Eric Dumazet fe36a67e82 ipv6: annotate accesses to fn->fn_sernum ... commit aafc2e3285 upstream. struct fib6_node's fn_sernum field can be read while other threads change it. Add READ_ONCE()/WRITE_ONCE() annotations. Do not change existing smp barriers in fib6_get_cookie_safe() and __fib6_update_sernum_upto_root() syzbot reported: BUG: KCSAN: data-race in fib6_clean_node / inet6_csk_route_socket write to 0xffff88813df62e2c of 4 bytes by task 1920 on cpu 1: fib6_clean_node+0xc2/0x260 net/ipv6/ip6_fib.c:2178 fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2112 fib6_walk net/ipv6/ip6_fib.c:2160 [inline] fib6_clean_tree net/ipv6/ip6_fib.c:2240 [inline] __fib6_clean_all+0x1a9/0x2e0 net/ipv6/ip6_fib.c:2256 fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2281 rt_genid_bump_ipv6 include/net/net_namespace.h:488 [inline] addrconf_dad_completed+0x57f/0x870 net/ipv6/addrconf.c:4230 addrconf_dad_work+0x908/0x1170 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:359 ret_from_fork+0x1f/0x30 read to 0xffff88813df62e2c of 4 bytes by task 15701 on cpu 0: fib6_get_cookie_safe include/net/ip6_fib.h:285 [inline] rt6_get_cookie include/net/ip6_fib.h:306 [inline] ip6_dst_store include/net/ip6_route.h:234 [inline] inet6_csk_route_socket+0x352/0x3c0 net/ipv6/inet6_connection_sock.c:109 inet6_csk_xmit+0x91/0x1e0 net/ipv6/inet6_connection_sock.c:121 __tcp_transmit_skb+0x1323/0x1840 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 tcp_push+0x2d9/0x2f0 net/ipv4/tcp.c:725 mptcp_push_release net/mptcp/protocol.c:1491 [inline] __mptcp_push_pending+0x46c/0x490 net/mptcp/protocol.c:1578 mptcp_sendmsg+0x9ec/0xa50 net/mptcp/protocol.c:1764 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] kernel_sendmsg+0x97/0xd0 net/socket.c:745 sock_no_sendpage+0x84/0xb0 net/core/sock.c:3086 inet_sendpage+0x9d/0xc0 net/ipv4/af_inet.c:834 kernel_sendpage+0x187/0x200 net/socket.c:3492 sock_sendpage+0x5a/0x70 net/socket.c:1007 pipe_to_sendpage+0x128/0x160 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x207/0x500 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x94/0xd0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:936 splice_direct_to_actor+0x345/0x650 fs/splice.c:891 do_splice_direct+0x106/0x190 fs/splice.c:979 do_sendfile+0x675/0xc40 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000026f -> 0x00000271 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 15701 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 The Fixes tag I chose is probably arbitrary, I do not think we need to backport this patch to older kernels. Fixes: c5cff8561d ("ipv6: add rcu grace period before freeing fib6_node") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220120174112.1126644-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-01 17:27:09 +01:00
..
ila	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
netfilter	netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6	2021-10-14 23:08:35 +02:00
addrconf_core.c	ipv6: add ipv6_dev_find to stubs	2021-03-30 13:29:39 -07:00
addrconf.c	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE	2021-11-18 19:16:19 +01:00
addrlabel.c	ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init	2020-11-25 11:20:16 -08:00
af_inet6.c	net: ipv6: add fib6_nh_release_dsts stub	2021-12-01 09:04:49 +01:00
ah6.c	xfrm: remove hdr_offset indirection	2021-06-11 14:48:50 +02:00
anycast.c	ipv6: fix memory leaks on IPV6_ADDRFORM path	2020-07-30 16:30:55 -07:00
calipso.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-04 15:26:57 -08:00
datagram.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
esp6_offload.c	xfrm: remove description from xfrm_type struct	2021-06-09 09:38:52 +02:00
esp6.c	ipv6: check return value of ipv6_skip_exthdr	2021-12-08 09:04:40 +01:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c	ipv6: exthdrs: get rid of indirect calls in ip6_parse_tlv()	2021-08-04 10:34:40 +01:00
fib6_notifier.c
fib6_rules.c	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:04:43 +01:00
fou6.c	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
icmp.c	icmp: ICMPV6: Examine invoking packet for Segment Route Headers.	2022-01-27 11:05:05 +01:00
inet6_connection_sock.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
