Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1604970

[PATCH 4.10 23/63] dccp: Unlock sock before calling sk_free()

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnaldo Carvalho de Melo <acme@redhat.com>


[ Upstream commit d5afb6f9b6bb2c57bd0c05e76e12489dc0d037d9 ]

The code where sk_clone() came from created a new socket and locked it,
but then, on the error path didn't unlock it.

This problem stayed there for a long while, till b0691c8ee7c2 ("net:
Unlock sock before calling sk_free()") fixed it, but unfortunately the
callers of sk_clone() (now sk_clone_locked()) were not audited and the
one in dccp_create_openreq_child() remained.

Now in the age of the syskaller fuzzer, this was finally uncovered, as
reported by Dmitry:

 ---- 8< ----

I've got the following report while running syzkaller fuzzer on
86292b33d4b7 ("Merge branch 'akpm' (patches from Andrew)")

  [ BUG: held lock freed! ]
  4.10.0+ #234 Not tainted
  -------------------------
  syz-executor6/6898 is freeing memory
  ffff88006286cac0-ffff88006286d3b7, with a lock still held there!
   (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
  include/linux/spinlock.h:299 [inline]
   (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
  sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504
  5 locks held by syz-executor6/6898:
   #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>] lock_sock
  include/net/sock.h:1460 [inline]
   #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>]
  inet_stream_connect+0x44/0xa0 net/ipv4/af_inet.c:681
   #1:  (rcu_read_lock){......}, at: [<ffffffff83bc1c2a>]
  inet6_csk_xmit+0x12a/0x5d0 net/ipv6/inet6_connection_sock.c:126
   #2:  (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_unlink
  include/linux/skbuff.h:1767 [inline]
   #2:  (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_dequeue
  include/linux/skbuff.h:1783 [inline]
   #2:  (rcu_read_lock){......}, at: [<ffffffff8369b424>]
  process_backlog+0x264/0x730 net/core/dev.c:4835
   #3:  (rcu_read_lock){......}, at: [<ffffffff83aeb5c0>]
  ip6_input_finish+0x0/0x1700 net/ipv6/ip6_input.c:59
   #4:  (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
  include/linux/spinlock.h:299 [inline]
   #4:  (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
  sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504

Fix it just like was done by b0691c8ee7c2 ("net: Unlock sock before calling
sk_free()").

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170301153510.GE15145@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/minisocks.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -122,6 +122,7 @@ struct sock *dccp_create_openreq_child(c
 			/* It is still raw copy of parent, so invalidate
 			 * destructor and make plain sk_free() */
 			newsk->sk_destruct = NULL;
+			bh_unlock_sock(newsk);
 			sk_free(newsk);
 			return NULL;
 		}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 31/63] net: fix socket refcounting in skb_complete_tx_timestamp() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 33/63] dccp: fix use-after-free in dccp_feat_activate_values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 32/63] net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 08/63] vti6: return GRE_KEY for vti6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 07/63] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 13/63] net sched actions: decrement module reference count after table flush. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 06/63] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 35/63] vrf: Fix use-after-free in vrf_xmit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 16/63] geneve: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 21/63] net: net_enable_timestamp() can be called from irq contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 40/63] mpls: Send route delete notifications when router module is unloaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 36/63] net/tunnel: set inner protocol in network gro hooks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 29/63] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 27/63] bonding: use ETH_MAX_MTU as max mtu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 17/63] mlxsw: spectrum_router: Avoid potential packets loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 59/63] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 38/63] amd-xgbe: Enable IRQs only if napi_complete_done() is true Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 60/63] futex: Add missing error handling to FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 22/63] ipv6: orphan skbs in reassembly unit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 56/63] x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 49/63] arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 05/63] net/mlx5e: Fix wrong CQE decompression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 09/63] vxlan: dont allow overwrite of config src addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 43/63] ipv6: avoid write to a possibly cloned skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 61/63] locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 41/63] mpls: Do not decrement alive counter for unregister events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 15/63] vxlan: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 03/63] net/mlx5e: Fix broken CQE compression initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 37/63] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 50/63] irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 26/63] amd-xgbe: Dont overwrite SFP PHY mod_absent settings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 12/63] sctp: set sin_port for addr param when checking duplicate address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 23/63] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 04/63] net/mlx5e: Update MPWQE stride size when modifying CQE compress state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 10/63] ipv4: add missing initialization for flowi4_uid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 62/63] crypto: powerpc - Fix initialisation of crc32c context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 25/63] amd-xgbe: Be sure to set MDIO modes on device (re)start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  Re: [PATCH 4.10 00/63] 4.10.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-21 01:20 +0100
    Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:40 +0100
  Re: [PATCH 4.10 00/63] 4.10.5-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-21 03:20 +0100
    Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:50 +0100

csiph-web