* KASAN: null-ptr-deref Write in queue_work_on @ 2019-08-21 22:38 syzbot 2020-01-14 14:32 ` [PATCH] can, slip: Protect tty->disc_data access with RCU Richard Palethorpe 0 siblings, 1 reply; 4+ messages in thread From: syzbot @ 2019-08-21 22:38 UTC (permalink / raw) To: davem, linux-can, linux-kernel, mkl, netdev, syzkaller-bugs, wg Hello, syzbot found the following crash on: HEAD commit: 6e625a1a Merge tag 'xtensa-20190816' of git://github.com/j.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=174e04ac600000 kernel config: https://syzkaller.appspot.com/x/.config?x=3ff364e429585cf2 dashboard link: https://syzkaller.appspot.com/bug?extid=017e491ae13c0068598a compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1327d9e2600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c4fc4c600000 Bisection is inconclusive: the first bad commit could be any of: 569dbb88 Linux 4.13 that is not the commit bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17520702600000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com ================================================================== BUG: KASAN: null-ptr-deref in test_and_set_bit include/asm-generic/bitops-instrumented.h:143 [inline] BUG: KASAN: null-ptr-deref in queue_work_on+0xa6/0x210 kernel/workqueue.c:1517 Write of size 8 at addr 0000000000000050 by task syz-executor935/9691 CPU: 0 PID: 9691 Comm: syz-executor935 Not tainted 5.3.0-rc4+ #113 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 __kasan_report.cold+0x5/0x36 mm/kasan/report.c:486 kasan_report+0x12/0x17 mm/kasan/common.c:612 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 __kasan_check_write+0x14/0x20 mm/kasan/common.c:98 test_and_set_bit include/asm-generic/bitops-instrumented.h:143 [inline] queue_work_on+0xa6/0x210 kernel/workqueue.c:1517 queue_work include/linux/workqueue.h:490 [inline] schedule_work include/linux/workqueue.h:548 [inline] slcan_write_wakeup+0x66/0x90 drivers/net/can/slcan.c:348 tty_wakeup+0xe9/0x120 drivers/tty/tty_io.c:535 pty_unthrottle+0x37/0x60 drivers/tty/pty.c:95 tty_unthrottle+0xab/0x110 drivers/tty/tty_ioctl.c:139 __tty_perform_flush+0x1b3/0x200 drivers/tty/tty_ioctl.c:861 n_tty_ioctl_helper+0x1cc/0x3b0 drivers/tty/tty_ioctl.c:937 n_tty_ioctl+0x59/0x370 drivers/tty/n_tty.c:2466 tty_ioctl+0xaf9/0x14f0 drivers/tty/tty_io.c:2666 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x446859 Code: e8 9c b4 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f17a0a3fd18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446859 RDX: 0000000000000000 RSI: 000000000000540b RDI: 0000000000000003 RBP: 00000000006dbc30 R08: 00007f17a0a40700 R09: 0000000000000000 R10: 00007f17a0a40700 R11: 0000000000000246 R12: 00000000006dbc3c R13: 00007ffdfd0bdb5f R14: 00007f17a0a409c0 R15: 20c49ba5e353f7cf ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] can, slip: Protect tty->disc_data access with RCU 2019-08-21 22:38 KASAN: null-ptr-deref Write in queue_work_on syzbot @ 2020-01-14 14:32 ` Richard Palethorpe 2020-01-14 15:17 ` Eric Dumazet 0 siblings, 1 reply; 4+ messages in thread From: Richard Palethorpe @ 2020-01-14 14:32 UTC (permalink / raw) To: linux-can Cc: Richard Palethorpe, syzbot+017e491ae13c0068598a, Wolfgang Grandegger, Marc Kleine-Budde, David S. Miller, Tyler Hall, netdev, linux-kernel, syzkaller write_wakeup can happen in parallel with close where tty->disc_data is set to NULL. So we a) need to check if tty->disc_data is NULL and b) ensure it is an atomic operation. Otherwise accessing tty->disc_data could result in a NULL pointer deref or access to some random location. This problem was found by Syzkaller on slcan, but the same issue appears to exist in slip where slcan was copied from. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> Cc: Wolfgang Grandegger <wg@grandegger.com> Cc: Marc Kleine-Budde <mkl@pengutronix.de> Cc: "David S. Miller" <davem@davemloft.net> Cc: Tyler Hall <tylerwhall@gmail.com> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com --- Note, that mabye RCU should also applied to receive_buf as that also happens in interrupt context. So if the pointer assignment is split by the compiler then sl may point somewhere unexpected? drivers/net/can/slcan.c | 11 +++++++++-- drivers/net/slip/slip.c | 11 +++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index 2e57122f02fb..ee029aae69d4 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -344,7 +344,14 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + rcu_read_unlock(); + + if (!sl) + return; schedule_work(&sl->tx_work); } @@ -644,7 +651,7 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 2a91c192659f..dfed9f0b8646 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,7 +452,14 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + rcu_read_unlock(); + + if (!sl) + return; schedule_work(&sl->tx_work); } @@ -882,7 +889,7 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); -- 2.24.