Daniel Borkmann 5a5abb1fa3 tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter ... Sasha Levin reported a suspicious rcu_dereference_protected() warning found while fuzzing with trinity that is similar to this one: [ 52.765684] net/core/filter.c:2262 suspicious rcu_dereference_protected() usage! [ 52.765688] other info that might help us debug this: [ 52.765695] rcu_scheduler_active = 1, debug_locks = 1 [ 52.765701] 1 lock held by a.out/1525: [ 52.765704] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff816a64b7>] rtnl_lock+0x17/0x20 [ 52.765721] stack backtrace: [ 52.765728] CPU: 1 PID: 1525 Comm: a.out Not tainted 4.5.0+ #264 [...] [ 52.765768] Call Trace: [ 52.765775] [<ffffffff813e488d>] dump_stack+0x85/0xc8 [ 52.765784] [<ffffffff810f2fa5>] lockdep_rcu_suspicious+0xd5/0x110 [ 52.765792] [<ffffffff816afdc2>] sk_detach_filter+0x82/0x90 [ 52.765801] [<ffffffffa0883425>] tun_detach_filter+0x35/0x90 [tun] [ 52.765810] [<ffffffffa0884ed4>] __tun_chr_ioctl+0x354/0x1130 [tun] [ 52.765818] [<ffffffff8136fed0>] ? selinux_file_ioctl+0x130/0x210 [ 52.765827] [<ffffffffa0885ce3>] tun_chr_ioctl+0x13/0x20 [tun] [ 52.765834] [<ffffffff81260ea6>] do_vfs_ioctl+0x96/0x690 [ 52.765843] [<ffffffff81364af3>] ? security_file_ioctl+0x43/0x60 [ 52.765850] [<ffffffff81261519>] SyS_ioctl+0x79/0x90 [ 52.765858] [<ffffffff81003ba2>] do_syscall_64+0x62/0x140 [ 52.765866] [<ffffffff817d563f>] entry_SYSCALL64_slow_path+0x25/0x25 Same can be triggered with PROVE_RCU (+ PROVE_RCU_REPEATEDLY) enabled from tun_attach_filter() when user space calls ioctl(tun_fd, TUN{ATTACH, DETACH}FILTER, ...) for adding/removing a BPF filter on tap devices. Since the fix in f91ff5b9ff ("net: sk_{detach|attach}_filter() rcu fixes") sk_attach_filter()/sk_detach_filter() now dereferences the filter with rcu_dereference_protected(), checking whether socket lock is held in control path. Since its introduction in 9940516259 ("tun: socket filter support"), tap filters are managed under RTNL lock from __tun_chr_ioctl(). Thus the sock_owned_by_user(sk) doesn't apply in this specific case and therefore triggers the false positive. Extend the BPF API with __sk_attach_filter()/__sk_detach_filter() pair that is used by tap filters and pass in lockdep_rtnl_is_held() for the rcu_dereference_protected() checks instead. Reported-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-04-01 14:33:46 -04:00
..
acpi	Merge branches 'acpi-processor' and 'acpi-cppc'	2016-03-14 14:20:33 +01:00
asm-generic	Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-03-24 09:36:18 -07:00
clocksource
crypto	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-03-17 11:33:45 -07:00
drm	Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux	2016-03-21 13:48:00 -07:00
dt-bindings	The clk changes for this release cycle are mostly dominated by	2016-03-23 06:06:45 -07:00
keys
kvm	arm64: KVM: vgic-v3: Avoid accessing ICH registers	2016-03-09 04:24:04 +00:00
linux	tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter	2016-04-01 14:33:46 -04:00
math-emu
media	Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm	2016-03-19 16:31:54 -07:00
memory
misc	cxl: Remove cxl_get_phys_dev() kernel API	2016-03-09 23:40:02 +11:00
net	net: ping: make ping_v6_sendmsg static	2016-03-23 22:09:58 -04:00
pcmcia
ras
rdma	Round two of 4.6 merge window patches	2016-03-22 15:48:44 -07:00
rxrpc	rxrpc: Be more selective about the types of received packets we accept	2016-03-04 15:56:06 +00:00
scsi	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-03-17 11:22:54 -07:00
soc	IOMMU Updates for Linux v4.6	2016-03-22 11:57:43 -07:00
sound	ASoC: Updates for v4.6	2016-03-14 14:03:29 +01:00
target	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2016-03-22 12:41:14 -07:00
trace	Nothing major this round. Mostly small clean ups and fixes.	2016-03-24 10:52:25 -07:00
uapi	bpf: make padding in bpf_tunnel_key explicit	2016-03-30 19:01:33 -04:00
video	drm/omap: add dispc_channel_connected field to omap_dss_device	2016-03-03 17:38:22 +02:00
xen	xen-netback: re-import canonical netif header	2016-03-13 22:08:01 -04:00
Kbuild