From patchwork Mon Oct 24 06:06:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 8168 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp278193wru; Sun, 23 Oct 2022 23:15:48 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4m25Rf6LDwIJOZeGBj9K97MEDHUzRSEJn+Bty/pJu0h0zMkbI/ZUx2fub6y/qtEqPiY7IM X-Received: by 2002:a17:907:60c7:b0:78e:1cc:57de with SMTP id hv7-20020a17090760c700b0078e01cc57demr26263674ejc.33.1666592147885; Sun, 23 Oct 2022 23:15:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666592147; cv=none; d=google.com; s=arc-20160816; b=FkaymjL7nIc/7xte384TGMRoFlzALGA2m5h65u7Y8YWoAgT4POdhWiZMJqESF/I1z2 fnmNkO3AIHuJTF4jJktHcDLXc4LhvjfQvboH/fZDM74AeDWwYlHn3IBgfbUFewXdPlOO oLDqyEqwlPn2TADJaJS448DpDL2pLpn3WeMf6UAkrm1Ji/aZBqz4aZOPWEzb/EamWjFB A/PuurllKyKJhvmNvFhI8XQPL9+FLLZVIdsMvGd3mzBnz5SqTD8WV1M4GRE5ONgkHUb4 eIiLTObvAdhZo92OS/O2LXeJlWsgVw8rSEXf2Dhf1/JVLbkM6MzhTJTgbxszXQfxVqB8 Ljog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date; bh=8cu8s+Qr+J5WCYyZLvINdM7IroeeiyfcrYnURZnUUOo=; b=qL6MreCi04DEA++OMfn1KQtJXPsdv8WM0QIPFwSWfrBPmQ8hPVaLnHKC4o84vgaa+4 /Mt87tQCvqqjxZix60xNNPaUwUfThVbhFcWozrBOc9VqSOfovizv6bUlygTrVTCmSO6L ntFeJJOBdO/QbAxISq00rwfW2tuiOErNBrkacLAWmg+B5IYLMVZVgKAi0CAKH3lgPoI1 7gkpt9MtRfr4TKKLU/BMXMGBVQk4oqFV9t0C3w5FPjMHICgrj7LLJdD2Ymv4HyDi7yxS 9xSSC3GExWYe82Rci4TzqdvumsSoOZyhbZQvujk+nA1hBwy3xYqWWTvhWdVLiedU/xSy fCiA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qk16-20020a1709077f9000b0078e19037659si21771815ejc.792.2022.10.23.23.15.24; Sun, 23 Oct 2022 23:15:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230151AbiJXGGa (ORCPT + 99 others); Mon, 24 Oct 2022 02:06:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53062 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229615AbiJXGG2 (ORCPT ); Mon, 24 Oct 2022 02:06:28 -0400 Received: from formenos.hmeau.com (helcar.hmeau.com [216.24.177.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E68F24E846; Sun, 23 Oct 2022 23:06:26 -0700 (PDT) Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1omqae-005UFA-Ab; Mon, 24 Oct 2022 14:06:13 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Mon, 24 Oct 2022 14:06:12 +0800 Date: Mon, 24 Oct 2022 14:06:12 +0800 From: Herbert Xu To: Eric Dumazet Cc: syzbot , davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, steffen.klassert@secunet.com, syzkaller-bugs@googlegroups.com Subject: [v2 PATCH] af_key: Fix send_acquire race with pfkey_register Message-ID: References: <000000000000fd9a4005ebbeac67@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747544653954945244?= X-GMAIL-MSGID: =?utf-8?q?1747548528109275882?= On Sun, Oct 23, 2022 at 10:21:05PM -0700, Eric Dumazet wrote: > > Are you sure we can sleep in mutex_lock() ? > > Use of GFP_ATOMIC would suggest otherwise :/ Good point. Acquires are triggered from the network stack so it may be in BH context. ---8<--- With name space support, it is possible for a pfkey_register to occur in the middle of a send_acquire, thus changing the number of supported algorithms. This can be fixed by taking a lock to make it single-threaded again. As this lock can be taken from both thread and softirq contexts, we need to take the necessary precausions with disabling BH and make it a spin lock. Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Herbert Xu diff --git a/net/key/af_key.c b/net/key/af_key.c index c85df5b958d2..4e0d21e2045e 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -39,6 +40,7 @@ struct netns_pfkey { atomic_t socks_nr; }; static DEFINE_MUTEX(pfkey_mutex); +static DEFINE_SPINLOCK(pfkey_alg_lock); #define DUMMY_MARK 0 static const struct xfrm_mark dummy_mark = {0, 0}; @@ -1697,11 +1699,11 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad pfk->registered |= (1<sadb_msg_satype); } - mutex_lock(&pfkey_mutex); + spin_lock_bh(&pfkey_alg_lock); xfrm_probe_algs(); supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); - mutex_unlock(&pfkey_mutex); + spin_unlock_bh(&pfkey_alg_lock); if (!supp_skb) { if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) @@ -3160,6 +3162,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct (sockaddr_size * 2) + sizeof(struct sadb_x_policy); + spin_lock_bh(&pfkey_alg_lock); if (x->id.proto == IPPROTO_AH) size += count_ah_combs(t); else if (x->id.proto == IPPROTO_ESP) @@ -3171,8 +3174,10 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct } skb = alloc_skb(size + 16, GFP_ATOMIC); - if (skb == NULL) + if (skb == NULL) { + spin_unlock_bh(&pfkey_alg_lock); return -ENOMEM; + } hdr = skb_put(skb, sizeof(struct sadb_msg)); hdr->sadb_msg_version = PF_KEY_V2; @@ -3228,6 +3233,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct dump_ah_combs(skb, t); else if (x->id.proto == IPPROTO_ESP) dump_esp_combs(skb, t); + spin_unlock_bh(&pfkey_alg_lock); /* security context */ if (xfrm_ctx) {