queue-4.14/kcm-switch-order-of-device-registration-to-fix-a-crash.patch

   1 From foo@baz Mon Apr 15 07:47:06 CEST 2019
   2 From: Jiri Slaby <jslaby@suse.cz>
   3 Date: Fri, 29 Mar 2019 12:19:46 +0100
   4 Subject: kcm: switch order of device registration to fix a crash
   5
   6 From: Jiri Slaby <jslaby@suse.cz>
   7
   8 [ Upstream commit 3c446e6f96997f2a95bf0037ef463802162d2323 ]
   9
  10 When kcm is loaded while many processes try to create a KCM socket, a
  11 crash occurs:
  12  BUG: unable to handle kernel NULL pointer dereference at 000000000000000e
  13  IP: mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
  14  PGD 8000000016ef2067 P4D 8000000016ef2067 PUD 3d6e9067 PMD 0
  15  Oops: 0002 [#1] SMP KASAN PTI
  16  CPU: 0 PID: 7005 Comm: syz-executor.5 Not tainted 4.12.14-396-default #1 SLE15-SP1 (unreleased)
  17  RIP: 0010:mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
  18  RSP: 0018:ffff88000d487a00 EFLAGS: 00010246
  19  RAX: 0000000000000000 RBX: 000000000000000e RCX: 1ffff100082b0719
  20  ...
  21  CR2: 000000000000000e CR3: 000000004b1bc003 CR4: 0000000000060ef0
  22  Call Trace:
  23   kcm_create+0x600/0xbf0 [kcm]
  24   __sock_create+0x324/0x750 net/socket.c:1272
  25  ...
  26
  27 This is due to race between sock_create and unfinished
  28 register_pernet_device. kcm_create tries to do "net_generic(net,
  29 kcm_net_id)". but kcm_net_id is not initialized yet.
  30
  31 So switch the order of the two to close the race.
  32
  33 This can be reproduced with mutiple processes doing socket(PF_KCM, ...)
  34 and one process doing module removal.
  35
  36 Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
  37 Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
  38 Signed-off-by: Jiri Slaby <jslaby@suse.cz>
  39 Signed-off-by: David S. Miller <davem@davemloft.net>
  40 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  41 ---
  42  net/kcm/kcmsock.c |   16 ++++++++--------
  43  1 file changed, 8 insertions(+), 8 deletions(-)
  44
  45 --- a/net/kcm/kcmsock.c
  46 +++ b/net/kcm/kcmsock.c
  47 @@ -2059,14 +2059,14 @@ static int __init kcm_init(void)
  48         if (err)
  49                 goto fail;
  50
  51 -       err = sock_register(&kcm_family_ops);
  52 -       if (err)
  53 -               goto sock_register_fail;
  54 -
  55         err = register_pernet_device(&kcm_net_ops);
  56         if (err)
  57                 goto net_ops_fail;
  58
  59 +       err = sock_register(&kcm_family_ops);
  60 +       if (err)
  61 +               goto sock_register_fail;
  62 +
  63         err = kcm_proc_init();
  64         if (err)
  65                 goto proc_init_fail;
  66 @@ -2074,12 +2074,12 @@ static int __init kcm_init(void)
  67         return 0;
  68
  69  proc_init_fail:
  70 -       unregister_pernet_device(&kcm_net_ops);
  71 -
  72 -net_ops_fail:
  73         sock_unregister(PF_KCM);
  74
  75  sock_register_fail:
  76 +       unregister_pernet_device(&kcm_net_ops);
  77 +
  78 +net_ops_fail:
  79         proto_unregister(&kcm_proto);
  80
  81  fail:
  82 @@ -2095,8 +2095,8 @@ fail:
  83  static void __exit kcm_exit(void)
  84  {
  85         kcm_proc_exit();
  86 -       unregister_pernet_device(&kcm_net_ops);
  87         sock_unregister(PF_KCM);
  88 +       unregister_pernet_device(&kcm_net_ops);
  89         proto_unregister(&kcm_proto);
  90         destroy_workqueue(kcm_wq);
  91