From patchwork Mon Oct 24 05:10:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 8161 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp260442wru; Sun, 23 Oct 2022 22:14:13 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6AqmZ7ssjXZ9ZtrtkXIcCa47RWGdtlrgLqjHXVWSHcuiy1DJ7R93Z09MGkzTYgGMRyQSai X-Received: by 2002:a17:907:72cb:b0:793:30b3:7f89 with SMTP id du11-20020a17090772cb00b0079330b37f89mr20413628ejc.259.1666588453255; Sun, 23 Oct 2022 22:14:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666588453; cv=none; d=google.com; s=arc-20160816; b=N61Th8K5+0Vq8KbyqHIPkyxE7da4WyySwh4dwCVEnOHdak88JVQwmvu/se0H0koxUx aNr8z5fWfWqKOqYI+q/aMXneBu1QBBg24IpcS+98we+gCuVeqAr8/SbQLOfZsQVdY0i+ iKy8/f5NaTK+g0osylFym4Wk/4oB7VuiK4ukiV/0Bpf/2k+d62B19ubhKBt/7rH9n43s ZIZkWDTj6rGb+O9ebteWZymUdwCNAmXBWyd8kviNsvUEiLksi6O5RfIVdOls0QN8qTTi dWmqE3mgaLNqp6JLNoWGFbkSdAbASuvp512iAxtVgoh8W2O6pIK3uqgjsA3/JsvwJ2vv Ac8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date; bh=i3nGN9r0wSjDTw6yrHbQHBN/jVGGZVZskbTY6Ctj/yo=; b=ZZ2q5IlDE3C0n2sX7ahnEq6zuPJTewCRiFX06nOEnkRxeUmpSfRSx2cTqokwaB8K2l W5g2vqgnKKgf0cBx1Urd1br2Le2LiPxobDIE9SxIgR6BmtFC7WNg/CEQfXDa7hHH7c9T 9cF7xlkPpUqSER+aGLX08ISZvJGRFEmJvv6ucW/Dqi/M8cqJBSEbMoPIG9TdOCHqTzxh fS0CNaks0srznBDA4UQ1HlJqLlMQ1yhi70YTKI95D9Evau8P/JjpIXqEkyTrOdizmaC9 EISebX8bACv+W5UnPLhhnK7KRRcIxZXzdfqNsq3sPoHFqpKPhKhJmFxLudGCudfe3l9w 6Q2Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id hd43-20020a17090796ab00b0077f3a9c58e2si32896466ejc.6.2022.10.23.22.13.49; Sun, 23 Oct 2022 22:14:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229918AbiJXFKt (ORCPT + 99 others); Mon, 24 Oct 2022 01:10:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229689AbiJXFKr (ORCPT ); Mon, 24 Oct 2022 01:10:47 -0400 Received: from formenos.hmeau.com (helcar.hmeau.com [216.24.177.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA59363360; Sun, 23 Oct 2022 22:10:46 -0700 (PDT) Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1ompin-005Tir-QH; Mon, 24 Oct 2022 13:10:35 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Mon, 24 Oct 2022 13:10:34 +0800 Date: Mon, 24 Oct 2022 13:10:34 +0800 From: Herbert Xu To: syzbot Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, steffen.klassert@secunet.com, syzkaller-bugs@googlegroups.com Subject: [PATCH] af_key: Fix send_acquire race with pfkey_register Message-ID: References: <000000000000fd9a4005ebbeac67@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <000000000000fd9a4005ebbeac67@google.com> X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,SORTED_RECIPS, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747544653954945244?= X-GMAIL-MSGID: =?utf-8?q?1747544653954945244?= With name space support, it is possible for a pfkey_register to occur in the middle of a send_acquire, thus changing the number of supported algorithms. This can be fixed by taking a mutex to make it single-threaded again. Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Herbert Xu diff --git a/net/key/af_key.c b/net/key/af_key.c index c85df5b958d2..4ceef96fef57 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -3160,6 +3160,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct (sockaddr_size * 2) + sizeof(struct sadb_x_policy); + mutex_lock(&pfkey_mutex); if (x->id.proto == IPPROTO_AH) size += count_ah_combs(t); else if (x->id.proto == IPPROTO_ESP) @@ -3171,8 +3172,10 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct } skb = alloc_skb(size + 16, GFP_ATOMIC); - if (skb == NULL) + if (skb == NULL) { + mutex_unlock(&pfkey_mutex); return -ENOMEM; + } hdr = skb_put(skb, sizeof(struct sadb_msg)); hdr->sadb_msg_version = PF_KEY_V2; @@ -3228,6 +3231,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct dump_ah_combs(skb, t); else if (x->id.proto == IPPROTO_ESP) dump_esp_combs(skb, t); + mutex_unlock(&pfkey_mutex); /* security context */ if (xfrm_ctx) {