mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
e4d32142d1de8bcafd90ea5f4f557104f0969c41
linux/net/sched
History
Dmitry Antipov b22db8b8be net: sched: use RCU read-side critical section in taprio_dump() 
Fix possible use-after-free in 'taprio_dump()' by adding RCU
read-side critical section there. Never seen on x86 but
found on a KASAN-enabled arm64 system when investigating
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:

[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
[T15862]
[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
[T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
[T15862] Call trace:
[T15862]  dump_backtrace+0x20c/0x220
[T15862]  show_stack+0x2c/0x40
[T15862]  dump_stack_lvl+0xf8/0x174
[T15862]  print_report+0x170/0x4d8
[T15862]  kasan_report+0xb8/0x1d4
[T15862]  __asan_report_load4_noabort+0x20/0x2c
[T15862]  taprio_dump+0xa0c/0xbb0
[T15862]  tc_fill_qdisc+0x540/0x1020
[T15862]  qdisc_notify.isra.0+0x330/0x3a0
[T15862]  tc_modify_qdisc+0x7b8/0x1838
[T15862]  rtnetlink_rcv_msg+0x3c8/0xc20
[T15862]  netlink_rcv_skb+0x1f8/0x3d4
[T15862]  rtnetlink_rcv+0x28/0x40
[T15862]  netlink_unicast+0x51c/0x790
[T15862]  netlink_sendmsg+0x79c/0xc20
[T15862]  __sock_sendmsg+0xe0/0x1a0
[T15862]  ____sys_sendmsg+0x6c0/0x840
[T15862]  ___sys_sendmsg+0x1ac/0x1f0
[T15862]  __sys_sendmsg+0x110/0x1d0
[T15862]  __arm64_sys_sendmsg+0x74/0xb0
[T15862]  invoke_syscall+0x88/0x2e0
[T15862]  el0_svc_common.constprop.0+0xe4/0x2a0
[T15862]  do_el0_svc+0x44/0x60
[T15862]  el0_svc+0x50/0x184
[T15862]  el0t_64_sync_handler+0x120/0x12c
[T15862]  el0t_64_sync+0x190/0x194
[T15862]
[T15862] Allocated by task 15857:
[T15862]  kasan_save_stack+0x3c/0x70
[T15862]  kasan_save_track+0x20/0x3c
[T15862]  kasan_save_alloc_info+0x40/0x60
[T15862]  __kasan_kmalloc+0xd4/0xe0
[T15862]  __kmalloc_cache_noprof+0x194/0x334
[T15862]  taprio_change+0x45c/0x2fe0
[T15862]  tc_modify_qdisc+0x6a8/0x1838
[T15862]  rtnetlink_rcv_msg+0x3c8/0xc20
[T15862]  netlink_rcv_skb+0x1f8/0x3d4
[T15862]  rtnetlink_rcv+0x28/0x40
[T15862]  netlink_unicast+0x51c/0x790
[T15862]  netlink_sendmsg+0x79c/0xc20
[T15862]  __sock_sendmsg+0xe0/0x1a0
[T15862]  ____sys_sendmsg+0x6c0/0x840
[T15862]  ___sys_sendmsg+0x1ac/0x1f0
[T15862]  __sys_sendmsg+0x110/0x1d0
[T15862]  __arm64_sys_sendmsg+0x74/0xb0
[T15862]  invoke_syscall+0x88/0x2e0
[T15862]  el0_svc_common.constprop.0+0xe4/0x2a0
[T15862]  do_el0_svc+0x44/0x60
[T15862]  el0_svc+0x50/0x184
[T15862]  el0t_64_sync_handler+0x120/0x12c
[T15862]  el0t_64_sync+0x190/0x194
[T15862]
[T15862] Freed by task 6192:
[T15862]  kasan_save_stack+0x3c/0x70
[T15862]  kasan_save_track+0x20/0x3c
[T15862]  kasan_save_free_info+0x4c/0x80
[T15862]  poison_slab_object+0x110/0x160
[T15862]  __kasan_slab_free+0x3c/0x74
[T15862]  kfree+0x134/0x3c0
[T15862]  taprio_free_sched_cb+0x18c/0x220
[T15862]  rcu_core+0x920/0x1b7c
[T15862]  rcu_core_si+0x10/0x1c
[T15862]  handle_softirqs+0x2e8/0xd64
[T15862]  __do_softirq+0x14/0x20

Fixes: 18cdd2f099 ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-10-23 13:26:15 +02:00
..
