OpenCloudOS-Kernel/net/rxrpc
David Howells 65550098c1 rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
There's a race between rxrpc_sendmsg setting up a call, but then failing to
send anything on it due to an error, and recvmsg() seeing the call
completion occur and trying to return the state to the user.

An assertion fails in rxrpc_recvmsg() because the call has already been
released from the socket and is about to be released again as recvmsg deals
with it.  (The recvmsg_q queue on the socket holds a ref, so there's no
problem with use-after-free.)

We also have to be careful not to end up reporting an error twice, in such
a way that both returns indicate to userspace that the user ID supplied
with the call is no longer in use - which could cause the client to
malfunction if it recycles the user ID fast enough.

Fix this by the following means:

 (1) When sendmsg() creates a call after the point that the call has been
     successfully added to the socket, don't return any errors through
     sendmsg(), but rather complete the call and let recvmsg() retrieve
     them.  Make sendmsg() return 0 at this point.  Further calls to
     sendmsg() for that call will fail with ESHUTDOWN.

     Note that at this point, we haven't send any packets yet, so the
     server doesn't yet know about the call.

 (2) If sendmsg() returns an error when it was expected to create a new
     call, it means that the user ID wasn't used.

 (3) Mark the call disconnected before marking it completed to prevent an
     oops in rxrpc_release_call().

 (4) recvmsg() will then retrieve the error and set MSG_EOR to indicate
     that the user ID is no longer known by the kernel.

An oops like the following is produced:

	kernel BUG at net/rxrpc/recvmsg.c:605!
	...
	RIP: 0010:rxrpc_recvmsg+0x256/0x5ae
	...
	Call Trace:
	 ? __init_waitqueue_head+0x2f/0x2f
	 ____sys_recvmsg+0x8a/0x148
	 ? import_iovec+0x69/0x9c
	 ? copy_msghdr_from_user+0x5c/0x86
	 ___sys_recvmsg+0x72/0xaa
	 ? __fget_files+0x22/0x57
	 ? __fget_light+0x46/0x51
	 ? fdget+0x9/0x1b
	 do_recvmmsg+0x15e/0x232
	 ? _raw_spin_unlock+0xa/0xb
	 ? vtime_delta+0xf/0x25
	 __x64_sys_recvmmsg+0x2c/0x2f
	 do_syscall_64+0x4c/0x78
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 357f5ef646 ("rxrpc: Call rxrpc_release_call() on error in rxrpc_new_client_call()")
Reported-by: syzbot+b54969381df354936d96@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-30 16:50:20 -07:00
..
Kconfig docs: networking: convert rxrpc.txt to ReST 2020-04-30 12:56:38 -07:00
Makefile rxrpc: Fix the excessive initial retransmission timeout 2020-05-11 16:42:28 +01:00
af_rxrpc.c rxrpc: add rxrpc_sock_set_min_security_level 2020-05-28 11:11:46 -07:00
ar-internal.h rxrpc: Move the call completion handling out of line 2020-06-05 13:36:35 +01:00
call_accept.c rxrpc: Fix notification call on completion of discarded calls 2020-06-20 21:31:43 -07:00
call_event.c rxrpc: Fix afs large storage transmission performance drop 2020-06-17 23:01:39 +01:00
call_object.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2020-07-30 16:50:20 -07:00
conn_client.c rxrpc: Fix call interruptibility handling 2020-03-13 23:04:30 +00:00
conn_event.c rxrpc: Fix missing notification 2020-06-05 13:36:35 +01:00
conn_object.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2020-07-30 16:50:20 -07:00
conn_service.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
input.c rxrpc: Fix handling of rwind from an ACK packet 2020-06-17 23:01:32 +01:00
insecure.c rxrpc: Fix -Wframe-larger-than= warnings from on-stack crypto 2019-07-30 10:32:35 -07:00
key.c KEYS: Don't write out to userspace while holding key semaphore 2020-03-29 12:40:41 +01:00
local_event.c rxrpc: Use the tx-phase skb flag to simplify tracing 2019-08-27 10:04:18 +01:00
local_object.c ipv6: add ip6_sock_set_recverr 2020-05-28 11:11:45 -07:00
misc.c rxrpc: Fix the excessive initial retransmission timeout 2020-05-11 16:42:28 +01:00
net_ns.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
output.c ipv4: add ip_sock_set_mtu_discover 2020-05-28 11:11:45 -07:00
peer_event.c rxrpc fixes 2020-06-08 19:13:37 -07:00
peer_object.c rxrpc: Fix the excessive initial retransmission timeout 2020-05-11 16:42:28 +01:00
proc.c rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not user_ID 2020-05-31 15:19:51 +01:00
protocol.h rxrpc: Improve jumbo packet counting 2019-08-27 09:48:37 +01:00
recvmsg.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2020-07-30 16:50:20 -07:00
rtt.c rxrpc: Fix the excessive initial retransmission timeout 2020-05-11 16:42:28 +01:00
rxkad.c rxrpc: Fix a memory leak in rxkad_verify_response() 2020-05-23 00:35:46 +01:00
security.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
sendmsg.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2020-07-30 16:50:20 -07:00
skbuff.c rxrpc: Use skb_unshare() rather than skb_cow_data() 2019-08-27 10:13:46 +01:00
sysctl.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-05-24 13:47:27 -07:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00