OpenCloudOS-Kernel/net/tipc
Hoang Le 911600bf5a tipc: fix use-after-free Read in tipc_named_reinit
syzbot found the following issue on:
==================================================================
BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0
net/tipc/name_distr.c:413
Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764

CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted
5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Workqueue: events tipc_net_finalize_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495
mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413
 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
[...]
==================================================================

In the commit
d966ddcc38 ("tipc: fix a deadlock when flushing scheduled work"),
the cancel_work_sync() function just to make sure ONLY the work
tipc_net_finalize_work() is executing/pending on any CPU completed before
tipc namespace is destroyed through tipc_exit_net(). But this function
is not guaranteed the work is the last queued. So, the destroyed instance
may be accessed in the work which will try to enqueue later.

In order to completely fix, we re-order the calling of cancel_work_sync()
to make sure the work tipc_net_finalize_work() was last queued and it
must be completed by calling cancel_work_sync().

Reported-by: syzbot+47af19f3307fc9c5c82e@syzkaller.appspotmail.com
Fixes: d966ddcc38 ("tipc: fix a deadlock when flushing scheduled work")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-06-17 11:39:10 +01:00
..
Kconfig tipc: not enable tipc when ipv6 works as a module 2020-08-16 21:04:55 -07:00
Makefile tipc: remove meaningless assignment in Makefile 2020-01-08 12:38:54 -08:00
addr.c tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
addr.h tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
bcast.c net: tipc: fix FB_MTU eat two pages 2021-06-28 13:31:57 -07:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c tipc: check attribute length for bearer name 2022-06-02 10:14:24 -07:00
bearer.h tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-17 11:39:10 +01:00
core.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
crypto.c tipc: fix a bit overflow in tipc_crypto_key_rcv() 2022-02-13 12:12:25 +00:00
crypto.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
diag.c tipc: switch to rhashtable iterator 2018-08-29 18:04:54 -07:00
discover.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
discover.h
eth_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
group.c tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
group.h tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
ib_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
link.c tipc: fix incorrect order of state message data sanity check 2022-03-08 22:18:42 -08:00
link.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
monitor.c tipc: improve size validations for received domain records 2022-02-10 05:37:44 -08:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c net: tipc: replace align() with ALIGN in msg.c 2021-06-28 13:31:57 -07:00
msg.h net: tipc: remove unused static inlines 2022-01-27 13:53:27 +00:00
name_distr.c tipc: rate limit warning for received illegal binding update 2022-02-09 12:48:22 +00:00
name_distr.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
name_table.c tipc: Fix end of loop tests for list_for_each_entry() 2022-02-23 12:35:40 +00:00
name_table.h tipc: simplify handling of lookup scope during multicast message reception 2021-06-03 14:06:39 -07:00
net.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
net.h tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
netlink.c tipc: add automatic rekeying for encryption key 2020-09-18 13:58:37 -07:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
netlink_compat.c tipc: convert dest node's address to network order 2021-03-11 18:06:54 -08:00
node.c tipc: fix wrong notification node addresses 2022-02-16 20:44:40 -08:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c tipc: fix the timer expires after interval 100ms 2022-03-22 10:50:46 +01:00
socket.h tipc: add stricter control of reserved service types 2020-10-30 08:19:18 -07:00
subscr.c tipc:subscr.c: fix a spelling mistake 2021-06-10 13:48:43 -07:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
topsrv.c tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
topsrv.h
trace.c net/tipc: fix various kernel-doc warnings 2020-12-01 15:37:46 -08:00
trace.h tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
udp_media.c tipc: wait and exit until all work queues are done 2021-05-17 14:07:48 -07:00
udp_media.h