act_api.c
net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers
2024-10-23 11:31:27 +02:00
act_bpf.c
net: Rename mono_delivery_time to tstamp_type for scalabilty
2024-05-23 14:14:23 -07:00
act_connmark.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_csum.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_ct.c
sched: act_ct: avoid -Wflex-array-member-not-at-end warning
2024-08-12 17:54:24 -07:00
act_ctinfo.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_gact.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_gate.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_ife.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_meta_mark.c
…
act_meta_skbprio.c
…
act_meta_skbtcindex.c
…
act_mirred.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-02-22 15:29:26 -08:00
act_mpls.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_nat.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_pedit.c
net: sched: Annotate struct tc_pedit with __counted_by
2024-02-19 10:58:24 +00:00
act_police.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_sample.c
net: sched: act_sample: add action cookie to sample
2024-07-05 17:45:47 -07:00
act_simple.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_skbedit.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
act_skbmod.c
net/sched: act_skbmod: convert comma to semicolon
2024-07-11 17:12:15 -07:00
act_tunnel_key.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
act_vlan.c
tc: adjust network header after 2nd vlan push
2024-08-27 11:37:42 +02:00
cls_api.c
net: sched: cls_api: fix slab-use-after-free in fl_dump_key
2024-04-10 08:28:26 +01:00
cls_basic.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_bpf.c
net: Rename mono_delivery_time to tstamp_type for scalabilty
2024-05-23 14:14:23 -07:00
cls_cgroup.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_flow.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_flower.c
net/sched: cls_flower: propagate tca[TCA_OPTIONS] to NL_REQ_ATTR_CHECK
2024-07-15 09:14:39 -07:00
cls_fw.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_matchall.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_route.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
cls_u32.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
em_canid.c
net: fill in MODULE_DESCRIPTION()s for net/sched
2024-02-09 14:12:02 -08:00
em_cmp.c
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
em_ipset.c
sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-03 14:34:53 -07:00
em_ipt.c
sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-03 14:34:53 -07:00
em_meta.c
net: fill in MODULE_DESCRIPTION()s for net/sched
2024-02-09 14:12:02 -08:00
em_nbyte.c
net: fill in MODULE_DESCRIPTION()s for net/sched
2024-02-09 14:12:02 -08:00
em_text.c
net: fill in MODULE_DESCRIPTION()s for net/sched
2024-02-09 14:12:02 -08:00
em_u32.c
net: fill in MODULE_DESCRIPTION()s for net/sched
2024-02-09 14:12:02 -08:00
ematch.c
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
2022-12-19 09:43:18 +00:00
Kconfig
net: sched: Remove NET_ACT_IPT from Kconfig
2024-02-13 11:24:35 +01:00
Makefile
net/sched: Retire ipt action
2024-01-02 12:41:16 +00:00
sch_api.c
net/sched: accept TCA_STAB only for root qdisc
2024-10-08 15:38:56 -07:00
sch_blackhole.c
Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"
2020-07-16 16:48:34 -07:00
sch_cake.c
sch_cake: constify inverse square root cache
2024-09-10 18:31:52 -07:00
sch_cbs.c
net_sched: sch_cbs: implement lockless cbs_dump()
2024-04-19 11:34:07 +01:00
sch_choke.c
net_sched: sch_choke: implement lockless choke_dump()
2024-04-19 11:34:07 +01:00
sch_codel.c
net_sched: sch_codel: implement lockless codel_dump()
2024-04-19 11:34:07 +01:00
sch_drr.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_etf.c
net_sched: sch_tfs: implement lockless etf_dump()
2024-04-19 11:34:07 +01:00
sch_ets.c
net_sched: sch_ets: implement lockless ets_dump()
2024-04-19 11:34:07 +01:00
sch_fifo.c
net_sched: sch_fifo: implement lockless __fifo_dump()
2024-04-19 11:34:07 +01:00
sch_fq_codel.c
net_sched: sch_fq_codel: implement lockless fq_codel_dump()
2024-04-19 11:34:07 +01:00
sch_fq_pie.c
net_sched: sch_fq_pie: implement lockless fq_pie_dump()
2024-04-19 11:34:07 +01:00
sch_fq.c
net_sched: sch_fq: fix incorrect behavior for small weights
2024-08-27 08:20:45 -07:00
sch_frag.c
net: dst: remove unnecessary input parameter in dst_alloc and dst_init
2023-09-12 11:42:25 +02:00
sch_generic.c
net: fix races in netdev_tx_sent_queue()/dev_watchdog()
2024-10-21 12:54:25 +02:00
sch_gred.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_hfsc.c
net_sched: sch_hfsc: implement lockless accesses to q->defcls
2024-04-19 11:34:08 +01:00
sch_hhf.c
net_sched: sch_hhf: implement lockless hhf_dump()
2024-04-19 11:34:08 +01:00
sch_htb.c
net/sched: fix false lockdep warning on qdisc root lock
2024-04-26 10:46:41 +02:00
sch_ingress.c
bpf: Fix too early release of tcx_entry
2024-07-08 14:07:31 -07:00
sch_mq.c
net: sched: add rcu annotations around qdisc->qdisc_sleeping
2023-06-07 10:25:39 +01:00
sch_mqprio_lib.c
net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs
2023-11-01 21:49:09 -07:00
sch_mqprio_lib.h
net/sched: mqprio: allow per-TC user input of FP adminStatus
2023-04-13 22:22:10 -07:00
sch_mqprio.c
netlink: introduce type-checking attribute iteration
2024-03-29 15:06:02 -07:00
sch_multiq.c
net: sched: sch_multiq: fix possible OOB write in multiq_tune()
2024-06-05 10:50:19 +01:00
sch_netem.c
sch/netem: fix use after free in netem_dequeue
2024-09-03 11:44:23 -07:00
sch_pie.c
net_sched: sch_pie: implement lockless pie_dump()
2024-04-19 11:34:08 +01:00
sch_plug.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_prio.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_qfq.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_red.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_sfb.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_sfq.c
net_sched: sch_sfq: annotate data-races around q->perturb_period
2024-05-02 19:01:35 -07:00
sch_skbprio.c
net_sched: sch_skbprio: implement lockless skbprio_dump()
2024-04-19 11:34:08 +01:00
sch_taprio.c
net: sched: use RCU read-side critical section in taprio_dump()
2024-10-23 13:26:15 +02:00
sch_tbf.c
net/sched: Add module aliases for cls_,sch_,act_ modules
2024-02-02 10:57:55 -08:00
sch_teql.c
net: annotate writes on dev->mtu from ndo_change_mtu()
2024-05-07 16:19:14 -07:00