linux/net/core
Eric Dumazet cd3bcb44ee net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
[ Upstream commit 7c422d0ce9 ]

__skb_wait_for_more_packets() can be called while other cpus
can feed packets to the socket receive queue.

KCSAN reported :

BUG: KCSAN: data-race in __skb_wait_for_more_packets / __udp_enqueue_schedule_skb

write to 0xffff888102e40b58 of 8 bytes by interrupt on cpu 0:
 __skb_insert include/linux/skbuff.h:1852 [inline]
 __skb_queue_before include/linux/skbuff.h:1958 [inline]
 __skb_queue_tail include/linux/skbuff.h:1991 [inline]
 __udp_enqueue_schedule_skb+0x2d7/0x410 net/ipv4/udp.c:1470
 __udp_queue_rcv_skb net/ipv4/udp.c:1940 [inline]
 udp_queue_rcv_one_skb+0x7bd/0xc70 net/ipv4/udp.c:2057
 udp_queue_rcv_skb+0xb5/0x400 net/ipv4/udp.c:2074
 udp_unicast_rcv_skb.isra.0+0x7e/0x1c0 net/ipv4/udp.c:2233
 __udp4_lib_rcv+0xa44/0x17c0 net/ipv4/udp.c:2300
 udp_rcv+0x2b/0x40 net/ipv4/udp.c:2470
 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:442 [inline]
 ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124
 process_backlog+0x1d3/0x420 net/core/dev.c:5955

read to 0xffff888102e40b58 of 8 bytes by task 13035 on cpu 1:
 __skb_wait_for_more_packets+0xfa/0x320 net/core/datagram.c:100
 __skb_recv_udp+0x374/0x500 net/ipv4/udp.c:1683
 udp_recvmsg+0xe1/0xb10 net/ipv4/udp.c:1712
 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838
 sock_recvmsg_nosec+0x5c/0x70 net/socket.c:871
 ___sys_recvmsg+0x1a0/0x3e0 net/socket.c:2480
 do_recvmmsg+0x19a/0x5c0 net/socket.c:2601
 __sys_recvmmsg+0x1ef/0x200 net/socket.c:2680
 __do_sys_recvmmsg net/socket.c:2703 [inline]
 __se_sys_recvmmsg net/socket.c:2696 [inline]
 __x64_sys_recvmmsg+0x89/0xb0 net/socket.c:2696
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13035 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-10 11:27:49 +01:00
..
datagram.c net: add READ_ONCE() annotation in __skb_wait_for_more_packets() 2019-11-10 11:27:49 +01:00
dev_addr_lists.c net: change the comment of dev_mc_init 2018-04-19 12:58:20 -04:00
dev_ioctl.c net: remove redundant input checks in SIOCSIFTXQLEN case of dev_ifsioc 2018-07-24 11:36:15 -07:00
dev.c netns: fix GFP flags in rtnl_net_notifyid() 2019-11-10 11:27:42 +01:00
devlink.c devlink: Add helper function for safely copy string param 2018-10-10 10:19:10 -07:00
drop_monitor.c
dst_cache.c
dst.c netfilter: nf_tables: add tunnel support 2018-08-03 21:12:12 +02:00
ethtool.c net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() 2019-11-10 11:27:44 +01:00
failover.c failover: allow name change on IFF_UP slave interfaces 2019-04-27 09:36:30 +02:00
fib_notifier.c net: Fix fib notifer to return errno 2018-03-29 14:10:30 -04:00
fib_rules.c Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied" 2019-06-11 12:20:50 +02:00
filter.c bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0 2019-09-21 07:16:59 +02:00
flow_dissector.c flow_dissector: do not dissect l4 ports for fragments 2018-11-23 08:17:02 +01:00
gen_estimator.c net: core: protect rate estimator statistics pointer with lock 2018-08-11 12:37:10 -07:00
gen_stats.c net: sched: put back q.qlen into a single location 2019-03-10 07:17:16 +01:00
gro_cells.c gro_cells: make sure device is up in gro_cells_receive() 2019-03-19 13:12:38 +01:00
hwbm.c
link_watch.c
lwt_bpf.c bpf: in __bpf_redirect_no_mac pull mac only if present 2019-01-22 21:40:35 +01:00
lwtunnel.c
Makefile net: Introduce generic failover module 2018-05-28 22:59:54 -04:00
neighbour.c net: neigh: fix multiple neigh timer scheduling 2019-07-28 08:29:24 +02:00
net_namespace.c netns: fix GFP flags in rtnl_net_notifyid() 2019-11-10 11:27:42 +01:00
net-procfs.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
net-sysfs.c net-sysfs: call dev_hold if kobject_init_and_add success 2019-04-03 06:26:17 +02:00
net-sysfs.h
net-traces.c net/ipv6: Udate fib6_table_lookup tracepoint 2018-05-24 23:01:15 -04:00
netclassid_cgroup.c cgroup, netclassid: add a preemption point to write_classid 2018-11-13 11:08:31 -08:00
netevent.c
netpoll.c net: fix skb use after free in netpoll 2019-09-10 10:33:38 +01:00
netprio_cgroup.c
page_pool.c net/page_pool: Fix inconsistent lock state warning 2018-07-19 23:23:01 -07:00
pktgen.c pktgen: do not sleep with the thread lock held. 2019-06-11 12:20:49 +02:00
ptp_classifier.c
request_sock.c
rtnetlink.c netns: fix GFP flags in rtnl_net_notifyid() 2019-11-10 11:27:42 +01:00
scm.c
secure_seq.c infiniband: i40iw, nes: don't use wall time for TCP sequence numbers 2018-07-11 12:10:19 -06:00
skbuff.c net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list 2019-09-19 09:09:30 +02:00
sock_diag.c net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() 2018-08-14 10:01:24 -07:00
sock_reuseport.c udp: correct reuseport selection with connected sockets 2019-09-21 07:16:43 +02:00
sock.c net: use skb_queue_empty_lockless() in busy poll contexts 2019-11-10 11:27:49 +01:00
stream.c tcp: make sure EPOLLOUT wont be missed 2019-09-06 10:22:07 +02:00
sysctl_net_core.c bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K 2019-07-10 09:53:47 +02:00
timestamping.c
tso.c
utils.c net: Remove some unneeded semicolon 2018-08-04 13:05:39 -07:00
xdp.c net/xdp: Fix suspicious RCU usage warning 2018-08-16 21:55:21 +02:00