Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net
History
Eric Dumazet 1ea80b9eb4 af_unix: fix lockdep positive in sk_diag_dump_icons() 
[ Upstream commit 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9 ]

syzbot reported a lockdep splat [1].

Blamed commit hinted about the possible lockdep
violation, and code used unix_state_lock_nested()
in an attempt to silence lockdep.

It is not sufficient, because unix_state_lock_nested()
is already used from unix_state_double_lock().

We need to use a separate subclass.

This patch adds a distinct enumeration to make things
more explicit.

Also use swap() in unix_state_double_lock() as a clean up.

v2: add a missing inline keyword to unix_state_lock_nested()

[1]
WARNING: possible circular locking dependency detected
6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Not tainted

syz-executor.1/2542 is trying to acquire lock:
 ffff88808b5df9e8 (rlock-AF_UNIX){+.+.}-{2:2}, at: skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863

but task is already holding lock:
 ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&u->lock/1){+.+.}-{2:2}:
        lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
        _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
        sk_diag_dump_icons net/unix/diag.c:87 [inline]
        sk_diag_fill+0x6ea/0xfe0 net/unix/diag.c:157
        sk_diag_dump net/unix/diag.c:196 [inline]
        unix_diag_dump+0x3e9/0x630 net/unix/diag.c:220
        netlink_dump+0x5c1/0xcd0 net/netlink/af_netlink.c:2264
        __netlink_dump_start+0x5d7/0x780 net/netlink/af_netlink.c:2370
        netlink_dump_start include/linux/netlink.h:338 [inline]
        unix_diag_handler_dump+0x1c3/0x8f0 net/unix/diag.c:319
       sock_diag_rcv_msg+0xe3/0x400
        netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543
        sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280
        netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
        netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367
        netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908
        sock_sendmsg_nosec net/socket.c:730 [inline]
        __sock_sendmsg net/socket.c:745 [inline]
        sock_write_iter+0x39a/0x520 net/socket.c:1160
        call_write_iter include/linux/fs.h:2085 [inline]
        new_sync_write fs/read_write.c:497 [inline]
        vfs_write+0xa74/0xca0 fs/read_write.c:590
        ksys_write+0x1a0/0x2c0 fs/read_write.c:643
        do_syscall_x64 arch/x86/entry/common.c:52 [inline]
        do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x63/0x6b

-> #0 (rlock-AF_UNIX){+.+.}-{2:2}:
        check_prev_add kernel/locking/lockdep.c:3134 [inline]
        check_prevs_add kernel/locking/lockdep.c:3253 [inline]
        validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869
        __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
        lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
        __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
        _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
        skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863
        unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112
        sock_sendmsg_nosec net/socket.c:730 [inline]
        __sock_sendmsg net/socket.c:745 [inline]
        ____sys_sendmsg+0x592/0x890 net/socket.c:2584
        ___sys_sendmsg net/socket.c:2638 [inline]
        __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724
        __do_sys_sendmmsg net/socket.c:2753 [inline]
        __se_sys_sendmmsg net/socket.c:2750 [inline]
        __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750
        do_syscall_x64 arch/x86/entry/common.c:52 [inline]
        do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x63/0x6b

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&u->lock/1);
                               lock(rlock-AF_UNIX);
                               lock(&u->lock/1);
  lock(rlock-AF_UNIX);

 *** DEADLOCK ***

1 lock held by syz-executor.1/2542:
  #0: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089

stack backtrace:
CPU: 1 PID: 2542 Comm: syz-executor.1 Not tainted 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
  check_noncircular+0x366/0x490 kernel/locking/lockdep.c:2187
  check_prev_add kernel/locking/lockdep.c:3134 [inline]
  check_prevs_add kernel/locking/lockdep.c:3253 [inline]
  validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869
  __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
  lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
  skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863
  unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg net/socket.c:745 [inline]
  ____sys_sendmsg+0x592/0x890 net/socket.c:2584
  ___sys_sendmsg net/socket.c:2638 [inline]
  __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724
  __do_sys_sendmmsg net/socket.c:2753 [inline]
  __se_sys_sendmmsg net/socket.c:2750 [inline]
  __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f26d887cda9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f26d95a60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f26d89abf80 RCX: 00007f26d887cda9
RDX: 000000000000003e RSI: 00000000200bd000 RDI: 0000000000000004
RBP: 00007f26d88c947a R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f26d89abf80 R15: 00007ffcfe081a68

