From 5ee777cc48aa4529095c5b7581a4f29987443e79 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 23 Nov 2022 08:56:15 +0100 Subject: [PATCH] 4.9-stable patches added patches: kcm-avoid-potential-race-in-kcm_tx_work.patch tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch --- ...-avoid-potential-race-in-kcm_tx_work.patch | 72 ++++++++ queue-4.9/series | 2 + ..._release-to-be-called-multiple-times.patch | 155 ++++++++++++++++++ 3 files changed, 229 insertions(+) create mode 100644 queue-4.9/kcm-avoid-potential-race-in-kcm_tx_work.patch create mode 100644 queue-4.9/tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch diff --git a/queue-4.9/kcm-avoid-potential-race-in-kcm_tx_work.patch b/queue-4.9/kcm-avoid-potential-race-in-kcm_tx_work.patch new file mode 100644 index 00000000000..c9981bbcf87 --- /dev/null +++ b/queue-4.9/kcm-avoid-potential-race-in-kcm_tx_work.patch @@ -0,0 +1,72 @@ +From ec7eede369fe5b0d085ac51fdbb95184f87bfc6c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 12 Oct 2022 13:34:12 +0000 +Subject: kcm: avoid potential race in kcm_tx_work + +From: Eric Dumazet + +commit ec7eede369fe5b0d085ac51fdbb95184f87bfc6c upstream. + +syzbot found that kcm_tx_work() could crash [1] in: + + /* Primarily for SOCK_SEQPACKET sockets */ + if (likely(sk->sk_socket) && + test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { +<<*>> clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_space(sk); + } + +I think the reason is that another thread might concurrently +run in kcm_release() and call sock_orphan(sk) while sk is not +locked. kcm_tx_work() find sk->sk_socket being NULL. + +[1] +BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] +BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] +BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 +Write of size 8 at addr 0000000000000008 by task kworker/u4:3/53 + +CPU: 0 PID: 53 Comm: kworker/u4:3 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: kkcmd kcm_tx_work +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 +kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 +check_region_inline mm/kasan/generic.c:183 [inline] +kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 +instrument_atomic_write include/linux/instrumented.h:86 [inline] +clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] +kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 +process_one_work+0x996/0x1610 kernel/workqueue.c:2289 +worker_thread+0x665/0x1080 kernel/workqueue.c:2436 +kthread+0x2e9/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 + + +Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Tom Herbert +Link: https://lore.kernel.org/r/20221012133412.519394-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/kcm/kcmsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1850,10 +1850,10 @@ static int kcm_release(struct socket *so + kcm = kcm_sk(sk); + mux = kcm->mux; + ++ lock_sock(sk); + sock_orphan(sk); + kfree_skb(kcm->seq_skb); + +- lock_sock(sk); + /* Purge queue under lock to avoid race condition with tx_work trying + * to act when queue is nonempty. If tx_work runs after this point + * it will just return. diff --git a/queue-4.9/series b/queue-4.9/series index 0a20bba85c7..086c022e755 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -64,3 +64,5 @@ mmc-core-properly-select-voltage-range-without-power-cycle.patch misc-vmw_vmci-fix-an-infoleak-in-vmci_host_do_receive_datagram.patch nilfs2-fix-use-after-free-bug-of-ns_writer-on-remount.patch serial-8250-flush-dma-rx-on-rlsi.patch +tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch +kcm-avoid-potential-race-in-kcm_tx_work.patch diff --git a/queue-4.9/tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch b/queue-4.9/tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch new file mode 100644 index 00000000000..5dd806b2720 --- /dev/null +++ b/queue-4.9/tcp-cdg-allow-tcp_cdg_release-to-be-called-multiple-times.patch @@ -0,0 +1,155 @@ +From 72e560cb8c6f80fc2b4afc5d3634a32465e13a51 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 11 Oct 2022 15:07:48 -0700 +Subject: tcp: cdg: allow tcp_cdg_release() to be called multiple times + +From: Eric Dumazet + +commit 72e560cb8c6f80fc2b4afc5d3634a32465e13a51 upstream. + +Apparently, mptcp is able to call tcp_disconnect() on an already +disconnected flow. This is generally fine, unless current congestion +control is CDG, because it might trigger a double-free [1] + +Instead of fixing MPTCP, and future bugs, we can make tcp_disconnect() +more resilient. + +[1] +BUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline] +BUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567 + +CPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 +Workqueue: events mptcp_worker +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 +print_address_description mm/kasan/report.c:317 [inline] +print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 +kasan_report_invalid_free+0x81/0x190 mm/kasan/report.c:462 +____kasan_slab_free+0x18b/0x1c0 mm/kasan/common.c:356 +kasan_slab_free include/linux/kasan.h:200 [inline] +slab_free_hook mm/slub.c:1759 [inline] +slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 +slab_free mm/slub.c:3539 [inline] +kfree+0xe2/0x580 mm/slub.c:4567 +tcp_disconnect+0x980/0x1e20 