inet6_hashtables.c	net: prefer socket bound to interface when not in VRF	2021-10-07 07:27:55 -07:00
ioam6_iptunnel.c	ipv6: ioam: move the check for undefined bits	2021-10-12 11:49:49 +01:00
ioam6.c	ipv6: ioam: move the check for undefined bits	2021-10-12 11:49:49 +01:00
ip6_checksum.c
ip6_fib.c	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:27:09 +01:00
ip6_flowlabel.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
ip6_gre.c	xfrm: fix policy lookup for ipv6 gre packets	2022-01-27 11:05:14 +01:00
ip6_icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-02-23 11:29:52 -08:00
ip6_input.c	ipv6: weaken the v4mapped source check	2021-03-18 11:19:23 -07:00
ip6_offload.c	net/core: move gro function declarations to separate header	2021-02-04 18:37:57 -08:00
ip6_offload.h
ip6_output.c	ipv6: fix typos in __ip6_finish_output()	2021-12-01 09:04:49 +01:00
ip6_tunnel.c	ipv6_tunnel: Rate limit warning messages	2022-02-01 17:27:07 +01:00
ip6_udp_tunnel.c	net: Make locking in sock_bindtoindex optional	2020-06-01 14:57:14 -07:00
ip6_vti.c	ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate	2022-01-11 15:35:17 +01:00
ip6mr.c	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00
ipcomp6.c	xfrm: remove hdr_offset indirection	2021-06-11 14:48:50 +02:00
ipv6_sockglue.c	net/ipv4/ipv6: Replace one-element arraya with flexible-array members	2021-08-05 11:46:42 +01:00
Kconfig	ipv6: ioam: Support for IOAM injection with lwtunnels	2021-07-21 08:14:33 -07:00
Makefile	ipv6: ioam: Support for IOAM injection with lwtunnels	2021-07-21 08:14:33 -07:00
mcast_snoop.c	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-04-27 14:02:06 -07:00
mcast.c	ipv6: change return type from int to void for mld_process_v2	2021-09-02 11:29:55 +01:00
mip6.c	xfrm: ipv6: move mip6_rthdr_offset into xfrm core	2021-06-11 14:48:50 +02:00
ndisc.c	ipv6: add IFLA_INET6_RA_MTU to expose mtu value	2021-08-27 17:29:18 -07:00
netfilter.c	netfilter: Dissect flow after packet mangling	2021-04-18 22:04:16 +02:00
output_core.c	ipv6: use prandom_u32() for ID generation	2021-05-31 22:12:08 -07:00
ping.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
proc.c	net: udp: introduce UDP_MIB_MEMERRORS for udp_mem	2020-11-09 15:34:44 -08:00
protocol.c
raw.c	ipv6: raw: check passed optlen before reading	2022-01-11 15:35:18 +01:00
reassembly.c	ipv6: record frag_max_size in atomic fragments in input path	2021-05-21 15:02:25 -07:00
route.c	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:27:09 +01:00
rpl_iptunnel.c	net: ipv6: rpl_iptunnel: simplify the return expression of rpl_do_srh()	2020-12-08 16:22:54 -08:00
rpl.c	net: ipv6: rpl*: Fix strange kerneldoc warnings due to bad header	2020-10-30 12:12:52 -07:00
seg6_hmac.c	crypto: sha - split sha.h into sha1.h and sha2.h	2020-11-20 14:45:33 +11:00
seg6_iptunnel.c	seg6: fix the iif in the IPv6 socket control block	2021-12-14 10:57:09 +01:00
seg6_local.c	seg6: export get_srh() for ICMP handling	2022-01-27 11:05:05 +01:00
seg6.c	icmp: ICMPV6: Examine invoking packet for Segment Route Headers.	2022-01-27 11:05:05 +01:00
sit.c	sit: do not call ipip6_dev_free() from sit_init_net()	2021-12-22 09:32:44 +01:00
syncookies.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
sysctl_net_ipv6.c	ipv6: ioam: Data plane support for Pre-allocated Trace	2021-07-21 08:14:33 -07:00
tcp_ipv6.c	inet: fully convert sk->sk_rx_dst to RCU rules	2021-12-29 12:28:42 +01:00
tcpv6_offload.c
tunnel6.c	tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels	2020-07-09 12:52:37 +02:00
udp_impl.h	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
udp_offload.c	udp: properly complete L4 GRO over UDP tunnel packet	2021-03-30 17:06:49 -07:00
udp.c	udp6: Use Segment Routing Header for dest address if present	2022-01-27 11:05:05 +01:00
udplite.c	net/ipv6: remove compat_ipv6_{get,set}sockopt	2020-07-19 18:16:41 -07:00
xfrm6_input.c	xfrm: state: remove extract_input indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_output.c	net: ipv6: fix return value of ip6_skb_dst_mtu	2021-07-02 11:57:01 -07:00
xfrm6_policy.c
xfrm6_protocol.c	xfrm: add support for UDPv6 encapsulation of ESP	2020-04-28 11:28:36 +02:00
xfrm6_state.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c	xfrm: remove description from xfrm_type struct	2021-06-09 09:38:52 +02:00