Dmitry Antipov b22db8b8be net: sched: use RCU read-side critical section in taprio_dump() ... Fix possible use-after-free in 'taprio_dump()' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigating https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa: [T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0 [T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862 [T15862] [T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2 [T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024 [T15862] Call trace: [T15862] dump_backtrace+0x20c/0x220 [T15862] show_stack+0x2c/0x40 [T15862] dump_stack_lvl+0xf8/0x174 [T15862] print_report+0x170/0x4d8 [T15862] kasan_report+0xb8/0x1d4 [T15862] __asan_report_load4_noabort+0x20/0x2c [T15862] taprio_dump+0xa0c/0xbb0 [T15862] tc_fill_qdisc+0x540/0x1020 [T15862] qdisc_notify.isra.0+0x330/0x3a0 [T15862] tc_modify_qdisc+0x7b8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Allocated by task 15857: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_alloc_info+0x40/0x60 [T15862] __kasan_kmalloc+0xd4/0xe0 [T15862] __kmalloc_cache_noprof+0x194/0x334 [T15862] taprio_change+0x45c/0x2fe0 [T15862] tc_modify_qdisc+0x6a8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Freed by task 6192: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_free_info+0x4c/0x80 [T15862] poison_slab_object+0x110/0x160 [T15862] __kasan_slab_free+0x3c/0x74 [T15862] kfree+0x134/0x3c0 [T15862] taprio_free_sched_cb+0x18c/0x220 [T15862] rcu_core+0x920/0x1b7c [T15862] rcu_core_si+0x10/0x1c [T15862] handle_softirqs+0x2e8/0xd64 [T15862] __do_softirq+0x14/0x20 Fixes: 18cdd2f099 ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex") Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2024-10-23 13:26:15 +02:00
..
act_api.c	net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers	2024-10-23 11:31:27 +02:00
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c	sched: act_ct: avoid -Wflex-array-member-not-at-end warning	2024-08-12 17:54:24 -07:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c
act_mpls.c
act_nat.c
act_pedit.c
act_police.c
act_sample.c	net: sched: act_sample: add action cookie to sample	2024-07-05 17:45:47 -07:00
act_simple.c
act_skbedit.c
act_skbmod.c	net/sched: act_skbmod: convert comma to semicolon	2024-07-11 17:12:15 -07:00
act_tunnel_key.c
act_vlan.c	tc: adjust network header after 2nd vlan push	2024-08-27 11:37:42 +02:00
cls_api.c
cls_basic.c
cls_bpf.c
cls_cgroup.c
cls_flow.c
cls_flower.c	net/sched: cls_flower: propagate tca[TCA_OPTIONS] to NL_REQ_ATTR_CHECK	2024-07-15 09:14:39 -07:00
cls_fw.c
cls_matchall.c
cls_route.c
cls_u32.c
em_canid.c
em_cmp.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
em_ipset.c
em_ipt.c
em_meta.c
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c	net/sched: accept TCA_STAB only for root qdisc	2024-10-08 15:38:56 -07:00
sch_blackhole.c
sch_cake.c	sch_cake: constify inverse square root cache	2024-09-10 18:31:52 -07:00
sch_cbs.c
sch_choke.c
sch_codel.c
sch_drr.c
sch_etf.c
sch_ets.c
sch_fifo.c
sch_fq.c	net_sched: sch_fq: fix incorrect behavior for small weights	2024-08-27 08:20:45 -07:00
sch_fq_codel.c
sch_fq_pie.c
sch_frag.c
sch_generic.c	net: fix races in netdev_tx_sent_queue()/dev_watchdog()	2024-10-21 12:54:25 +02:00
sch_gred.c
sch_hfsc.c
sch_hhf.c
sch_htb.c
sch_ingress.c	bpf: Fix too early release of tcx_entry	2024-07-08 14:07:31 -07:00
sch_mq.c
sch_mqprio.c
sch_mqprio_lib.c
sch_mqprio_lib.h
sch_multiq.c	net: sched: sch_multiq: fix possible OOB write in multiq_tune()	2024-06-05 10:50:19 +01:00
sch_netem.c	sch/netem: fix use after free in netem_dequeue	2024-09-03 11:44:23 -07:00
sch_pie.c
sch_plug.c
sch_prio.c
sch_qfq.c
sch_red.c
sch_sfb.c
sch_sfq.c
sch_skbprio.c
sch_taprio.c	net: sched: use RCU read-side critical section in taprio_dump()	2024-10-23 13:26:15 +02:00
sch_tbf.c
sch_teql.c