mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 18:39:59 +00:00
![David Howells](/assets/img/avatar_default.png)
An incoming call can race with rxrpc socket destruction, leading to a
leaked call. This may result in an oops when the call timer eventually
expires:
BUG: kernel NULL pointer dereference, address: 0000000000000874
RIP: 0010:_raw_spin_lock_irqsave+0x2a/0x50
Call Trace:
<IRQ>
try_to_wake_up+0x59/0x550
? __local_bh_enable_ip+0x37/0x80
? rxrpc_poke_call+0x52/0x110 [rxrpc]
? rxrpc_poke_call+0x110/0x110 [rxrpc]
? rxrpc_poke_call+0x110/0x110 [rxrpc]
call_timer_fn+0x24/0x120
with a warning in the kernel log looking something like:
rxrpc: Call 00000000ba5e571a still in use (1,SvAwtACK,1061d,0)!
incurred during rmmod of rxrpc. The 1061d is the call flags:
RECVMSG_READ_ALL, RX_HEARD, BEGAN_RX_TIMER, RX_LAST, EXPOSED,
IS_SERVICE, RELEASED
but no DISCONNECTED flag (0x800), so it's an incoming (service) call and
it's still connected.
The race appears to be that:
(1) rxrpc_new_incoming_call() consults the service struct, checks sk_state
and allocates a call - then pauses, possibly for an interrupt.
(2) rxrpc_release_sock() sets RXRPC_CLOSE, nulls the service pointer,
discards the prealloc and releases all calls attached to the socket.
(3) rxrpc_new_incoming_call() resumes, launching the new call, including
its timer and attaching it to the socket.
Fix this by read-locking local->services_lock to access the AF_RXRPC socket
providing the service rather than RCU in rxrpc_new_incoming_call().
There's no real need to use RCU here as local->services_lock is only
write-locked by the socket side in two places: when binding and when
shutting down.
Fixes: 5e6ef4f101
("rxrpc: Make the I/O thread take over the call and local processor work")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: linux-afs@lists.infradead.org
207 lines
4.5 KiB
C
207 lines
4.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/* RxRPC security handling
|
|
*
|
|
* Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/net.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/udp.h>
|
|
#include <linux/crypto.h>
|
|
#include <net/sock.h>
|
|
#include <net/af_rxrpc.h>
|
|
#include <keys/rxrpc-type.h>
|
|
#include "ar-internal.h"
|
|
|
|
static const struct rxrpc_security *rxrpc_security_types[] = {
|
|
[RXRPC_SECURITY_NONE] = &rxrpc_no_security,
|
|
#ifdef CONFIG_RXKAD
|
|
[RXRPC_SECURITY_RXKAD] = &rxkad,
|
|
#endif
|
|
};
|
|
|
|
int __init rxrpc_init_security(void)
|
|
{
|
|
int i, ret;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(rxrpc_security_types); i++) {
|
|
if (rxrpc_security_types[i]) {
|
|
ret = rxrpc_security_types[i]->init();
|
|
if (ret < 0)
|
|
goto failed;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
|
|
failed:
|
|
for (i--; i >= 0; i--)
|
|
if (rxrpc_security_types[i])
|
|
rxrpc_security_types[i]->exit();
|
|
return ret;
|
|
}
|
|
|
|
void rxrpc_exit_security(void)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(rxrpc_security_types); i++)
|
|
if (rxrpc_security_types[i])
|
|
rxrpc_security_types[i]->exit();
|
|
}
|
|
|
|
/*
|
|
* look up an rxrpc security module
|
|
*/
|
|
const struct rxrpc_security *rxrpc_security_lookup(u8 security_index)
|
|
{
|
|
if (security_index >= ARRAY_SIZE(rxrpc_security_types))
|
|
return NULL;
|
|
return rxrpc_security_types[security_index];
|
|
}
|
|
|
|
/*
|
|
* Initialise the security on a client call.
