All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Jia He <justin.he@arm.com>,
	Stefano Garzarella <sgarzare@redhat.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 5.6 11/41] virtio_vsock: Fix race condition in virtio_transport_recv_pkt
Date: Tue,  9 Jun 2020 19:45:13 +0200	[thread overview]
Message-ID: <20200609174113.221123784@linuxfoundation.org> (raw)
In-Reply-To: <20200609174112.129412236@linuxfoundation.org>

From: Jia He <justin.he@arm.com>

[ Upstream commit 8692cefc433f282228fd44938dd4d26ed38254a2 ]

When client on the host tries to connect(SOCK_STREAM, O_NONBLOCK) to the
server on the guest, there will be a panic on a ThunderX2 (armv8a server):

[  463.718844] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  463.718848] Mem abort info:
[  463.718849]   ESR = 0x96000044
[  463.718852]   EC = 0x25: DABT (current EL), IL = 32 bits
[  463.718853]   SET = 0, FnV = 0
[  463.718854]   EA = 0, S1PTW = 0
[  463.718855] Data abort info:
[  463.718856]   ISV = 0, ISS = 0x00000044
[  463.718857]   CM = 0, WnR = 1
[  463.718859] user pgtable: 4k pages, 48-bit VAs, pgdp=0000008f6f6e9000
[  463.718861] [0000000000000000] pgd=0000000000000000
[  463.718866] Internal error: Oops: 96000044 [#1] SMP
[...]
[  463.718977] CPU: 213 PID: 5040 Comm: vhost-5032 Tainted: G           O      5.7.0-rc7+ #139
[  463.718980] Hardware name: GIGABYTE R281-T91-00/MT91-FS1-00, BIOS F06 09/25/2018
[  463.718982] pstate: 60400009 (nZCv daif +PAN -UAO)
[  463.718995] pc : virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[  463.718999] lr : virtio_transport_recv_pkt+0x1fc/0xd40 [vmw_vsock_virtio_transport_common]
[  463.719000] sp : ffff80002dbe3c40
[...]
[  463.719025] Call trace:
[  463.719030]  virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[  463.719034]  vhost_vsock_handle_tx_kick+0x360/0x408 [vhost_vsock]
[  463.719041]  vhost_worker+0x100/0x1a0 [vhost]
[  463.719048]  kthread+0x128/0x130
[  463.719052]  ret_from_fork+0x10/0x18

The race condition is as follows:
Task1                                Task2
=====                                =====
__sock_release                       virtio_transport_recv_pkt
  __vsock_release                      vsock_find_bound_socket (found sk)
    lock_sock_nested
    vsock_remove_sock
    sock_orphan
      sk_set_socket(sk, NULL)
    sk->sk_shutdown = SHUTDOWN_MASK
    ...
    release_sock
                                    lock_sock
                                       virtio_transport_recv_connecting
                                         sk->sk_socket->state (panic!)

The root cause is that vsock_find_bound_socket can't hold the lock_sock,
so there is a small race window between vsock_find_bound_socket() and
lock_sock(). If __vsock_release() is running in another task,
sk->sk_socket will be set to NULL inadvertently.

This fixes it by checking sk->sk_shutdown(suggested by Stefano) after
lock_sock since sk->sk_shutdown is set to SHUTDOWN_MASK under the
protection of lock_sock_nested.

Signed-off-by: Jia He <justin.he@arm.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/vmw_vsock/virtio_transport_common.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -1128,6 +1128,14 @@ void virtio_transport_recv_pkt(struct vi
 
 	lock_sock(sk);
 
+	/* Check if sk has been released before lock_sock */
+	if (sk->sk_shutdown == SHUTDOWN_MASK) {
+		(void)virtio_transport_reset_no_sock(t, pkt);
+		release_sock(sk);
+		sock_put(sk);
+		goto free_pkt;
+	}
+
 	/* Update CID in case it has changed after a transport reset event */
 	vsk->local_addr.svm_cid = dst.svm_cid;
 



  parent reply	other threads:[~2020-06-09 18:00 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-09 17:45 [PATCH 5.6 00/41] 5.6.18-rc1 review Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 01/41] devinet: fix memleak in inetdev_init() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 02/41] l2tp: add sk_family checks to l2tp_validate_socket Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 03/41] l2tp: do not use inet_hash()/inet_unhash() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 04/41] net: check untrusted gso_size at kernel entry Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 05/41] net/mlx5: Fix crash upon suspend/resume Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 06/41] net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 07/41] net: usb: qmi_wwan: add Telit LE910C1-EUX composition Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 08/41] NFC: st21nfca: add missed kfree_skb() in an error path Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 09/41] nfp: flower: fix used time of merge flow statistics Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 10/41] sctp: check assoc before SCTP_ADDR_{MADE_PRIM, ADDED} event Greg Kroah-Hartman
2020-06-09 17:45 ` Greg Kroah-Hartman [this message]
2020-06-09 17:45 ` [PATCH 5.6 12/41] vsock: fix timeout in vsock_accept() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 13/41] net: be more gentle about silly gso requests coming from user Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 14/41] net: dsa: felix: send VLANs on CPU port as egress-tagged Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 15/41] mptcp: fix unblocking connect() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 16/41] net/sched: fix infinite loop in sch_fq_pie Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 17/41] net/mlx5e: replace EINVAL in mlx5e_flower_parse_meta() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 18/41] USB: serial: qcserial: add DW5816e QDL support Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 19/41] USB: serial: usb_wwan: do not resubmit rx urb on fatal errors Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 20/41] USB: serial: option: add Telit LE910C1-EUX compositions Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 21/41] USB: serial: ch341: add basis for quirk detection Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 22/41] USB: serial: ch341: fix lockup of devices with limited prescaler Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 23/41] iio:chemical:sps30: Fix timestamp alignment Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 24/41] iio: vcnl4000: Fix i2c swapped word reading Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 25/41] iio:chemical:pms7003: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 26/41] iio: adc: stm32-adc: fix a wrong error message when probing interrupts Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 27/41] usb: musb: start session in resume for host port Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 28/41] usb: musb: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 29/41] serial: 8250: Enable 16550A variants by default on non-x86 Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 30/41] vt: keyboard: avoid signed integer overflow in k_ascii Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 31/41] tty: hvc_console, fix crashes on parallel open/close Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 32/41] staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 33/41] CDC-ACM: heed quirk also in error handling Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 34/41] nvmem: qfprom: remove incorrect write support Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 35/41] x86/cpu: Add a steppings field to struct x86_cpu_id Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 36/41] x86/cpu: Add table argument to cpu_matches() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 37/41] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 38/41] x86/speculation: Add SRBDS vulnerability and mitigation documentation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 39/41] x86/speculation: Add Ivy Bridge to affected list Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 40/41] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 5.6 41/41] Revert "net/mlx5: Annotate mutex destroy for root ns" Greg Kroah-Hartman
2020-06-10  6:32 ` [PATCH 5.6 00/41] 5.6.18-rc1 review Naresh Kamboju
     [not found] ` <20200609174112.129412236-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>
2020-06-10 11:30   ` Jon Hunter
2020-06-10 11:30     ` Jon Hunter
2020-06-10 13:51 ` Shuah Khan
2020-06-10 19:11 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200609174113.221123784@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=justin.he@arm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sgarzare@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.