diff options
| author | Eric Dumazet <edumazet@google.com> | 2019-11-07 10:30:42 -0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2020-02-11 20:03:36 +0000 |
| commit | 8b3e113e8b253025b06efa07bc194ccf0db4bc26 (patch) | |
| tree | 21ae1eae2f818f647572916fe0f42537f5d68c1d /net | |
| parent | 1ceba7e469ff0b6e0a3e10ae98972d13571e7eef (diff) | |
| download | linux-stable-8b3e113e8b253025b06efa07bc194ccf0db4bc26.tar.gz linux-stable-8b3e113e8b253025b06efa07bc194ccf0db4bc26.tar.bz2 linux-stable-8b3e113e8b253025b06efa07bc194ccf0db4bc26.zip | |
inetpeer: fix data-race in inet_putpeer / inet_putpeer
commit 71685eb4ce80ae9c49eff82ca4dd15acab215de9 upstream.
We need to explicitely forbid read/store tearing in inet_peer_gc()
and inet_putpeer().
The following syzbot report reminds us about inet_putpeer()
running without a lock held.
BUG: KCSAN: data-race in inet_putpeer / inet_putpeer
write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 0:
inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240
ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102
inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157
rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377
rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386
__do_softirq+0x115/0x33f kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0xbb/0xe0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x1af/0x280 kernel/sched/idle.c:263
write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 1:
inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240
ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102
inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157
rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377
rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386
__do_softirq+0x115/0x33f kernel/softirq.c:292
run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Fixes: 4b9d9be839fd ("inetpeer: remove unused list")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
- Use ACCESS_ONCE() instead of {READ,WRITE}_ONCE()
- Adjust context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/inetpeer.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c index c2b97cdb2e72..5746d54e52c0 100644 --- a/net/ipv4/inetpeer.c +++ b/net/ipv4/inetpeer.c @@ -419,7 +419,12 @@ static int inet_peer_gc(struct inet_peer_base *base, p = rcu_deref_locked(**stackptr, base); if (atomic_read(&p->refcnt) == 0) { smp_rmb(); - delta = (__u32)jiffies - p->dtime; + + /* The ACCESS_ONCE() pairs with the ACCESS_ONCE() + * in inet_putpeer() + */ + delta = (__u32)jiffies - ACCESS_ONCE(p->dtime); + if (delta >= ttl && atomic_cmpxchg(&p->refcnt, 0, -1) == 0) { p->gc_next = gchead; @@ -504,7 +509,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer); void inet_putpeer(struct inet_peer *p) { - p->dtime = (__u32)jiffies; + /* The ACCESS_ONCE() pairs with itself (we run lockless) + * and the ACCESS_ONCE() in inet_peer_gc() + */ + ACCESS_ONCE(p->dtime) = (__u32)jiffies; smp_mb__before_atomic(); atomic_dec(&p->refcnt); } |