Ziyang Xuan
44d8073200
net: qrtr: Fix a refcount bug in qrtr_recvmsg()
Syzbot reported a bug as following:
refcount_t: addition on 0; use-after-free.
...
RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
...
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
kref_get include/linux/kref.h:45 [inline]
qrtr_node_acquire net/qrtr/af_qrtr.c:202 [inline]
qrtr_node_lookup net/qrtr/af_qrtr.c:398 [inline]
qrtr_send_resume_tx net/qrtr/af_qrtr.c:1003 [inline]
qrtr_recvmsg+0x85f/0x990 net/qrtr/af_qrtr.c:1070
sock_recvmsg_nosec net/socket.c:1017 [inline]
sock_recvmsg+0xe2/0x160 net/socket.c:1038
qrtr_ns_worker+0x170/0x1700 net/qrtr/ns.c:688
process_one_work+0x991/0x15c0 kernel/workqueue.c:2390
worker_thread+0x669/0x1090 kernel/workqueue.c:2537
It occurs in the concurrent scenario of qrtr_recvmsg() and
qrtr_endpoint_unregister() as following:
cpu0 cpu1
qrtr_recvmsg qrtr_endpoint_unregister
qrtr_send_resume_tx qrtr_node_release
qrtr_node_lookup mutex_lock(&qrtr_node_lock)
spin_lock_irqsave(&qrtr_nodes_lock, ) refcount_dec_and_test(&node->ref) [node->ref == 0]
radix_tree_lookup [node != NULL] __qrtr_node_release
qrtr_node_acquire spin_lock_irqsave(&qrtr_nodes_lock, )
kref_get(&node->ref) [WARNING] ...
mutex_unlock(&qrtr_node_lock)
Use qrtr_node_lock to protect qrtr_node_lookup() implementation, this
is actually improving the protection of node reference.
Fixes: 0a7e0d0ef0 ("net: qrtr: Migrate node lookup tree to spinlock")
Reported-by: syzbot+a7492efaa5d61b51db23@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=a7492efaa5d61b51db23
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-31 09:18:30 +01:00
..
2023-03-01 08:52:49 -08:00
2022-12-25 13:38:09 -08:00
2022-10-28 20:13:54 -07:00
2022-11-24 17:12:15 +01:00
2022-11-16 13:31:03 +00:00
2023-01-21 19:01:59 +01:00
2023-03-23 13:09:38 -07:00
2023-03-06 11:15:54 -08:00
2023-02-22 21:25:23 -08:00
2023-03-02 22:22:07 -08:00
2023-03-27 14:40:45 +02:00
2023-02-21 18:24:12 -08:00
2023-03-23 16:03:33 -07:00
2023-01-20 09:33:22 +00:00
2023-02-10 19:53:42 -08:00
2023-02-20 11:38:35 +00:00
2022-11-01 10:04:52 -07:00
2023-03-30 11:32:46 -07:00
2022-12-07 20:02:44 -08:00
2023-02-21 09:05:01 -08:00
2023-03-16 21:11:03 -07:00
2023-03-17 09:13:53 +01:00
2023-03-21 21:16:26 -07:00
2023-03-21 21:16:26 -07:00
2023-03-16 17:34:40 -07:00
2023-01-23 11:26:50 +00:00
2023-02-13 09:30:14 +00:00
2023-02-20 09:25:20 +00:00
2023-03-30 11:19:53 +02:00
2023-02-20 16:40:52 -08:00
2023-01-28 00:26:09 -08:00
2023-02-15 10:26:37 +00:00
2023-03-10 21:42:56 -08:00
2023-03-16 17:41:28 +00:00
2023-03-08 12:26:42 +01:00
2023-02-09 22:30:24 -08:00
2023-01-30 07:30:47 +00:00
2023-03-07 13:37:05 -08:00
2023-02-23 17:55:40 -08:00
2023-02-15 10:25:21 +00:00
2023-01-23 11:26:50 +00:00
2023-03-31 09:18:30 +01:00
2023-02-13 09:33:39 +00:00
2023-02-14 12:21:14 +01:00
2023-01-28 00:19:57 -08:00
2023-02-21 18:24:12 -08:00
2023-03-16 21:25:45 -07:00
2023-02-23 12:59:40 -08:00
2023-03-15 08:15:19 +00:00
2023-03-25 13:32:43 -07:00
2023-02-21 18:24:12 -08:00
2023-03-06 13:26:16 -08:00
2023-03-08 23:26:03 -08:00
2023-03-31 08:58:13 +01:00
2023-03-17 13:31:16 -07:00
2023-01-25 09:51:04 +00:00
2023-03-16 16:02:55 +01:00
2023-03-16 17:23:48 -07:00
2022-11-25 13:01:55 -05:00
2023-01-05 22:12:00 -08:00
2023-03-08 23:26:51 -08:00