Eric Dumazet fe36a67e82 ipv6: annotate accesses to fn->fn_sernum ... commit aafc2e3285 upstream. struct fib6_node's fn_sernum field can be read while other threads change it. Add READ_ONCE()/WRITE_ONCE() annotations. Do not change existing smp barriers in fib6_get_cookie_safe() and __fib6_update_sernum_upto_root() syzbot reported: BUG: KCSAN: data-race in fib6_clean_node / inet6_csk_route_socket write to 0xffff88813df62e2c of 4 bytes by task 1920 on cpu 1: fib6_clean_node+0xc2/0x260 net/ipv6/ip6_fib.c:2178 fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2112 fib6_walk net/ipv6/ip6_fib.c:2160 [inline] fib6_clean_tree net/ipv6/ip6_fib.c:2240 [inline] __fib6_clean_all+0x1a9/0x2e0 net/ipv6/ip6_fib.c:2256 fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2281 rt_genid_bump_ipv6 include/net/net_namespace.h:488 [inline] addrconf_dad_completed+0x57f/0x870 net/ipv6/addrconf.c:4230 addrconf_dad_work+0x908/0x1170 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:359 ret_from_fork+0x1f/0x30 read to 0xffff88813df62e2c of 4 bytes by task 15701 on cpu 0: fib6_get_cookie_safe include/net/ip6_fib.h:285 [inline] rt6_get_cookie include/net/ip6_fib.h:306 [inline] ip6_dst_store include/net/ip6_route.h:234 [inline] inet6_csk_route_socket+0x352/0x3c0 net/ipv6/inet6_connection_sock.c:109 inet6_csk_xmit+0x91/0x1e0 net/ipv6/inet6_connection_sock.c:121 __tcp_transmit_skb+0x1323/0x1840 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 tcp_push+0x2d9/0x2f0 net/ipv4/tcp.c:725 mptcp_push_release net/mptcp/protocol.c:1491 [inline] __mptcp_push_pending+0x46c/0x490 net/mptcp/protocol.c:1578 mptcp_sendmsg+0x9ec/0xa50 net/mptcp/protocol.c:1764 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] kernel_sendmsg+0x97/0xd0 net/socket.c:745 sock_no_sendpage+0x84/0xb0 net/core/sock.c:3086 inet_sendpage+0x9d/0xc0 net/ipv4/af_inet.c:834 kernel_sendpage+0x187/0x200 net/socket.c:3492 sock_sendpage+0x5a/0x70 net/socket.c:1007 pipe_to_sendpage+0x128/0x160 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x207/0x500 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x94/0xd0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:936 splice_direct_to_actor+0x345/0x650 fs/splice.c:891 do_splice_direct+0x106/0x190 fs/splice.c:979 do_sendfile+0x675/0xc40 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000026f -> 0x00000271 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 15701 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 The Fixes tag I chose is probably arbitrary, I do not think we need to backport this patch to older kernels. Fixes: c5cff8561d ("ipv6: add rcu grace period before freeing fib6_node") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220120174112.1126644-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-01 17:27:09 +01:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-07-22 16:19:03 +02:00
9p	9p/net: fix missing error check in p9_check_errors	2021-11-18 19:17:16 +01:00
802	net: 802: remove dead leftover after ipx driver removal	2021-08-13 16:30:35 -07:00
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:04:53 +01:00
appletalk	net: socket: rework compat_ifreq_ioctl()	2021-07-23 14:20:25 +01:00
atm	atm: Use list_for_each_entry() to simplify code in resources.c	2021-06-10 14:08:09 -07:00
ax25	ax25: uninitialized variable in ax25_setsockopt()	2022-01-27 11:03:59 +01:00
batman-adv	batman-adv: allow netlink usage in unprivileged containers	2022-01-27 11:04:25 +01:00
bluetooth	Bluetooth: hci_sync: Fix not setting adv set duration	2022-01-27 11:05:22 +01:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-09-28 09:29:28 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	netfilter: bridge: add support for pppoe filtering	2022-01-27 11:03:22 +01:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-14 12:51:15 +01:00
can	can: isotp: convert struct tpcon::{idx,len} to unsigned int	2022-01-16 09:12:44 +01:00
ceph	Networking changes for 5.14.	2021-06-30 15:51:09 -07:00
core	net-procfs: show net devices bound packet types	2022-02-01 17:27:08 +01:00
dcb	net: dcb: Return the correct errno code	2021-06-01 17:01:33 -07:00
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 19:16:33 +01:00
decnet	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00
