From: Greg Kroah-Hartman Date: Tue, 12 Mar 2019 12:21:36 +0000 (-0700) Subject: 4.20-stable patches X-Git-Tag: v5.0.2~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e5aa63aeea7697affff0f80dd7014306a268aaa8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.20-stable patches added patches: bpf-stop-the-psock-parser-before-canceling-its-work.patch sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch --- diff --git a/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch b/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch new file mode 100644 index 00000000000..c9c11c3f306 --- /dev/null +++ b/queue-4.20/bpf-stop-the-psock-parser-before-canceling-its-work.patch @@ -0,0 +1,63 @@ +From e8e3437762ad938880dd48a3c52d702e7cf3c124 Mon Sep 17 00:00:00 2001 +From: Jakub Sitnicki +Date: Thu, 7 Mar 2019 11:35:43 +0100 +Subject: bpf: Stop the psock parser before canceling its work + +From: Jakub Sitnicki + +commit e8e3437762ad938880dd48a3c52d702e7cf3c124 upstream. + +We might have never enabled (started) the psock's parser, in which case it +will not get stopped when destroying the psock. This leads to a warning +when trying to cancel parser's work from psock's deferred destructor: + +[ 405.325769] WARNING: CPU: 1 PID: 3216 at net/strparser/strparser.c:526 strp_done+0x3c/0x40 +[ 405.326712] Modules linked in: [last unloaded: test_bpf] +[ 405.327359] CPU: 1 PID: 3216 Comm: kworker/1:164 Tainted: G W 5.0.0 #42 +[ 405.328294] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180531_142017-buildhw-08.phx2.fedoraproject.org-1.fc28 04/01/2014 +[ 405.329712] Workqueue: events sk_psock_destroy_deferred +[ 405.330254] RIP: 0010:strp_done+0x3c/0x40 +[ 405.330706] Code: 28 e8 b8 d5 6b ff 48 8d bb 80 00 00 00 e8 9c d5 6b ff 48 8b 7b 18 48 85 ff 74 0d e8 1e a5 e8 ff 48 c7 43 18 00 00 00 00 5b c3 <0f> 0b eb cf 66 66 66 66 90 55 89 f5 53 48 89 fb 48 83 c7 28 e8 0b +[ 405.332862] RSP: 0018:ffffc900026bbe50 EFLAGS: 00010246 +[ 405.333482] RAX: ffffffff819323e0 RBX: ffff88812cb83640 RCX: ffff88812cb829e8 +[ 405.334228] RDX: 0000000000000001 RSI: ffff88812cb837e8 RDI: ffff88812cb83640 +[ 405.335366] RBP: ffff88813fd22680 R08: 0000000000000000 R09: 000073746e657665 +[ 405.336472] R10: 8080808080808080 R11: 0000000000000001 R12: ffff88812cb83600 +[ 405.337760] R13: 0000000000000000 R14: ffff88811f401780 R15: ffff88812cb837e8 +[ 405.338777] FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 +[ 405.339903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 405.340821] CR2: 00007fb11489a6b8 CR3: 000000012d4d6000 CR4: 00000000000406e0 +[ 405.341981] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 405.343131] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 405.344415] Call Trace: +[ 405.344821] sk_psock_destroy_deferred+0x23/0x1b0 +[ 405.345585] process_one_work+0x1ae/0x3e0 +[ 405.346110] worker_thread+0x3c/0x3b0 +[ 405.346576] ? pwq_unbound_release_workfn+0xd0/0xd0 +[ 405.347187] kthread+0x11d/0x140 +[ 405.347601] ? __kthread_parkme+0x80/0x80 +[ 405.348108] ret_from_fork+0x35/0x40 +[ 405.348566] ---[ end trace a4a3af4026a327d4 ]--- + +Stop psock's parser just before canceling its work. + +Fixes: 1d79895aef18 ("sk_msg: Always cancel strp work before freeing the psock") +Reported-by: kernel test robot +Signed-off-by: Jakub Sitnicki +Signed-off-by: Daniel Borkmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skmsg.