| Message ID | 7f24b6b0a0d2cb82b9dfbf5343c01266d2840561.1597908887.git.lucien.xin@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] tipc: call rcu_read_lock() in tipc_aead_encrypt_done() | expand |
From: Xin Long <lucien.xin@gmail.com> Date: Thu, 20 Aug 2020 15:34:47 +0800 > b->media->send_msg() requires rcu_read_lock(), as we can see > elsewhere in tipc, tipc_bearer_xmit, tipc_bearer_xmit_skb > and tipc_bearer_bc_xmit(). > > Syzbot has reported this issue as: > > net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage! > Workqueue: cryptd cryptd_queue_worker > Call Trace: > tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466 > tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761 > cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739 > cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181 > process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 > kthread+0x3b5/0x4a0 kernel/kthread.c:291 > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 > > So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done() > for b->media->send_msg(). > > Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") > Reported-by: syzbot+47bbc6b678d317cccbe0@syzkaller.appspotmail.com > Signed-off-by: Xin Long <lucien.xin@gmail.com> Applied and queued up for -stable, thank you.
diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index 001bcb0..c38baba 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -757,10 +757,12 @@ static void tipc_aead_encrypt_done(struct crypto_async_request *base, int err) switch (err) { case 0: this_cpu_inc(tx->stats->stat[STAT_ASYNC_OK]); + rcu_read_lock(); if (likely(test_bit(0, &b->up))) b->media->send_msg(net, skb, b, &tx_ctx->dst); else kfree_skb(skb); + rcu_read_unlock(); break; case -EINPROGRESS: return;
b->media->send_msg() requires rcu_read_lock(), as we can see elsewhere in tipc, tipc_bearer_xmit, tipc_bearer_xmit_skb and tipc_bearer_bc_xmit(). Syzbot has reported this issue as: net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage! Workqueue: cryptd cryptd_queue_worker Call Trace: tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466 tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761 cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739 cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:291 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done() for b->media->send_msg(). Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Reported-by: syzbot+47bbc6b678d317cccbe0@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/tipc/crypto.c | 2 ++ 1 file changed, 2 insertions(+)