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] can, slip: Protect tty->disc_data access with RCU 2020-01-14 14:32 ` [PATCH] can, slip: Protect tty->disc_data access with RCU Richard Palethorpe @ 2020-01-14 15:17 ` Eric Dumazet 2020-01-16 10:38 ` Richard Palethorpe 0 siblings, 1 reply; 4+ messages in thread From: Eric Dumazet @ 2020-01-14 15:17 UTC (permalink / raw) To: Richard Palethorpe, linux-can Cc: syzbot+017e491ae13c0068598a, Wolfgang Grandegger, Marc Kleine-Budde, David S. Miller, Tyler Hall, netdev, linux-kernel, syzkaller On 1/14/20 6:32 AM, Richard Palethorpe wrote: > write_wakeup can happen in parallel with close where tty->disc_data is set > to NULL. So we a) need to check if tty->disc_data is NULL and b) ensure it > is an atomic operation. Otherwise accessing tty->disc_data could result in > a NULL pointer deref or access to some random location. > > This problem was found by Syzkaller on slcan, but the same issue appears to > exist in slip where slcan was copied from. > > A fix which didn't use RCU was posted by Hillf Danton. > > Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") > Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") > Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com > Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> > Cc: Wolfgang Grandegger <wg@grandegger.com> > Cc: Marc Kleine-Budde <mkl@pengutronix.de> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Tyler Hall <tylerwhall@gmail.com> > Cc: netdev@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: syzkaller@googlegroups.com > --- > > Note, that mabye RCU should also applied to receive_buf as that also happens > in interrupt context. So if the pointer assignment is split by the compiler > then sl may point somewhere unexpected? > > drivers/net/can/slcan.c | 11 +++++++++-- > drivers/net/slip/slip.c | 11 +++++++++-- > 2 files changed, 18 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c > index 2e57122f02fb..ee029aae69d4 100644 > --- a/drivers/net/can/slcan.c > +++ b/drivers/net/can/slcan.c > @@ -344,7 +344,14 @@ static void slcan_transmit(struct work_struct *work) > */ > static void slcan_write_wakeup(struct tty_struct *tty) > { > - struct slcan *sl = tty->disc_data; > + struct slcan *sl; > + > + rcu_read_lock(); > + sl = rcu_dereference(tty->disc_data); > + rcu_read_unlock(); This rcu_read_lock()/rcu_read_unlock() pair is not protecting anything. Right after rcu_read_unlock(), sl validity can not be guaranteed. > + > + if (!sl) > + return; > > schedule_work(&sl->tx_work); > } > @@ -644,7 +651,7 @@ static void slcan_close(struct tty_struct *tty) > return; > > spin_lock_bh(&sl->lock); > - tty->disc_data = NULL; > + rcu_assign_pointer(tty->disc_data, NULL); > sl->tty = NULL; > spin_unlock_bh(&sl->lock); Where is the rcu grace period before freeing enforced ? > > diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c > index 2a91c192659f..dfed9f0b8646 100644 > --- a/drivers/net/slip/slip.c > +++ b/drivers/net/slip/slip.c > @@ -452,7 +452,14 @@ static void slip_transmit(struct work_struct *work) > */ > static void slip_write_wakeup(struct tty_struct *tty) > { > - struct slip *sl = tty->disc_data; > + struct slip *sl; > + > + rcu_read_lock(); > + sl = rcu_dereference(tty->disc_data); > + rcu_read_unlock(); Same here. > + > + if (!sl) > + return; > > schedule_work(&sl->tx_work); > } > @@ -882,7 +889,7 @@ static void slip_close(struct tty_struct *tty) > return; > > spin_lock_bh(&sl->lock); > - tty->disc_data = NULL; > + rcu_assign_pointer(tty->disc_data, NULL); > sl->tty = NULL; > spin_unlock_bh(&sl->lock); > > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] can, slip: Protect tty->disc_data access with RCU 2020-01-14 15:17 ` Eric Dumazet @ 2020-01-16 10:38 ` Richard Palethorpe 0 siblings, 0 replies; 4+ messages in thread From: Richard Palethorpe @ 2020-01-16 10:38 UTC (permalink / raw) To: Eric Dumazet Cc: Richard Palethorpe, linux-can, syzbot+017e491ae13c0068598a, Wolfgang Grandegger, Marc Kleine-Budde, David S. Miller, Tyler Hall, netdev, linux-kernel, syzkaller Eric Dumazet <eric.dumazet@gmail.com> writes: > On 1/14/20 6:32 AM, Richard Palethorpe wrote: >> write_wakeup can happen in parallel with close where tty->disc_data is set >> to NULL. So we a) need to check if