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