dns_resolver	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
dsa	net: dsa: fix incorrect function pointer check for MRP ring roles	2022-01-27 11:03:50 +01:00
ethernet	move netdev_boot_setup into Space.c	2021-08-03 13:05:26 +01:00
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-14 10:57:09 +01:00
hsr	net: hsr: don't check sequence number if tag removal is offloaded	2021-06-16 12:13:01 -07:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-13 06:41:22 -07:00
ife	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
ipv4	ping: fix the sk_bound_dev_if match in ping_lookup	2022-02-01 17:27:08 +01:00
ipv6	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:27:09 +01:00
iucv	net/iucv: Replace deprecated CPU-hotplug functions.	2021-08-09 10:13:32 +01:00
kcm	net: sock: introduce sk_error_report	2021-06-29 11:28:21 -07:00
key	net: Remove unnecessary variables	2021-05-26 07:03:39 +02:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-09 11:00:20 +01:00
l3mdev	l3mdev: Correct function names in the kerneldoc comments	2021-03-28 17:56:55 -07:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00
mac80211	mac80211: allow non-standard VHT MCS-10/11	2022-01-27 11:04:52 +01:00
mac802154	ieee802154: Remove redundant initialization of variable ret	2021-09-07 14:06:08 +01:00
mctp	mctp: Don't let RTM_DELROUTE delete local routes	2021-12-08 09:04:53 +01:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:04:47 +01:00
mptcp	mptcp: fix a DSS option writing error	2022-01-27 11:03:59 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:42:37 +01:00
netfilter	netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone	2022-01-27 11:03:51 +01:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-08-30 12:23:18 +01:00
netlink	net: netlink: af_netlink: Prevent empty skb by adding a check on len.	2021-12-17 10:30:15 +01:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 11:04:00 +01:00
nfc	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()	2022-01-27 11:02:48 +01:00
nsh
openvswitch	net: openvswitch: Fix ct_state nat flags for conns arriving from tc	2022-01-27 11:04:02 +01:00
packet	net: fix information leakage in /proc/net/ptype	2022-02-01 17:27:07 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:35:16 +01:00
psample	psample: Add additional metadata attributes	2021-03-14 15:00:43 -07:00
qrtr	net: qrtr: revert check in qrtr_endpoint_post()	2021-09-02 11:37:02 +01:00
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:32:42 +01:00
rfkill	Another set of updates, all over the map:	2021-04-20 16:44:04 -07:00
rose	net: rose: Fix fall-through warnings for Clang	2021-03-10 12:45:15 -08:00
rxrpc	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:04:49 +01:00
sched	sch_api: Don't skip qdisc attach on ingress	2022-01-27 11:05:42 +01:00
sctp	sctp: hold endpoint before calling cb in sctp_transport_lookup_process	2022-01-11 15:35:14 +01:00
smc	net/smc: Fix hung_task when removing SMC-R devices	2022-01-27 11:05:31 +01:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 19:17:11 +01:00
sunrpc	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:27:01 +01:00
switchdev	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tipc	net ticp:fix a kernel-infoleak in __tipc_sendmsg()	2022-01-11 15:35:16 +01:00
tls	net/tls: Fix authentication failure in CCM mode	2021-12-08 09:04:41 +01:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 11:05:30 +01:00
vmw_vsock	virtio/vsock: fix the transport to work with VMADDR_CID_ANY	2021-12-22 09:32:39 +01:00
wireless	cfg80211: Acquire wiphy mutex on regulatory work	2021-12-22 09:32:42 +01:00
x25	net: x25: Use list_for_each_entry() to simplify code in x25_route.c	2021-06-10 14:08:09 -07:00
xdp	Revert "xsk: Do not sleep in poll() when need_wakeup set"	2021-12-22 09:32:51 +01:00
xfrm	xfrm: Don't accidentally set RTO_ONLINK in decode_session4()	2022-01-27 11:05:36 +01:00
compat.c	net: Return the correct errno code	2021-06-03 15:13:56 -07:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
Makefile	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
socket.c	net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets	2022-01-27 11:03:52 +01:00
sysctl_net.c	net: Ensure net namespace isolation of sysctls	2021-04-12 13:27:11 -07:00