From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jakub Sitnicki <jakub@cloudflare.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org, bpf@vger.kernel.org
Subject: [PATCH AUTOSEL 4.20 29/81] sk_msg: Always cancel strp work before freeing the psock
Date: Thu, 28 Feb 2019 10:07:21 -0500 [thread overview]
Message-ID: <20190228150813.10256-29-sashal@kernel.org> (raw)
In-Reply-To: <20190228150813.10256-1-sashal@kernel.org>
From: Jakub Sitnicki <jakub@cloudflare.com>
[ Upstream commit 1d79895aef18fa05789995d86d523c9b2ee58a02 ]
Despite having stopped the parser, we still need to deinitialize it
by calling strp_done so that it cancels its work. Otherwise the worker
thread can run after we have freed the parser, and attempt to access
its workqueue resulting in a use-after-free:
==================================================================
BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0
Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93
CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
Workqueue: (null) (kstrp)
Call Trace:
print_address_description+0x6e/0x2b0
? pwq_activate_delayed_work+0x1b/0x1d0
kasan_report+0xfd/0x177
? pwq_activate_delayed_work+0x1b/0x1d0
? pwq_activate_delayed_work+0x1b/0x1d0
pwq_activate_delayed_work+0x1b/0x1d0
? process_one_work+0x4aa/0x660
pwq_dec_nr_in_flight+0x9b/0x100
worker_thread+0x82/0x680
? process_one_work+0x660/0x660
kthread+0x1b9/0x1e0
? __kthread_create_on_node+0x250/0x250
ret_from_fork+0x1f/0x30
Allocated by task 111:
sk_psock_init+0x3c/0x1b0
sock_map_link.isra.2+0x103/0x4b0
sock_map_update_common+0x94/0x270
sock_map_update_elem+0x145/0x160
__se_sys_bpf+0x152e/0x1e10
do_syscall_64+0xb2/0x3e0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 112:
kfree+0x7f/0x140
process_one_work+0x40b/0x660
worker_thread+0x82/0x680
kthread+0x1b9/0x1e0
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888069975180
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 192 bytes inside of
512-byte region [ffff888069975180, ffff888069975380)
The buggy address belongs to the page:
page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Reported-by: Marek Majkowski <marek@cloudflare.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skmsg.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 54d8548076306..4932861d7b882 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc)
struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
/* No sk_callback_lock since already detached. */
- if (psock->parser.enabled)
- strp_done(&psock->parser.strp);
+ strp_done(&psock->parser.strp);
cancel_work_sync(&psock->work);
--
2.19.1
next prev parent reply other threads:[~2019-02-28 15:32 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-28 15:06 [PATCH AUTOSEL 4.20 01/81] ARM: OMAP: dts: N950/N9: fix onenand timings Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 02/81] ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 03/81] ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2 Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 04/81] arm: dts: meson: Fix IRQ trigger type for macirq Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 05/81] ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 06/81] ARM: dts: meson8b: ec100: " Sasha Levin
2019-02-28 15:06 ` [PATCH AUTOSEL 4.20 07/81] ARM: dts: meson8m2: mxiii-plus: " Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 08/81] signal: Make siginmask safe when passed a signal of 0 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 09/81] ARM: dts: imx6sx: correct backward compatible of gpt Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 10/81] arm64: dts: renesas: r8a7796: Enable DMA for SCIF2 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 11/81] arm64: dts: renesas: r8a77965: " Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 12/81] soc: fsl: qbman: avoid race in clearing QMan interrupt Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 13/81] pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 14/81] wlcore: sdio: Fixup power on/off sequence Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 15/81] bpftool: Fix prog dump by tag Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 16/81] bpftool: fix percpu maps updating Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 17/81] bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt() Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 18/81] ARM: pxa: ssp: unneeded to free devm_ allocated data Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 19/81] ARM: dts: omap3-gta04: Fix graph_port warning Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 20/81] ARM: dts: n900: fix mmc1 card detect gpio polarity Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 21/81] ARM: dts: am335x-shc.dts: fix wrong cd pin level Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 22/81] arm64: dts: add msm8996 compatible to gicv3 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 23/81] batman-adv: release station info tidstats Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 24/81] MIPS: DTS: jz4740: Correct interrupt number of DMA core Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 25/81] DTS: CI20: Fix bugs in ci20's device tree Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 26/81] usb: phy: fix link errors Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 27/81] usb: dwc3: exynos: Fix error handling of clk_prepare_enable Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 28/81] irqchip/gic-v4: Fix occasional VLPI drop Sasha Levin
2019-02-28 15:07 ` Sasha Levin [this message]
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 30/81] irqchip/gic-v3-its: Gracefully fail on LPI exhaustion Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 31/81] irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 32/81] drm/amdgpu: Add missing power attribute to APU check Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 33/81] drm/radeon: check if device is root before getting pci speed caps Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 34/81] debugfs: return error values, not NULL Sasha Levin