Fixes: 2aac7a2cb0d9 ("unix_diag: Pending connections IDs NLA")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240130184235.1620738-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:13:23 +01:00
..
6lowpan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
9p 9p/net: fix possible memory leak in p9_check_errors() 2024-11-18 12:12:01 +01:00
802 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-11-18 12:13:00 +01:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2024-11-18 12:11:49 +01:00
atm atm: Fix Use-After-Free in do_vcc_ioctl 2024-11-18 12:11:49 +01:00
ax25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
batman-adv net: vlan: introduce skb_vlan_eth_hdr() 2024-11-18 12:11:48 +01:00
bluetooth Bluetooth: L2CAP: Fix possible multiple reject send 2024-11-18 12:13:17 +01:00
bpf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpfilter Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bridge netfilter: nf_conntrack_bridge: initialize err to 0 2024-11-18 11:43:20 +01:00
caif Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
can can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior 2024-11-18 10:58:47 +01:00
ceph libceph: use kernel_connect() 2024-11-08 11:25:50 +01:00
core tcp: make sure init the accept_queue's spinlocks once 2024-11-18 12:12:59 +01:00
dcb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2024-11-18 11:43:07 +01:00
decnet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-11-18 12:12:43 +01:00
dsa Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethernet Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-11-18 12:12:51 +01:00
hsr hsr: Prevent use after free in prp_create_tagged_frame() 2024-11-18 11:43:07 +01:00
ieee802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ife net: sched: ife: fix potential use-after-free 2024-11-18 12:11:59 +01:00
ipv4 net: ipv4: fix a memleak in ip_setup_cork 2024-11-18 12:13:22 +01:00
ipv6 ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-11-18 12:13:22 +01:00
iucv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
key Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l2tp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l3mdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lapb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
llc llc: call sock_orphan() at release time 2024-11-18 12:13:22 +01:00
mac80211 wifi: mac80211: mesh_plink: fix matches_local logic 2024-11-18 12:11:58 +01:00
mac802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mptcp mptcp: fix uninit-value in mptcp_incoming_options 2024-11-18 12:12:12 +01:00
ncm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ncsi net/ncsi: Fix netlink major/minor version numbers 2024-11-18 12:12:28 +01:00
netfilter netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations 2024-11-18 12:13:22 +01:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-11-18 12:12:25 +01:00
netlink netlink: fix potential sleeping issue in mqueue_flush_file 2024-11-18 12:13:00 +01:00
netrom Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfc nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local 2024-11-18 12:12:06 +01:00
nsh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openvswitch Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
packet packet: Move reference count in packet_sock to atomic_long_t 2024-11-18 12:11:42 +01:00
phonet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2024-11-18 12:11:46 +01:00
qrtr Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rds net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 2024-11-18 12:13:00 +01:00
rfkill net: rfkill: gpio: set GPIO direction 2024-11-18 12:12:01 +01:00
rose net/rose: fix races in rose_kill_by_device() 2024-11-18 12:11:59 +01:00
rxrpc rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() 2024-11-18 12:13:10 +01:00
sched net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-11-18 12:12:06 +01:00
sctp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
skb_tracer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smc net/smc: fix illegal rmb_desc access in SMC-D connection dump 2024-11-18 12:12:59 +01:00
strparser Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sunrpc SUNRPC: Fix a suspicious RCU usage warning 2024-11-18 12:13:10 +01:00
switchdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tipc tipc: Fix kernel-infoleak due to uninitialized TLV value 2024-11-18 11:43:19 +01:00
tls net: tls, update curr on splice as well 2024-11-18 12:12:08 +01:00
unix af_unix: fix lockdep positive in sk_diag_dump_icons() 2024-11-18 12:13:23 +01:00
vmw_vsock virtio/vsock: fix logic which reduces credit update messages 2024-11-18 12:12:37 +01:00
wimax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wireless wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update 2024-11-18 12:13:21 +01:00
x25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xdp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm Revert "xfrm: fix a data-race in xfrm_gen_index()" 2024-11-17 19:38:56 +01:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devres.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
socket.c net: Save and restore msg_namelen in sock_sendmsg 2024-11-18 12:12:07 +01:00
sysctl_net.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
TEST_MAPPING Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00