From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>,
syzbot+d3eccef36ddbd02713e9@syzkaller.appspotmail.com,
"David S . Miller" <davem@davemloft.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 4.14 13/78] rxrpc: Fix notification call on completion of discarded calls
Date: Mon, 29 Jun 2020 11:37:01 -0400 [thread overview]
Message-ID: <20200629153806.2494953-14-sashal@kernel.org> (raw)
In-Reply-To: <20200629153806.2494953-1-sashal@kernel.org>
From: David Howells <dhowells@redhat.com>
[ Upstream commit 0041cd5a50442db6e456b145892a0eaf2dff061f ]
When preallocated service calls are being discarded, they're passed to
->discard_new_call() to have the caller clean up any attached higher-layer
preallocated pieces before being marked completed. However, the act of
marking them completed now invokes the call's notification function - which
causes a problem because that function might assume that the previously
freed pieces of memory are still there.
Fix this by setting a dummy notification function on the socket after
calling ->discard_new_call().
This results in the following kasan message when the kafs module is
removed.
==================================================================
BUG: KASAN: use-after-free in afs_wake_up_async_call+0x6aa/0x770 fs/afs/rxrpc.c:707
Write of size 1 at addr ffff8880946c39e4 by task kworker/u4:1/21
CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.8.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18f/0x20d lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
afs_wake_up_async_call+0x6aa/0x770 fs/afs/rxrpc.c:707
rxrpc_notify_socket+0x1db/0x5d0 net/rxrpc/recvmsg.c:40
__rxrpc_set_call_completion.part.0+0x172/0x410 net/rxrpc/recvmsg.c:76
__rxrpc_call_completed net/rxrpc/recvmsg.c:112 [inline]
rxrpc_call_completed+0xca/0xf0 net/rxrpc/recvmsg.c:111
rxrpc_discard_prealloc+0x781/0xab0 net/rxrpc/call_accept.c:233
rxrpc_listen+0x147/0x360 net/rxrpc/af_rxrpc.c:245
afs_close_socket+0x95/0x320 fs/afs/rxrpc.c:110
afs_net_exit+0x1bc/0x310 fs/afs/main.c:155
ops_exit_list.isra.0+0xa8/0x150 net/core/net_namespace.c:186
cleanup_net+0x511/0xa50 net/core/net_namespace.c:603
process_one_work+0x965/0x1690 kernel/workqueue.c:2269
worker_thread+0x96/0xe10 kernel/workqueue.c:2415
kthread+0x3b5/0x4a0 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Allocated by task 6820:
save_stack+0x1b/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc mm/kasan/common.c:494 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467
kmem_cache_alloc_trace+0x153/0x7d0 mm/slab.c:3551
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
afs_alloc_call+0x55/0x630 fs/afs/rxrpc.c:141
afs_charge_preallocation+0xe9/0x2d0 fs/afs/rxrpc.c:757
afs_open_socket+0x292/0x360 fs/afs/rxrpc.c:92
afs_net_init+0xa6c/0xe30 fs/afs/main.c:125
ops_init+0xaf/0x420 net/core/net_namespace.c:151
setup_net+0x2de/0x860 net/core/net_namespace.c:341
copy_net_ns+0x293/0x590 net/core/net_namespace.c:482
create_new_namespaces+0x3fb/0xb30 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:231
ksys_unshare+0x43d/0x8e0 kernel/fork.c:2983
__do_sys_unshare kernel/fork.c:3051 [inline]
__se_sys_unshare kernel/fork.c:3049 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3049
do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 21:
save_stack+0x1b/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
kasan_set_free_info mm/kasan/common.c:316 [inline]
__kasan_slab_free+0xf7/0x140 mm/kasan/common.c:455
__cache_free mm/slab.c:3426 [inline]
kfree+0x109/0x2b0 mm/slab.c:3757
afs_put_call+0x585/0xa40 fs/afs/rxrpc.c:190
rxrpc_discard_prealloc+0x764/0xab0 net/rxrpc/call_accept.c:230
rxrpc_listen+0x147/0x360 net/rxrpc/af_rxrpc.c:245
afs_close_socket+0x95/0x320 fs/afs/rxrpc.c:110
afs_net_exit+0x1bc/0x310 fs/afs/main.c:155
ops_exit_list.isra.0+0xa8/0x150 net/core/net_namespace.c:186
cleanup_net+0x511/0xa50 net/core/net_namespace.c:603
process_one_work+0x965/0x1690 kernel/workqueue.c:2269
worker_thread+0x96/0xe10 kernel/workqueue.c:2415
kthread+0x3b5/0x4a0 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
The buggy address belongs to the object at ffff8880946c3800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 484 bytes inside of
1024-byte region [ffff8880946c3800, ffff8880946c3c00)
The buggy address belongs to the page:
page:ffffea000251b0c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0002546508 ffffea00024fa248 ffff8880aa000c40
raw: 0000000000000000 ffff8880946c3000 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880946c3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880946c3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880946c3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880946c3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880946c3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Reported-by: syzbot+d3eccef36ddbd02713e9@syzkaller.appspotmail.com
Fixes: 5ac0d62226a0 ("rxrpc: Fix missing notification")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/call_accept.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 2dd13f5c47c86..61425179780c3 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -26,6 +26,11 @@
#include <net/ip.h>
#include "ar-internal.h"
+static void rxrpc_dummy_notify(struct sock *sk, struct rxrpc_call *call,
+ unsigned long user_call_ID)
+{
+}
+
/*
* Preallocate a single service call, connection and peer and, if possible,
* give them a user ID and attach the user's side of the ID to them.
