From patchwork Thu Mar 30 01:25:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ziyang Xuan X-Patchwork-Id: 76870 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp819317vqo; Wed, 29 Mar 2023 19:17:06 -0700 (PDT) X-Google-Smtp-Source: AKy350b9209xauJMWFTivRwyv1x7pmPIySbJMFa6e1G2qtjzSW/vwdy0y0SZL5A5hk4liv6BIRZ9 X-Received: by 2002:a17:902:c403:b0:1a2:7356:1ecd with SMTP id k3-20020a170902c40300b001a273561ecdmr6132973plk.5.1680142626153; Wed, 29 Mar 2023 19:17:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1680142626; cv=none; d=google.com; s=arc-20160816; b=RSny9nrkXqK/75brN6G9IMv56/HpCdjJFG82aVNCUw01bQDHSaL3QcT+W3Ch/dun6e Mq002bZaAoMKdSgffppDL5ci+5/5cM0MfBTGw1ZwLUhI/kCEAIk6RGmxFlRTBJA5iOS/ pf8YbcEeUCspIFrN2WbDVaWBb3WS0sdqEMPikpFILj0ODasDdRd1YHqJKpyFjSqyNDy9 wOa+P/eoXFGlCiaBblOYp8C5J04Q7K5z8ZYjvrWtYUc0PXtjhKHgwYy4nYRlYpkNa3pC V3cTT/G2YtSnE2x/hAREyGPqJVF+zzEdO3mM7qAVohfjwDKnNeS5SJHmrhlDp+xHvcaa dsJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=6o7OHsS++R1CNZz9ThSsZYizbPFNjc77TN+7D7GqlpM=; b=r0zyD2sp3QRPfUBAtfjcKWIS9vEkqW9DpJ8O5FGfnhBX1dKb11wnniRnzUibRoXAeU iyvx7vdDndd+PQFqF2+VQaqub0jIhfmvxsUAKbxT7CU4l21pHN4Kc/Vfqt9pm76pVyPv uOl0fxDWGhBPvbBmTGBa8k20EJKnyaNgL+ftDaRsukSrU2oK0bJSuzU+zntB0GIsB3Rs 56y5Pc4S/1rNA/VBq5A+um3OuaR2pzYbneb/2AiYlMdZaSPSQL9rVU7IKCPIOjrT7mWA NSAd5RJIlvNnYZWXJV+gy7ShwjZhEvNAcj+Bay3kvCMiqW2OMG26JyJJ82tb2XXinHED wRSw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i7-20020a635407000000b00508d4eae759si32445508pgb.231.2023.03.29.19.16.50; Wed, 29 Mar 2023 19:17:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229694AbjC3BZl (ORCPT + 99 others); Wed, 29 Mar 2023 21:25:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229475AbjC3BZj (ORCPT ); Wed, 29 Mar 2023 21:25:39 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7FF4A4ECD; Wed, 29 Mar 2023 18:25:38 -0700 (PDT) Received: from canpemm500006.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4Pn5M62mk7zKnsL; Thu, 30 Mar 2023 09:25:06 +0800 (CST) Received: from localhost.localdomain (10.175.104.82) by canpemm500006.china.huawei.com (7.192.105.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Thu, 30 Mar 2023 09:25:35 +0800 From: Ziyang Xuan To: , , , , , , CC: , Subject: [PATCH net] net: qrtr: Fix a refcount bug in qrtr_recvmsg() Date: Thu, 30 Mar 2023 09:25:32 +0800 Message-ID: <20230330012532.1065159-1-william.xuanziyang@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.104.82] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500006.china.huawei.com (7.192.105.130) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-2.3 required=5.0 tests=RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1761757234057212480?= X-GMAIL-MSGID: =?utf-8?q?1761757234057212480?= Syzbot reported a bug as following: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 ... Call Trace: __refcount_add include/linux/refcount.h:199 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] qrtr_node_acquire net/qrtr/af_qrtr.c:202 [inline] qrtr_node_lookup net/qrtr/af_qrtr.c:398 [inline] qrtr_send_resume_tx net/qrtr/af_qrtr.c:1003 [inline] qrtr_recvmsg+0x85f/0x990 net/qrtr/af_qrtr.c:1070 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1038 qrtr_ns_worker+0x170/0x1700 net/qrtr/ns.c:688 process_one_work+0x991/0x15c0 kernel/workqueue.c:2390 worker_thread+0x669/0x1090 kernel/workqueue.c:2537 It occurs in the concurrent scenario of qrtr_recvmsg() and qrtr_endpoint_unregister() as following: cpu0 cpu1 qrtr_recvmsg qrtr_endpoint_unregister qrtr_send_resume_tx qrtr_node_release qrtr_node_lookup mutex_lock(&qrtr_node_lock) spin_lock_irqsave(&qrtr_nodes_lock, ) refcount_dec_and_test(&node->ref) [node->ref == 0] radix_tree_lookup [node != NULL] __qrtr_node_release qrtr_node_acquire spin_lock_irqsave(&qrtr_nodes_lock, ) kref_get(&node->ref) [WARNING] ... mutex_unlock(&qrtr_node_lock) Use qrtr_node_lock to protect qrtr_node_lookup() implementation, this is actually improving the protection of node reference. Fixes: 0a7e0d0ef054 ("net: qrtr: Migrate node lookup tree to spinlock") Reported-by: syzbot+a7492efaa5d61b51db23@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a7492efaa5d61b51db23 Signed-off-by: Ziyang Xuan --- net/qrtr/af_qrtr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c index 5c2fb992803b..3a70255c8d02 100644 --- a/net/qrtr/af_qrtr.c +++ b/net/qrtr/af_qrtr.c @@ -393,10 +393,12 @@ static struct qrtr_node *qrtr_node_lookup(unsigned int nid) struct qrtr_node *node; unsigned long flags; + mutex_lock(&qrtr_node_lock); spin_lock_irqsave(&qrtr_nodes_lock, flags); node = radix_tree_lookup(&qrtr_nodes, nid); node = qrtr_node_acquire(node); spin_unlock_irqrestore(&qrtr_nodes_lock, flags); + mutex_unlock(&qrtr_node_lock); return node; }