net/ipv4/tcp.c:3145 +__mptcp_close_ssk+0x5ca/0x7e0 net/mptcp/protocol.c:2327 +mptcp_do_fastclose net/mptcp/protocol.c:2592 [inline] +mptcp_worker+0x78c/0xff0 net/mptcp/protocol.c:2627 +process_one_work+0x991/0x1610 kernel/workqueue.c:2289 +worker_thread+0x665/0x1080 kernel/workqueue.c:2436 +kthread+0x2e4/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + + +Allocated by task 3671: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +kasan_set_track mm/kasan/common.c:45 [inline] +set_alloc_info mm/kasan/common.c:437 [inline] +____kasan_kmalloc mm/kasan/common.c:516 [inline] +____kasan_kmalloc mm/kasan/common.c:475 [inline] +__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 +kmalloc_array include/linux/slab.h:640 [inline] +kcalloc include/linux/slab.h:671 [inline] +tcp_cdg_init+0x10d/0x170 net/ipv4/tcp_cdg.c:380 +tcp_init_congestion_control+0xab/0x550 net/ipv4/tcp_cong.c:193 +tcp_reinit_congestion_control net/ipv4/tcp_cong.c:217 [inline] +tcp_set_congestion_control+0x96c/0xaa0 net/ipv4/tcp_cong.c:391 +do_tcp_setsockopt+0x505/0x2320 net/ipv4/tcp.c:3513 +tcp_setsockopt+0xd4/0x100 net/ipv4/tcp.c:3801 +mptcp_setsockopt+0x35f/0x2570 net/mptcp/sockopt.c:844 +__sys_setsockopt+0x2d6/0x690 net/socket.c:2252 +__do_sys_setsockopt net/socket.c:2263 [inline] +__se_sys_setsockopt net/socket.c:2260 [inline] +__x64_sys_setsockopt+0xba/0x150 net/socket.c:2260 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Freed by task 16: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +kasan_set_track+0x21/0x30 mm/kasan/common.c:45 +kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 +____kasan_slab_free mm/kasan/common.c:367 [inline] +____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329 +kasan_slab_free include/linux/kasan.h:200 [inline] +slab_free_hook mm/slub.c:1759 [inline] +slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 +slab_free mm/slub.c:3539 [inline] +kfree+0xe2/0x580 mm/slub.c:4567 +tcp_cleanup_congestion_control+0x70/0x120 net/ipv4/tcp_cong.c:226 +tcp_v4_destroy_sock+0xdd/0x750 net/ipv4/tcp_ipv4.c:2254 +tcp_v6_destroy_sock+0x11/0x20 net/ipv6/tcp_ipv6.c:1969 +inet_csk_destroy_sock+0x196/0x440 net/ipv4/inet_connection_sock.c:1157 +tcp_done+0x23b/0x340 net/ipv4/tcp.c:4649 +tcp_rcv_state_process+0x40e7/0x4990 net/ipv4/tcp_input.c:6624 +tcp_v6_do_rcv+0x3fc/0x13c0 net/ipv6/tcp_ipv6.c:1525 +tcp_v6_rcv+0x2e8e/0x3830 net/ipv6/tcp_ipv6.c:1759 +ip6_protocol_deliver_rcu+0x2db/0x1950 net/ipv6/ip6_input.c:439 +ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484 +NF_HOOK include/linux/netfilter.h:302 [inline] +NF_HOOK include/linux/netfilter.h:296 [inline] +ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:493 +dst_input include/net/dst.h:455 [inline] +ip6_rcv_finish+0x193/0x2c0 net/ipv6/ip6_input.c:79 +ip_sabotage_in net/bridge/br_netfilter_hooks.c:874 [inline] +ip_sabotage_in+0x1fa/0x260 net/bridge/br_netfilter_hooks.c:865 +nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] +nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:614 +nf_hook.constprop.0+0x3ac/0x650 include/linux/netfilter.h:257 +NF_HOOK include/linux/netfilter.h:300 [inline] +ipv6_rcv+0x9e/0x380 net/ipv6/ip6_input.c:309 +__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5485 +__netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5599 +netif_receive_skb_internal net/core/dev.c:5685 [inline] +netif_receive_skb+0x12f/0x8d0 net/core/dev.c:5744 +NF_HOOK include/linux/netfilter.h:302 [inline] +NF_HOOK include/linux/netfilter.h:296 [inline] +br_pass_frame_up+0x303/0x410 net/bridge/br_input.c:68 +br_handle_frame_finish+0x909/0x1aa0 net/bridge/br_input.c:199 +br_nf_hook_thresh+0x2f8/0x3d0 net/bridge/br_netfilter_hooks.c:1041 +br_nf_pre_routing_finish_ipv6+0x695/0xef0 net/bridge/br_netfilter_ipv6.c:207 +NF_HOOK include/linux/netfilter.h:302 [inline] +br_nf_pre_routing_ipv6+0x417/0x7c0 net/bridge/br_netfilter_ipv6.c:237 +br_nf_pre_routing+0x1496/0x1fe0 net/bridge/br_netfilter_hooks.c:507 +nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] +nf_hook_bridge_pre net/bridge/br_input.c:255 [inline] +br_handle_frame+0x9c9/0x12d0 net/bridge/br_input.c:399 +__netif_receive_skb_core+0x9fe/0x38f0 net/core/dev.c:5379 +__netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:5483 +__netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5599 +process_backlog+0x3a0/0x7c0 net/core/dev.c:5927 +__napi_poll+0xb3/0x6d0 net/core/dev.c:6494 +napi_poll net/core/dev.c:6561 [inline] +net_rx_action+0x9c1/0xd90 net/core/dev.c:6672 +__do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 + +Fixes: 2b0a8c9eee81 ("tcp: add CDG congestion control") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_cdg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/tcp_cdg.c ++++ b/net/ipv4/tcp_cdg.c +@@ -382,6 +382,7 @@ static void tcp_cdg_init(struct sock *sk + struct cdg *ca = inet_csk_ca(sk); + struct tcp_sock *tp = tcp_sk(sk); + ++ ca->gradients = NULL; + /* We silently fall back to window = 1 if allocation fails. */ + if (window > 1) + ca->gradients = kcalloc(window, sizeof(ca->gradients[0]), +@@ -395,6 +396,7 @@ static void tcp_cdg_release(struct sock + struct cdg *ca = inet_csk_ca(sk); + + kfree(ca->gradients); ++ ca->gradients = NULL; + } + + struct tcp_congestion_ops tcp_cdg __read_mostly = { -- 2.47.3