Eric Dumazet 13b430574e net/x25: fix a race in x25_bind() ... [ Upstream commit 797a22bd52 ] syzbot was able to trigger another soft lockup [1] I first thought it was the O(N^2) issue I mentioned in my prior fix (f657d22ee1f "net/x25: do not hold the cpu too long in x25_new_lci()"), but I eventually found that x25_bind() was not checking SOCK_ZAPPED state under socket lock protection. This means that multiple threads can end up calling x25_insert_socket() for the same socket, and corrupt x25_list [1] watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.2:10492] Modules linked in: irq event stamp: 27515 hardirqs last enabled at (27514): [<ffffffff81006673>] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (27515): [<ffffffff8100668f>] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (32): [<ffffffff8632ee73>] x25_get_neigh+0xa3/0xd0 net/x25/x25_link.c:336 softirqs last disabled at (34): [<ffffffff86324bc3>] x25_find_socket+0x23/0x140 net/x25/af_x25.c:341 CPU: 0 PID: 10492 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:97 Code: f4 ff ff ff e8 11 9f ea ff 48 c7 05 12 fb e5 08 00 00 00 00 e9 c8 e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 <48> 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 38 0c 92 7e 81 e2 RSP: 0018:ffff88806e94fc48 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1100d84dac5 RBX: 0000000000000001 RCX: ffffc90006197000 RDX: 0000000000040000 RSI: ffffffff86324bf3 RDI: ffff88806c26d628 RBP: ffff88806e94fc48 R08: ffff88806c1c6500 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: ffff88806c26d628 R13: ffff888090455200 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f3a107e4700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3a107e3db8 CR3: 00000000a5544000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __x25_find_socket net/x25/af_x25.c:327 [inline] x25_find_socket+0x7d/0x140 net/x25/af_x25.c:342 x25_new_lci net/x25/af_x25.c:355 [inline] x25_connect+0x380/0xde0 net/x25/af_x25.c:784 __sys_connect+0x266/0x330 net/socket.c:1662 __do_sys_connect net/socket.c:1673 [inline] __se_sys_connect net/socket.c:1670 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1670 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3a107e3c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000005 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a107e46d4 R13: 00000000004be362 R14: 00000000004ceb98 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10493 Comm: syz-executor.3 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:queued_write_lock_slowpath+0x143/0x290 kernel/locking/qrwlock.c:86 Code: 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 41 0f b6 55 00 <41> 38 d7 7c eb 84 d2 74 e7 48 89 df e8 cc aa 4e 00 eb dd be 04 00 RSP: 0018:ffff888085c47bd8 EFLAGS: 00000206 RAX: 0000000000000300 RBX: ffffffff89412b00 RCX: 1ffffffff1282560 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89412b00 RBP: ffff888085c47c70 R08: 1ffffffff1282560 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: 00000000000000ff R13: fffffbfff1282560 R14: 1ffff11010b88f7d R15: 0000000000000003 FS: 00007fdd04086700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd04064db8 CR3: 0000000090be0000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:104 [inline] do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203 __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline] _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312 x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267 x25_bind+0x273/0x340 net/x25/af_x25.c:703 __sys_bind+0x23f/0x290 net/socket.c:1481 __do_sys_bind net/socket.c:1492 [inline] __se_sys_bind net/socket.c:1490 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1490 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Fixes: 90c27297a9 ("X.25 remove bkl in bind") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: andrew hendry <andrew.hendry@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-03-19 13:12:40 +01:00
..
6lowpan
9p	9p/net: put a lower bound on msize	2019-01-13 09:51:08 +01:00
802
8021q	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
appletalk
atm	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
ax25	ax25: fix possible use-after-free	2019-02-23 09:07:27 +01:00
batman-adv	batman-adv: release station info tidstats	2019-03-13 14:02:34 -07:00
bluetooth	Bluetooth: Fix locking in bt_accept_enqueue() for BH context	2019-03-10 07:17:21 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	net: bpfilter: use get_pid_task instead of pid_task	2018-10-17 22:03:40 -07:00
bridge	netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present	2019-03-13 14:02:29 -07:00
caif	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
can	can: bcm: check timer values before ktime conversion	2019-01-31 08:14:39 +01:00
ceph	libceph: handle an empty authorize reply	2019-02-27 10:08:50 +01:00
core	gro_cells: make sure device is up in gro_cells_receive()	2019-03-19 13:12:38 +01:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-12 19:47:21 +01:00
decnet	decnet: fix using plain integer as NULL warning	2018-08-09 14:11:24 -07:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-12 19:47:22 +01:00
ethernet
hsr	net/hsr: fix possible crash in add_timer()	2019-03-19 13:12:38 +01:00
ieee802154	ieee802154: lowpan_header_create check must check daddr	2019-01-09 17:38:31 +01:00
ife
ipv4	tcp: handle inet_csk_reqsk_queue_add() failures	2019-03-19 13:12:39 +01:00
ipv6	net: sit: fix UBSAN Undefined behaviour in check_6rd	2019-03-19 13:12:38 +01:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	Revert "kcm: remove any offset before parsing messages"	2018-09-17 18:43:42 -07:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-19 13:12:38 +01:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-12-01 09:37:27 +01:00
mac80211	mac80211: Add attribute aligned(2) to struct 'action'	2019-03-05 17:58:52 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	netfilter: xt_TEE: add missing code to get interface index in checkentry.	2019-03-13 14:02:40 -07:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net	2018-08-05 13:04:31 -07:00
netrom	netrom: switch to sock timer API	2019-02-06 17:30:07 +01:00
nfc	net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails	2019-03-10 07:17:18 +01:00
nsh
openvswitch	openvswitch: Avoid OOB read when parsing flow nlattrs	2019-01-31 08:14:32 +01:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-02-27 10:08:58 +01:00
phonet
psample
qrtr
rds	rds: fix refcount bug in rds_sock_addref	2019-02-12 19:47:22 +01:00
rfkill	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
rose	net/rose: fix NULL ax25_cb kernel panic	2019-02-06 17:30:07 +01:00
rxrpc	rxrpc: Fix client call queueing, waiting for channel	2019-03-19 13:12:39 +01:00
sched	net: sched: act_tunnel_key: fix NULL pointer dereference during init	2019-03-10 07:17:20 +01:00
sctp	sctp: remove sched init from sctp_stream_init	2019-03-19 13:12:39 +01:00
smc	smc: move unhash as early as possible in smc_release()	2019-01-22 21:40:31 +01:00
strparser	strparser: remove redundant variable 'rd_desc'	2018-08-01 10:00:06 -07:00
sunrpc	xprtrdma: Double free in rpcrdma_sendctxs_create()	2019-02-27 10:08:53 +01:00
switchdev
tipc	tipc: fix race condition causing hung sendto	2019-03-10 07:17:18 +01:00
tls	net/tls: Init routines in create_ctx	2019-01-13 09:51:00 +01:00
unix	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
vmw_vsock	vsock/virtio: reset connected sockets on device removal	2019-03-13 14:02:36 -07:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	cfg80211: extend range deviation for DMG	2019-03-05 17:58:52 +01:00
x25	net/x25: fix a race in x25_bind()	2019-03-19 13:12:40 +01:00
xdp	xsk: do not call synchronize_net() under RCU read lock	2018-10-11 10:19:01 +02:00
xfrm	xfrm: refine validation of template and selector families	2019-02-15 08:10:13 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-10 07:17:18 +01:00
sysctl_net.c