2019-02-28 15:25 ` Greg Kroah-Hartman
2019-03-11 17:22 ` Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 35/81] debugfs: debugfs_lookup() should return NULL if not found Sasha Levin
2019-02-28 15:25 ` Greg Kroah-Hartman
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 36/81] binder: fix CONFIG_ANDROID_BINDER_DEVICES Sasha Levin
2019-02-28 15:24 ` Greg Kroah-Hartman
2019-03-11 17:23 ` Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 37/81] drm/amdgpu: Transfer fences to dmabuf importer Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 38/81] net: stmmac: Fallback to Platform Data clock in Watchdog conversion Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 39/81] net: stmmac: Send TSO packets always from Queue 0 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 40/81] net: stmmac: Disable EEE mode earlier in XMIT callback Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 41/81] irqchip/gic-v3-its: Fix ITT_entry_size accessor Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 42/81] relay: check return of create_buf_file() properly Sasha Levin
2019-02-28 15:26 ` Greg Kroah-Hartman
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 43/81] blk-mq: protect debugfs_create_files() from failures Sasha Levin
2019-02-28 15:26 ` Greg Kroah-Hartman
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 44/81] ath10k: correct bus type for WCN3990 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 45/81] bpf, selftests: fix handling of sparse CPU allocations Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 46/81] bpf: run bpf programs with preemption disabled Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 47/81] bpf: fix lockdep false positive in percpu_freelist Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 48/81] bpf: fix potential deadlock in bpf_prog_register Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 49/81] bpf: Fix syscall's stackmap lookup potential deadlock Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 50/81] drm/amdgpu: Implement doorbell self-ring for NBIO 7.4 Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 51/81] drm/amdgpu: fix the incorrect external id for raven series Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 52/81] drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 53/81] dmaengine: at_xdmac: Fix wrongfull report of a channel as in use Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 54/81] vsock/virtio: fix kernel panic after device hot-unplug Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 55/81] vsock/virtio: reset connected sockets on device removal Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 56/81] dmaengine: dmatest: Abort test in case of mapping error Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 57/81] selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 58/81] selftests: netfilter: add simple masq/redirect test cases Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 59/81] netfilter: nf_nat: skip nat clash resolution for same-origin entries Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 60/81] arm64: ptdump: Don't iterate kernel page tables using PTRS_PER_PXX Sasha Levin
2019-02-28 15:14 ` Will Deacon
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 61/81] s390/qeth: release cmd buffer in error paths Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 62/81] s390/qeth: fix use-after-free in error path Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 63/81] s390/qeth: cancel close_dev work before removing a card Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 64/81] s390/qeth: conclude all event processing before offlining " Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 65/81] perf symbols: Filter out hidden symbols from labels Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 66/81] perf trace: Support multiple "vfs_getname" probes Sasha Levin
2019-02-28 15:07 ` [PATCH AUTOSEL 4.20 67/81] MIPS: Loongson: Introduce and use loongson_llsc_mb() Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 68/81] MIPS: Remove function size check in get_frame_info() Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 69/81] Revert "scsi: libfc: Add WARN_ON() when deleting rports" Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 70/81] i2c: omap: Use noirq system sleep pm ops to idle device for suspend Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 71/81] drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 72/81] drm/omap: dsi: Fix crash in DSI debug dumps Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 73/81] drm/omap: dsi: Fix OF platform depopulate Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 74/81] drm/omap: dsi: Hack-fix DSI bus flags Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 75/81] nvme: lock NS list changes while handling command effects Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 76/81] nvme-pci: fix rapid add remove sequence Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 77/81] fs: ratelimit __find_get_block_slow() failure message Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 78/81] qed: Fix EQ full firmware assert Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 79/81] qed: Consider TX tcs while deriving the max num_queues for PF Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 80/81] qede: Fix system crash on configuring channels Sasha Levin
2019-02-28 15:08 ` [PATCH AUTOSEL 4.20 81/81] blk-iolatency: fix IO hang due to negative inflight counter Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190228150813.10256-29-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=jakub@cloudflare.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).