From: Greg Kroah-Hartman Date: Fri, 6 Nov 2020 11:22:23 +0000 (+0100) Subject: 5.9-stable patches X-Git-Tag: v4.4.242~52 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=a1177b15bf87051d992fb6cce3db3a654d360db1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.9-stable patches added patches: net-core-use-list_del_init-instead-of-list_del-in-netdev_run_todo.patch tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch --- diff --git a/queue-5.9/net-core-use-list_del_init-instead-of-list_del-in-netdev_run_todo.patch b/queue-5.9/net-core-use-list_del_init-instead-of-list_del-in-netdev_run_todo.patch new file mode 100644 index 00000000000..ad610c6f970 --- /dev/null +++ b/queue-5.9/net-core-use-list_del_init-instead-of-list_del-in-netdev_run_todo.patch @@ -0,0 +1,100 @@ +From 0e8b8d6a2d85344d80dda5beadd98f5f86e8d3d3 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Thu, 15 Oct 2020 16:26:06 +0000 +Subject: net: core: use list_del_init() instead of list_del() in netdev_run_todo() + +From: Taehee Yoo + +commit 0e8b8d6a2d85344d80dda5beadd98f5f86e8d3d3 upstream. + +dev->unlink_list is reused unless dev is deleted. +So, list_del() should not be used. +Due to using list_del(), dev->unlink_list can't be reused so that +dev->nested_level update logic doesn't work. +In order to fix this bug, list_del_init() should be used instead +of list_del(). + +Test commands: + ip link add bond0 type bond + ip link add bond1 type bond + ip link set bond0 master bond1 + ip link set bond0 nomaster + ip link set bond1 master bond0 + ip link set bond1 nomaster + +Splat looks like: +[ 255.750458][ T1030] ============================================ +[ 255.751967][ T1030] WARNING: possible recursive locking detected +[ 255.753435][ T1030] 5.9.0-rc8+ #772 Not tainted +[ 255.754553][ T1030] -------------------------------------------- +[ 255.756047][ T1030] ip/1030 is trying to acquire lock: +[ 255.757304][ T1030] ffff88811782a280 (&dev_addr_list_lock_key/1){+...}-{2:2}, at: dev_mc_sync_multiple+0xc2/0x150 +[ 255.760056][ T1030] +[ 255.760056][ T1030] but task is already holding lock: +[ 255.761862][ T1030] ffff88811130a280 (&dev_addr_list_lock_key/1){+...}-{2:2}, at: bond_enslave+0x3d4d/0x43e0 [bonding] +[ 255.764581][ T1030] +[ 255.764581][ T1030] other info that might help us debug this: +[ 255.766645][ T1030] Possible unsafe locking scenario: +[ 255.766645][ T1030] +[ 255.768566][ T1030] CPU0 +[ 255.769415][ T1030] ---- +[ 255.770259][ T1030] lock(&dev_addr_list_lock_key/1); +[ 255.771629][ T1030] lock(&dev_addr_list_lock_key/1); +[ 255.772994][ T1030] +[ 255.772994][ T1030] *** DEADLOCK *** +[ 255.772994][ T1030] +[ 255.775091][ T1030] May be due to missing lock nesting notation +[ 255.775091][ T1030] +[ 255.777182][ T1030] 2 locks held by ip/1030: +[ 255.778299][ T1030] #0: ffffffffb1f63250 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x2e4/0x8b0 +[ 255.780600][ T1030] #1: ffff88811130a280 (&dev_addr_list_lock_key/1){+...}-{2:2}, at: bond_enslave+0x3d4d/0x43e0 [bonding] +[ 255.783411][ T1030] +[ 255.783411][ T1030] stack backtrace: +[ 255.784874][ T1030] CPU: 7 PID: 1030 Comm: ip Not tainted 5.9.0-rc8+ #772 +[ 255.786595][ T1030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 255.789030][ T1030] Call Trace: +[ 255.789850][ T1030] dump_stack+0x99/0xd0 +[ 255.790882][ T1030] __lock_acquire.cold.71+0x166/0x3cc +[ 255.792285][ T1030] ? register_lock_class+0x1a30/0x1a30 +[ 255.793619][ T1030] ? rcu_read_lock_sched_held+0x91/0xc0 +[ 255.794963][ T1030] ? rcu_read_lock_bh_held+0xa0/0xa0 +[ 255.796246][ T1030] lock_acquire+0x1b8/0x850 +[ 255.797332][ T1030] ? dev_mc_sync_multiple+0xc2/0x150 +[ 255.798624][ T1030] ? bond_enslave+0x3d4d/0x43e0 [bonding] +[ 255.800039][ T1030] ? check_flags+0x50/0x50 +[ 255.801143][ T1030] ? lock_contended+0xd80/0xd80 +[ 255.802341][ T1030] _raw_spin_lock_nested+0x2e/0x70 +[ 255.803592][ T1030] ? dev_mc_sync_multiple+0xc2/0x150 +[ 255.804897][ T1030] dev_mc_sync_multiple+0xc2/0x150 +[ 255.806168][ T1030] bond_enslave+0x3d58/0x43e0 [bonding] +[ 255.807542][ T1030] ? __lock_acquire+0xe53/0x51b0 +[ 255.808824][ T1030] ? bond_update_slave_arr+0xdc0/0xdc0 [bonding] +[ 255.810451][ T1030] ? check_chain_key+0x236/0x5e0 +[ 255.811742][ T1030] ? mutex_is_locked+0x13/0x50 +[ 255.812910][ T1030] ? rtnl_is_locked+0x11/0x20 +[ 255.814061][ T1030] ? netdev_master_upper_dev_get+0xf/0x120 +[ 255.815553][ T1030] do_setlink+0x94c/0x3040 +[ ... ] + +Reported-by: syzbot+4a0f7bc34e3997a6c7df@syzkaller.appspotmail.com +Fixes: 1fc70edb7d7b ("net: core: add nested_level variable in net_device") +Signed-off-by: Taehee Yoo +Link: https://lore.kernel.org/r/20201015162606.9377-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10134,7 +10134,7 @@ void netdev_run_todo(void) + struct net_device *dev = list_first_entry(&unlink_list, + struct net_device, + unlink_list); +- list_del(&dev->unlink_list); ++ list_del_init(&dev->unlink_list); + dev->nested_level = dev->lower_level - 1; + } + #endif diff --git a/queue-5.9/series b/queue-5.9/series index 5f351cce28b..6acbd212938 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -1,3 +1,5 @@ +net-core-use-list_del_init-instead-of-list_del-in-netdev_run_todo.patch +tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch drm-i915-gem-avoid-implicit-vmap-for-highmem-on-x86-32.patch drm-i915-gem-prevent-using-pgprot_writecombine-if-pat-is-not-supported.patch drm-i915-gem-always-test-execution-status-on-closing-the-context.patch diff --git a/queue-5.9/tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch b/queue-5.9/tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch new file mode 100644 index 00000000000..9b2e1227989 --- /dev/null +++ b/queue-5.9/tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch @@ -0,0 +1,101 @@ +From fdeba99b1e58ecd18c2940c453e19e4ef20ff591 Mon Sep 17 00:00:00 2001 +From: Hoang Huu Le +Date: Thu, 27 Aug 2020 09:56:51 +0700 +Subject: tipc: fix use-after-free in tipc_bcast_get_mode + +From: Hoang Huu Le + +commit fdeba99b1e58ecd18c2940c453e19e4ef20ff591 upstream. + +Syzbot has reported those issues as: + +================================================================== +BUG: KASAN: use-after-free in tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 +Read of size 1 at addr ffff88805e6b3571 by task kworker/0:6/3850 + +CPU: 0 PID: 3850 Comm: kworker/0:6 Not tainted 5.8.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: events tipc_net_finalize_work + +Thread 1's call trace: +[...] + kfree+0x103/0x2c0 mm/slab.c:3757 <- bcbase releasing + tipc_bcast_stop+0x1b0/0x2f0 net/tipc/bcast.c:721 + tipc_exit_net+0x24/0x270 net/tipc/core.c:112 +[...] + +Thread 2's call trace: +[...] + tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 <- bcbase +has already been freed by Thread 1 + + tipc_node_broadcast+0x9e/0xcc0 net/tipc/node.c:1744 + tipc_nametbl_publish+0x60b/0x970 net/tipc/name_table.c:752 + tipc_net_finalize net/tipc/net.c:141 [inline] + tipc_net_finalize+0x1fa/0x310 net/tipc/net.c:131 + tipc_net_finalize_work+0x55/0x80 net/tipc/net.c:150 +[...] + +================================================================== +BUG: KASAN: use-after-free in tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 +Read of size 8 at addr ffff888052ab2000 by task kworker/0:13/30628 +CPU: 0 PID: 30628 Comm: kworker/0:13 Not tainted 5.8.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: events tipc_net_finalize_work +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x1f0/0x31e lib/dump_stack.c:118 + print_address_description+0x66/0x5a0 mm/kasan/report.c:383 + __kasan_report mm/kasan/report.c:513 [inline] + kasan_report+0x132/0x1d0 mm/kasan/report.c:530 + tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 + tipc_net_finalize+0x85/0xe0 net/tipc/net.c:138 + tipc_net_finalize_work+0x50/0x70 net/tipc/net.c:150 + process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 + worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 + kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 +[...] +Freed by task 14058: + save_stack mm/kasan/common.c:48 [inline] + set_track mm/kasan/common.c:56 [inline] + kasan_set_free_info mm/kasan/common.c:316 [inline] + __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 + __cache_free mm/slab.c:3426 [inline] + kfree+0x10a/0x220 mm/slab.c:3757 + tipc_exit_net+0x29/0x50 net/tipc/core.c:113 + ops_exit_list net/core/net_namespace.c:186 [inline] + cleanup_net+0x708/0xba0 net/core/net_namespace.c:603 + process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 + worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 + kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 + +Fix it by calling flush_scheduled_work() to make sure the +tipc_net_finalize_work() stopped before releasing bcbase object. + +Reported-by: syzbot+6ea1f7a8df64596ef4d7@syzkaller.appspotmail.com +Reported-by: syzbot+e9cc557752ab126c1b99@syzkaller.appspotmail.com +Acked-by: Jon Maloy +Signed-off-by: Hoang Huu Le +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/tipc/core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -109,6 +109,11 @@ static void __net_exit tipc_exit_net(str + { + tipc_detach_loopback(net); + tipc_net_stop(net); ++ ++ /* Make sure the tipc_net_finalize_work stopped ++ * before releasing the resources. ++ */ ++ flush_scheduled_work(); + tipc_bcast_stop(net); + tipc_nametbl_stop(net); + tipc_sk_rht_destroy(net);