lkml.org 
[lkml]   [2022]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 05/71] tipc: fix kernel panic when enabling bearer
    Date
    From: Tung Nguyen <tung.q.nguyen@dektech.com.au>

    [ Upstream commit be4977b847f5d5cedb64d50eaaf2218c3a55a3a3 ]

    When enabling a bearer on a node, a kernel panic is observed:

    [ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]
    ...
    [ 4.520030] Call Trace:
    [ 4.520689] <IRQ>
    [ 4.521236] tipc_link_build_proto_msg+0x375/0x750 [tipc]
    [ 4.522654] tipc_link_build_state_msg+0x48/0xc0 [tipc]
    [ 4.524034] __tipc_node_link_up+0xd7/0x290 [tipc]
    [ 4.525292] tipc_rcv+0x5da/0x730 [tipc]
    [ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0
    [ 4.527601] tipc_l2_rcv_msg+0x5e/0x90 [tipc]
    [ 4.528737] __netif_receive_skb_list_core+0x20b/0x260
    [ 4.530068] netif_receive_skb_list_internal+0x1bf/0x2e0
    [ 4.531450] ? dev_gro_receive+0x4c2/0x680
    [ 4.532512] napi_complete_done+0x6f/0x180
    [ 4.533570] virtnet_poll+0x29c/0x42e [virtio_net]
    ...

    The node in question is receiving activate messages in another
    thread after changing bearer status to allow message sending/
    receiving in current thread:

    thread 1 | thread 2
    -------- | --------
    |
    tipc_enable_bearer() |
    test_and_set_bit_lock() |
    tipc_bearer_xmit_skb() |
    | tipc_l2_rcv_msg()
    | tipc_rcv()
    | __tipc_node_link_up()
    | tipc_link_build_state_msg()
    | tipc_link_build_proto_msg()
    | tipc_mon_prep()
    | {
    | ...
    | // null-pointer dereference
    | u16 gen = mon->dom_gen;
    | ...
    | }
    // Not being executed yet |
    tipc_mon_create() |
    { |
    ... |
    // allocate |
    mon = kzalloc(); |
    ... |
    } |

    Monitoring pointer in thread 2 is dereferenced before monitoring data
    is allocated in thread 1. This causes kernel panic.

    This commit fixes it by allocating the monitoring data before enabling
    the bearer to receive messages.

    Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")
    Reported-by: Shuang Li <shuali@redhat.com>
    Acked-by: Jon Maloy <jmaloy@redhat.com>
    Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/tipc/bearer.c | 12 +++++++-----
    1 file changed, 7 insertions(+), 5 deletions(-)

    diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
    index 12e535b43d88..6911f1cab206 100644
    --- a/net/tipc/bearer.c
    +++ b/net/tipc/bearer.c
    @@ -342,16 +342,18 @@ static int tipc_enable_bearer(struct net *net, const char *name,
    goto rejected;
    }

    - test_and_set_bit_lock(0, &b->up);
    - rcu_assign_pointer(tn->bearer_list[bearer_id], b);
    - if (skb)
    - tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
    -
    + /* Create monitoring data before accepting activate messages */
    if (tipc_mon_create(net, bearer_id)) {
    bearer_disable(net, b);
    + kfree_skb(skb);
    return -ENOMEM;
    }

    + test_and_set_bit_lock(0, &b->up);
    + rcu_assign_pointer(tn->bearer_list[bearer_id], b);
    + if (skb)
    + tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
    +
    pr_info("Enabled bearer <%s>, priority %u\n", name, prio);

    return res;
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-03-14 13:05    [W:4.307 / U:0.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site