tty->disc_data is NULL and b) ensure it >> is an atomic operation. Otherwise accessing tty->disc_data could result in >> a NULL pointer deref or access to some random location. >> >> This problem was found by Syzkaller on slcan, but the same issue appears to >> exist in slip where slcan was copied from. >> >> A fix which didn't use RCU was posted by Hillf Danton. >> >> Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") >> Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") >> Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com >> Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> >> Cc: Wolfgang Grandegger <wg@grandegger.com> >> Cc: Marc Kleine-Budde <mkl@pengutronix.de> >> Cc: "David S. Miller" <davem@davemloft.net> >> Cc: Tyler Hall <tylerwhall@gmail.com> >> Cc: netdev@vger.kernel.org >> Cc: linux-kernel@vger.kernel.org >> Cc: syzkaller@googlegroups.com >> --- >> >> Note, that mabye RCU should also applied to receive_buf as that also happens >> in interrupt context. So if the pointer assignment is split by the compiler >> then sl may point somewhere unexpected? >> >> drivers/net/can/slcan.c | 11 +++++++++-- >> drivers/net/slip/slip.c | 11 +++++++++-- >> 2 files changed, 18 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c >> index 2e57122f02fb..ee029aae69d4 100644 >> --- a/drivers/net/can/slcan.c >> +++ b/drivers/net/can/slcan.c >> @@ -344,7 +344,14 @@ static void slcan_transmit(struct work_struct *work) >> */ >> static void slcan_write_wakeup(struct tty_struct *tty) >> { >> - struct slcan *sl = tty->disc_data; >> + struct slcan *sl; >> + >> + rcu_read_lock(); >> + sl = rcu_dereference(tty->disc_data); >> + rcu_read_unlock(); > > This rcu_read_lock()/rcu_read_unlock() pair is not protecting anything. > > Right after rcu_read_unlock(), sl validity can not be guaranteed. > >> + >> + if (!sl) >> + return; >> >> schedule_work(&sl->tx_work); >> } >> @@ -644,7 +651,7 @@ static void slcan_close(struct tty_struct *tty) >> return; >> >> spin_lock_bh(&sl->lock); >> - tty->disc_data = NULL; >> + rcu_assign_pointer(tty->disc_data, NULL); >> sl->tty = NULL; >> spin_unlock_bh(&sl->lock); > > > > Where is the rcu grace period before freeing enforced ? > Sorry that was dumb. I have respun the patch so it now schedules the work inside the RCU read lock and it synchronises before freeing the netdev. However sparse complains about the address space of the pointer. I guess if disc_data is to be protected by RCU then it should be marked as such... I suppose that at least the access in slip/slcan_receive_buf should also be protected by RCU? It seems like disc_data could be freed from underneath it by close. At any rate below is the updated patch FYI. -- >8 -- Subject: [PATCH v2] can, slip: Protect tty->disc_data access with RCU write_wakeup can happen in parallel with close where tty->disc_data is set to NULL. So we a) need to check if tty->disc_data is NULL and b) ensure it is an atomic operation. Otherwise accessing tty->disc_data could result in a NULL pointer deref or access to some random location. This problem was found by Syzkaller on slcan, but the same issue appears to exist in slip where slcan was copied from. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> Cc: Wolfgang Grandegger <wg@grandegger.com> Cc: Marc Kleine-Budde <mkl@pengutronix.de> Cc: "David S. Miller" <davem@davemloft.net> Cc: Tyler Hall <tylerwhall@gmail.com> Cc: linux-can@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com --- drivers/net/can/slcan.c | 12 ++++++++++-- drivers/net/slip/slip.c | 12 ++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index 2e57122f02fb..2f5c287eac95 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -344,9 +344,16 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } /* Send a can_frame to a TTY queue. */ @@ -644,10 +651,11 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* Flush network side */ diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 2a91c192659f..61d7e0d1d77d 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } static void sl_tx_timeout(struct net_device *dev) @@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* VSV = very important to remove timers */ -- 2.24.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-01-16 10:38 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-08-21 22:38 KASAN: null-ptr-deref Write in queue_work_on syzbot 2020-01-14 14:32 ` [PATCH] can, slip: Protect tty->disc_data access with RCU Richard Palethorpe 2020-01-14 15:17 ` Eric Dumazet 2020-01-16 10:38 ` Richard Palethorpe
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).