@@ -227,6 +232,8 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
if (rx->discard_new_call) {
_debug("discard %lx", call->user_call_ID);
rx->discard_new_call(call, call->user_call_ID);
+ if (call->notify_rx)
+ call->notify_rx = rxrpc_dummy_notify;
rxrpc_put_call(call, rxrpc_call_put_kernel);
}
rxrpc_call_completed(call);
--
2.25.1
next prev parent reply other threads:[~2020-06-29 20:04 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-29 15:36 [PATCH 4.14 00/78] 4.14.186-rc1 review Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 01/78] scsi: scsi_devinfo: handle non-terminated strings Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 02/78] net: be more gentle about silly gso requests coming from user Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 03/78] block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 04/78] net: sched: export __netdev_watchdog_up() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 05/78] fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 06/78] apparmor: don't try to replace stale label in ptraceme check Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 07/78] ibmveth: Fix max MTU limit Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 08/78] mld: fix memory leak in ipv6_mc_destroy_dev() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 09/78] net: bridge: enfore alignment for ethernet address Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 10/78] net: fix memleak in register_netdevice() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 11/78] net: usb: ax88179_178a: fix packet alignment padding Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 12/78] rocker: fix incorrect error handling in dma_rings_init Sasha Levin
2020-06-29 15:37 ` Sasha Levin [this message]
2020-06-29 15:37 ` [PATCH 4.14 14/78] sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 15/78] tcp: grow window for OOO packets only for SACK flows Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 16/78] tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 17/78] ip_tunnel: fix use-after-free in ip_tunnel_lookup() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 18/78] tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 19/78] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 20/78] net: Fix the arp error in some cases Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 21/78] net: Do not clear the sock TX queue in sk_set_socket() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 22/78] net: core: reduce recursion limit value Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 23/78] USB: ohci-sm501: Add missed iounmap() in remove Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 24/78] usb: dwc2: Postponed gadget registration to the udc class driver Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 25/78] usb: add USB_QUIRK_DELAY_INIT for Logitech C922 Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 26/78] USB: ehci: reopen solution for Synopsys HC bug Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 27/78] usb: host: xhci-mtk: avoid runtime suspend when removing hcd Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 28/78] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 29/78] ALSA: usb-audio: add quirk for Denon DCD-1500RE Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 30/78] xhci: Fix incorrect EP_STATE_MASK Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 31/78] xhci: Fix enumeration issue when setting max packet size for FS devices Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 32/78] cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 33/78] loop: replace kill_bdev with invalidate_bdev Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 34/78] ALSA: usb-audio: uac1: Invalidate ctl on interrupt Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 35/78] ALSA: usb-audio: Clean up mixer element list traverse Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 36/78] ALSA: usb-audio: Fix OOB access of mixer element list Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 37/78] xhci: Poll for U0 after disabling USB2 LPM Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 38/78] cifs/smb3: Fix data inconsistent when punch hole Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 39/78] cifs/smb3: Fix data inconsistent when zero file range Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 40/78] efi/esrt: Fix reference count leak in esre_create_sysfs_entry Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 41/78] ARM: dts: NSP: Correct FA2 mailbox node Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 42/78] rxrpc: Fix handling of rwind from an ACK packet Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 43/78] RDMA/cma: Protect bind_list and listen_list while finding matching cm id Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 44/78] ASoC: rockchip: Fix a reference count leak Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 45/78] RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 46/78] net: qed: fix left elements count calculation Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 47/78] net: qed: fix NVMe login fails over VFs Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 48/78] net: qed: fix excessive QM ILT lines consumption Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 49/78] ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 50/78] usb: gadget: udc: Potential Oops in error handling code Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 51/78] netfilter: ipset: fix unaligned atomic access Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 52/78] net: bcmgenet: use hardware padding of runt frames Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 53/78] sched/core: Fix PI boosting between RT and DEADLINE tasks Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 54/78] ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 55/78] net: alx: fix race condition in alx_remove Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 56/78] s390/ptrace: fix setting syscall number Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 57/78] kbuild: improve cc-option to clean up all temporary files Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 58/78] blktrace: break out of blktrace setup on concurrent calls Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 59/78] ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 60/78] ACPI: sysfs: Fix pm_profile_attr type Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 61/78] KVM: X86: Fix MSR range of APIC registers in X2APIC mode Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 62/78] KVM: nVMX: Plumb L2 GPA through to PML emulation Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 63/78] btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 64/78] mm/slab: use memzero_explicit() in kzfree() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 65/78] ocfs2: load global_inode_alloc Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 66/78] ocfs2: fix value of OCFS2_INVALID_SLOT Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 67/78] ocfs2: fix panic on nfs server over ocfs2 Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 68/78] arm64: perf: Report the PC value in REGS_ABI_32 mode Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 69/78] tracing: Fix event trigger to accept redundant spaces Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 70/78] drm/radeon: fix fb_div check in ni_init_smc_spll_table() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 71/78] Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 72/78] sunrpc: fixed rollback in rpc_gssd_dummy_populate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 73/78] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 74/78] pNFS/flexfiles: Fix list corruption if the mirror count changes Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 75/78] NFSv4 fix CLOSE not waiting for direct IO compeletion Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 76/78] ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 77/78] xfs: add agf freeblocks verify in xfs_agf_verify Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 78/78] Linux 4.14.186-rc1 Sasha Levin
2020-06-30 7:19 ` [PATCH 4.14 00/78] 4.14.186-rc1 review Naresh Kamboju
2020-06-30 9:20 ` Jon Hunter
2020-06-30 13:08 ` Sebastian Gottschall
2020-06-30 17:21 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200629153806.2494953-14-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+d3eccef36ddbd02713e9@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).