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -545,6 +545,7 @@ static void sk_psock_destroy_deferred(st + struct sk_psock *psock = container_of(gc, struct sk_psock, gc); + + /* No sk_callback_lock since already detached. */ ++ strp_stop(&psock->parser.strp); + strp_done(&psock->parser.strp); + + cancel_work_sync(&psock->work); diff --git a/queue-4.20/series b/queue-4.20/series index fce752dee0c..c1749a08c9b 100644 --- a/queue-4.20/series +++ b/queue-4.20/series @@ -160,3 +160,5 @@ arm-dts-exynos-fix-max-voltage-for-buck8-regulator-on-odroid-xu3-xu4.patch drm-disable-uncached-dma-optimization-for-arm-and-ar.patch media-revert-media-rc-some-events-are-dropped-by-userspace.patch revert-pci-pme-implement-runtime-pm-callbacks.patch +sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch +bpf-stop-the-psock-parser-before-canceling-its-work.patch diff --git a/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch b/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch new file mode 100644 index 00000000000..ddb5915b1df --- /dev/null +++ b/queue-4.20/sk_msg-always-cancel-strp-work-before-freeing-the-psock.patch @@ -0,0 +1,95 @@ +From 1d79895aef18fa05789995d86d523c9b2ee58a02 Mon Sep 17 00:00:00 2001 +From: Jakub Sitnicki +Date: Mon, 28 Jan 2019 10:13:35 +0100 +Subject: sk_msg: Always cancel strp work before freeing the psock + +From: Jakub Sitnicki + +commit 1d79895aef18fa05789995d86d523c9b2ee58a02 upstream. + +Despite having stopped the parser, we still need to deinitialize it +by calling strp_done so that it cancels its work. Otherwise the worker +thread can run after we have freed the parser, and attempt to access +its workqueue resulting in a use-after-free: + +================================================================== +BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0 +Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93 + +CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 +Workqueue: (null) (kstrp) +Call Trace: + print_address_description+0x6e/0x2b0 + ? pwq_activate_delayed_work+0x1b/0x1d0 + kasan_report+0xfd/0x177 + ? pwq_activate_delayed_work+0x1b/0x1d0 + ? pwq_activate_delayed_work+0x1b/0x1d0 + pwq_activate_delayed_work+0x1b/0x1d0 + ? process_one_work+0x4aa/0x660 + pwq_dec_nr_in_flight+0x9b/0x100 + worker_thread+0x82/0x680 + ? process_one_work+0x660/0x660 + kthread+0x1b9/0x1e0 + ? __kthread_create_on_node+0x250/0x250 + ret_from_fork+0x1f/0x30 + +Allocated by task 111: + sk_psock_init+0x3c/0x1b0 + sock_map_link.isra.2+0x103/0x4b0 + sock_map_update_common+0x94/0x270 + sock_map_update_elem+0x145/0x160 + __se_sys_bpf+0x152e/0x1e10 + do_syscall_64+0xb2/0x3e0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 112: + kfree+0x7f/0x140 + process_one_work+0x40b/0x660 + worker_thread+0x82/0x680 + kthread+0x1b9/0x1e0 + ret_from_fork+0x1f/0x30 + +The buggy address belongs to the object at ffff888069975180 + which belongs to the cache kmalloc-512 of size 512 +The buggy address is located 192 bytes inside of + 512-byte region [ffff888069975180, ffff888069975380) +The buggy address belongs to the page: +page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0 +flags: 0x4000000000010200(slab|head) +raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280 +raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +================================================================== + +Reported-by: Marek Majkowski +Signed-off-by: Jakub Sitnicki +Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com +Acked-by: Song Liu +Signed-off-by: Daniel Borkmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skmsg.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(st + struct sk_psock *psock = container_of(gc, struct sk_psock, gc); + + /* No sk_callback_lock since already detached. */ +- if (psock->parser.enabled) +- strp_done(&psock->parser.strp); ++ strp_done(&psock->parser.strp); + + cancel_work_sync(&psock->work); +