Eric Dumazet cdfaf8e985 ipv6: annotate accesses to fn->fn_sernum ... commit aafc2e3285 upstream. struct fib6_node's fn_sernum field can be read while other threads change it. Add READ_ONCE()/WRITE_ONCE() annotations. Do not change existing smp barriers in fib6_get_cookie_safe() and __fib6_update_sernum_upto_root() syzbot reported: BUG: KCSAN: data-race in fib6_clean_node / inet6_csk_route_socket write to 0xffff88813df62e2c of 4 bytes by task 1920 on cpu 1: fib6_clean_node+0xc2/0x260 net/ipv6/ip6_fib.c:2178 fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2112 fib6_walk net/ipv6/ip6_fib.c:2160 [inline] fib6_clean_tree net/ipv6/ip6_fib.c:2240 [inline] __fib6_clean_all+0x1a9/0x2e0 net/ipv6/ip6_fib.c:2256 fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2281 rt_genid_bump_ipv6 include/net/net_namespace.h:488 [inline] addrconf_dad_completed+0x57f/0x870 net/ipv6/addrconf.c:4230 addrconf_dad_work+0x908/0x1170 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:359 ret_from_fork+0x1f/0x30 read to 0xffff88813df62e2c of 4 bytes by task 15701 on cpu 0: fib6_get_cookie_safe include/net/ip6_fib.h:285 [inline] rt6_get_cookie include/net/ip6_fib.h:306 [inline] ip6_dst_store include/net/ip6_route.h:234 [inline] inet6_csk_route_socket+0x352/0x3c0 net/ipv6/inet6_connection_sock.c:109 inet6_csk_xmit+0x91/0x1e0 net/ipv6/inet6_connection_sock.c:121 __tcp_transmit_skb+0x1323/0x1840 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 tcp_push+0x2d9/0x2f0 net/ipv4/tcp.c:725 mptcp_push_release net/mptcp/protocol.c:1491 [inline] __mptcp_push_pending+0x46c/0x490 net/mptcp/protocol.c:1578 mptcp_sendmsg+0x9ec/0xa50 net/mptcp/protocol.c:1764 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] kernel_sendmsg+0x97/0xd0 net/socket.c:745 sock_no_sendpage+0x84/0xb0 net/core/sock.c:3086 inet_sendpage+0x9d/0xc0 net/ipv4/af_inet.c:834 kernel_sendpage+0x187/0x200 net/socket.c:3492 sock_sendpage+0x5a/0x70 net/socket.c:1007 pipe_to_sendpage+0x128/0x160 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x207/0x500 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x94/0xd0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:936 splice_direct_to_actor+0x345/0x650 fs/splice.c:891 do_splice_direct+0x106/0x190 fs/splice.c:979 do_sendfile+0x675/0xc40 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000026f -> 0x00000271 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 15701 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 The Fixes tag I chose is probably arbitrary, I do not think we need to backport this patch to older kernels. Fixes: c5cff8561d ("ipv6: add rcu grace period before freeing fib6_node") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220120174112.1126644-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-01 17:24:38 +01:00
..