|
|
*/
|
|
int rxrpc_init_client_call_security(struct rxrpc_call *call)
|
|
{
|
|
const struct rxrpc_security *sec = &rxrpc_no_security;
|
|
struct rxrpc_key_token *token;
|
|
struct key *key = call->key;
|
|
int ret;
|
|
|
|
if (!key)
|
|
goto found;
|
|
|
|
ret = key_validate(key);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
for (token = key->payload.data[0]; token; token = token->next) {
|
|
sec = rxrpc_security_lookup(token->security_index);
|
|
if (sec)
|
|
goto found;
|
|
}
|
|
return -EKEYREJECTED;
|
|
|
|
found:
|
|
call->security = sec;
|
|
call->security_ix = sec->security_index;
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* initialise the security on a client connection
|
|
*/
|
|
int rxrpc_init_client_conn_security(struct rxrpc_connection *conn)
|
|
{
|
|
struct rxrpc_key_token *token;
|
|
struct key *key = conn->key;
|
|
int ret = 0;
|
|
|
|
_enter("{%d},{%x}", conn->debug_id, key_serial(key));
|
|
|
|
for (token = key->payload.data[0]; token; token = token->next) {
|
|
if (token->security_index == conn->security->security_index)
|
|
goto found;
|
|
}
|
|
return -EKEYREJECTED;
|
|
|
|
found:
|
|
mutex_lock(&conn->security_lock);
|
|
if (conn->state == RXRPC_CONN_CLIENT_UNSECURED) {
|
|
ret = conn->security->init_connection_security(conn, token);
|
|
if (ret == 0) {
|
|
spin_lock(&conn->state_lock);
|
|
if (conn->state == RXRPC_CONN_CLIENT_UNSECURED)
|
|
conn->state = RXRPC_CONN_CLIENT;
|
|
spin_unlock(&conn->state_lock);
|
|
}
|
|
}
|
|
mutex_unlock(&conn->security_lock);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Set the ops a server connection.
|
|
*/
|
|
const struct rxrpc_security *rxrpc_get_incoming_security(struct rxrpc_sock *rx,
|
|
struct sk_buff *skb)
|
|
{
|
|
const struct rxrpc_security *sec;
|
|
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
|
|
|
|
_enter("");
|
|
|
|
sec = rxrpc_security_lookup(sp->hdr.securityIndex);
|
|
if (!sec) {
|
|
rxrpc_direct_abort(skb, rxrpc_abort_unsupported_security,
|
|
RX_INVALID_OPERATION, -EKEYREJECTED);
|
|
return NULL;
|
|
}
|
|
|
|
if (sp->hdr.securityIndex != RXRPC_SECURITY_NONE &&
|
|
!rx->securities) {
|
|
rxrpc_direct_abort(skb, rxrpc_abort_no_service_key,
|
|
sec->no_key_abort, -EKEYREJECTED);
|
|
return NULL;
|
|
}
|
|
|
|
return sec;
|
|
}
|
|
|
|
/*
|
|
* Find the security key for a server connection.
|
|
*/
|
|
struct key *rxrpc_look_up_server_security(struct rxrpc_connection *conn,
|
|
struct sk_buff *skb,
|
|
u32 kvno, u32 enctype)
|
|
{
|
|
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
|
|
struct rxrpc_sock *rx;
|
|
struct key *key = ERR_PTR(-EKEYREJECTED);
|
|
key_ref_t kref = NULL;
|
|
char kdesc[5 + 1 + 3 + 1 + 12 + 1 + 12 + 1];
|
|
int ret;
|
|
|
|
_enter("");
|
|
|
|
if (enctype)
|
|
sprintf(kdesc, "%u:%u:%u:%u",
|
|
sp->hdr.serviceId, sp->hdr.securityIndex, kvno, enctype);
|
|
else if (kvno)
|
|
sprintf(kdesc, "%u:%u:%u",
|
|
sp->hdr.serviceId, sp->hdr.securityIndex, kvno);
|
|
else
|
|
sprintf(kdesc, "%u:%u",
|
|
sp->hdr.serviceId, sp->hdr.securityIndex);
|
|
|
|
read_lock(&conn->local->services_lock);
|
|
|
|
rx = conn->local->service;
|
|
if (!rx)
|
|
goto out;
|
|
|
|
/* look through the service's keyring */
|
|
kref = keyring_search(make_key_ref(rx->securities, 1UL),
|
|
&key_type_rxrpc_s, kdesc, true);
|
|
if (IS_ERR(kref)) {
|
|
key = ERR_CAST(kref);
|
|
goto out;
|
|
}
|
|
|
|
key = key_ref_to_ptr(kref);
|
|
|
|
ret = key_validate(key);
|
|
if (ret < 0) {
|
|
key_put(key);
|
|
key = ERR_PTR(ret);
|
|
goto out;
|
|
}
|
|
|
|
out:
|
|
read_unlock(&conn->local->services_lock);
|
|
return key;
|
|
}
|