ila	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netfilter	netfilter: ip6_tables: zero-initialize fragment offset	2021-10-17 10:42:33 +02:00
addrconf.c	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE	2021-11-17 09:48:32 +01:00
addrconf_core.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-18 16:08:42 +01:00
addrlabel.c	ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init	2020-12-08 10:40:23 +01:00
af_inet6.c	net: ipv6: add fib6_nh_release_dsts stub	2021-12-01 09:23:33 +01:00
ah6.c	ah6: fix error return code in ah6_input()	2020-11-24 13:28:55 +01:00
anycast.c	ipv6: fix memory leaks on IPV6_ADDRFORM path	2020-08-11 15:33:39 +02:00
calipso.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:03:35 +01:00
datagram.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
esp6.c	xfrm: xfrm_state_mtu should return at least 1280 for ipv6	2021-07-14 16:53:26 +02:00
esp6_offload.c	esp: delete NETIF_F_SCTP_CRC bit from features for esp offload	2021-04-14 08:24:13 +02:00
exthdrs.c	ipv6: fix out-of-bound access in ip6_parse_tlv()	2021-07-14 16:53:33 +02:00
exthdrs_core.c	ipv6: remove printk	2019-07-27 14:23:48 -07:00
exthdrs_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
fib6_notifier.c
fib6_rules.c	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:01:13 +01:00
fou6.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 10:26:53 +01:00
inet6_connection_sock.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
inet6_hashtables.c	net: prefer socket bound to interface when not in VRF	2021-10-13 10:08:20 +02:00
ip6_checksum.c
ip6_fib.c	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:24:38 +01:00
ip6_flowlabel.c	ipv6: fix static key imbalance in fl_create()	2019-07-11 14:43:25 -07:00
ip6_gre.c	xfrm: fix policy lookup for ipv6 gre packets	2022-01-27 09:19:50 +01:00
ip6_icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 10:26:53 +01:00
ip6_input.c	ipv6: weaken the v4mapped source check	2021-04-07 14:47:38 +02:00
ip6_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ip6_offload.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ip6_output.c	ipv6: fix typos in __ip6_finish_output()	2021-12-01 09:23:32 +01:00
ip6_tunnel.c	ipv6_tunnel: Rate limit warning messages	2022-02-01 17:24:36 +01:00
ip6_udp_tunnel.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
ip6_vti.c	ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate	2022-01-11 15:23:33 +01:00
ip6mr.c	net: don't return invalid table id error when we fall back to PF_UNSPEC	2020-06-03 08:20:41 +02:00
ipcomp6.c	xfrm: remove type and offload_type map from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
ipv6_sockglue.c	ipv6: fix memory leaks on IPV6_ADDRFORM path	2020-08-11 15:33:39 +02:00
Kconfig	net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC	2020-09-26 18:03:13 +02:00
Makefile	xfrm: make xfrm modes builtin	2019-04-08 09:15:17 +02:00
mcast.c	mld: fix panic in mld_newpack()	2021-06-03 08:59:14 +02:00
mcast_snoop.c	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-05-14 09:44:32 +02:00
mip6.c	xfrm: remove type and offload_type map from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
ndisc.c	Exempt multicast addresses from five-second neighbor lifetime	2020-11-24 13:28:56 +01:00
netfilter.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-11-18 19:20:17 +01:00
output_core.c	ipv6: use prandom_u32() for ID generation	2021-07-19 08:53:09 +02:00
ping.c	ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'	2019-09-12 11:20:33 +01:00
proc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-07 11:00:14 -07:00
protocol.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
raw.c	net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()	2021-04-14 08:24:12 +02:00
reassembly.c	ipv6: record frag_max_size in atomic fragments in input path	2021-06-03 08:59:15 +02:00
route.c	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:24:38 +01:00
seg6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
seg6_hmac.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
seg6_iptunnel.c	seg6: fix the iif in the IPv6 socket control block	2021-12-14 14:49:00 +01:00
seg6_local.c	ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions	2020-01-29 16:45:20 +01:00
sit.c	sit: do not call ipip6_dev_free() from sit_init_net()	2021-12-22 09:29:38 +01:00
syncookies.c	net: Update window_clamp if SOCK_RCVBUF is set	2020-11-18 19:20:32 +01:00
sysctl_net_ipv6.c	ipv6: Fix sysctl max for fib_multipath_hash_policy	2020-09-12 14:18:55 +02:00
tcp_ipv6.c	ipv6: tcp: drop silly ICMPv6 packet too big messages	2021-07-25 14:35:15 +02:00
tcpv6_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
tunnel6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
udp.c	udp: using datalen to cap ipv6 udp max gso segments	2022-01-05 12:37:44 +01:00
udp_impl.h
udp_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
udplite.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm6_input.c
xfrm6_output.c	net: ipv6: fix return value of ip6_skb_dst_mtu	2021-07-25 14:35:14 +02:00
xfrm6_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
xfrm6_protocol.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm6_state.c	xfrm: remove eth_proto value from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
xfrm6_tunnel.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00