linux-stable/net
Eric Dumazet 3a0018ef96 ipvs: move old_secure_tcp into struct netns_ipvs
[ Upstream commit c24b75e0f9 ]

syzbot reported the following issue :

BUG: KCSAN: data-race in update_defense_level / update_defense_level

read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1:
 update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177
 defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
 worker_thread+0xa0/0x800 kernel/workqueue.c:2415
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0:
 update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205
 defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
 worker_thread+0xa0/0x800 kernel/workqueue.c:2415
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events defense_work_handler

Indeed, old_secure_tcp is currently a static variable, while it
needs to be a per netns variable.

Fixes: a0840e2e16 ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-11-12 19:18:38 +01:00
..
6lowpan 6lowpan: iphc: reset mac_header after decompress to fix panic 2018-10-03 17:00:47 -07:00
9p 9p/virtio: Add cleanup path in p9_virtio_init 2019-07-31 07:28:39 +02:00
802
8021q vlan: disable SIOCSHWTSTAMP in container 2019-05-16 19:42:34 +02:00
appletalk appletalk: enforce CAP_NET_RAW for raw sockets 2019-10-05 12:47:43 +02:00
atm net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
ax25 ax25: enforce CAP_NET_RAW for raw sockets 2019-10-05 12:47:43 +02:00
batman-adv batman-adv: Only read OGM2 tvlv_len after buffer len check 2019-09-21 07:15:35 +02:00
bluetooth net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
bpf
bridge bridge/mdb: remove wrong use of NLM_F_MULTI 2019-09-19 09:07:59 +02:00
caif net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
can can: af_can: Fix error path of can_init() 2019-07-21 09:04:22 +02:00
ceph libceph: fix PG split vs OSD (re)connect race 2019-08-29 08:26:42 +02:00
core net/flow_dissector: switch to siphash 2019-11-10 11:25:37 +01:00
dcb net: dcb: For wild-card lookups, use priority -1, not 0 2018-09-19 22:43:43 +02:00
dccp inet: stop leaking jiffies on the wire 2019-11-10 11:25:37 +01:00
decnet
dns_resolver KEYS: DNS: fix parsing multiple options 2018-07-22 14:28:49 +02:00
dsa net: dsa: fix switch tree list 2019-11-10 11:25:32 +01:00
ethernet
hsr net/hsr: fix possible crash in add_timer() 2019-03-19 13:13:22 +01:00
ieee802154 ieee802154: enforce CAP_NET_RAW for raw sockets 2019-10-05 12:47:44 +02:00
ife net: sched: ife: check on metadata length 2018-04-29 11:33:13 +02:00
ipv4 ipv4: Fix table id reference in fib_sync_down_addr 2019-11-12 19:17:49 +01:00
ipv6 net: annotate accesses to sk->sk_incoming_cpu 2019-11-10 11:25:23 +01:00
ipx
iucv net/iucv: Free memory obtained by kzalloc 2018-03-31 18:10:41 +02:00
kcm kcm: switch order of device registration to fix a crash 2019-04-17 08:37:45 +02:00
key xfrm: clean up xfrm protocol checks 2019-09-16 08:20:44 +02:00
l2tp compat_ioctl: pppoe: fix PPPOEIOCSFWD handling 2019-08-09 17:53:35 +02:00
l3mdev
lapb lapb: fixed leak of control-blocks. 2019-06-22 08:16:14 +02:00
llc llc: fix sk_buff leak in llc_conn_service() 2019-11-06 12:43:36 +01:00
mac80211 mac80211: Reject malformed SSID elements 2019-10-29 09:17:35 +01:00
mac802154 net: mac802154: tx: expand tailroom if necessary 2018-09-09 19:55:52 +02:00
mpls mpls: Return error for RTA_GATEWAY attribute 2019-03-13 14:03:09 -07:00
ncsi
netfilter ipvs: move old_secure_tcp into struct netns_ipvs 2019-11-12 19:18:38 +01:00
netlabel netlabel: fix out-of-bounds memory accesses 2019-03-13 14:03:08 -07:00
netlink genetlink: Fix a memory leak on error path 2019-04-03 06:25:08 +02:00
netrom netrom: hold sock when setting skb->destructor 2019-07-31 07:28:46 +02:00
nfc nfc: netlink: fix double device reference drop 2019-11-12 19:17:54 +01:00
nsh nsh: set mac len based on inner packet 2018-07-22 14:28:49 +02:00
openvswitch net: openvswitch: free vport unless register_netdevice() succeeds 2019-11-12 19:18:37 +01:00
packet net/packet: fix race in tpacket_snd() 2019-08-25 10:50:26 +02:00
phonet net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
psample net: sched: act_sample: fix psample group handling on overwrite 2019-09-10 10:32:21 +01:00
qrtr net: qrtr: Stop rx_worker before freeing node 2019-10-05 12:47:40 +02:00
rds net/rds: Fix error handling in rds_ib_add_one() 2019-10-07 18:55:20 +02:00
rfkill rfkill: gpio: fix memory leak in probe error path 2018-05-16 10:10:26 +02:00
rose net/rose: fix unbound loop in rose_loopback_timer() 2019-05-02 09:40:34 +02:00
rxrpc rxrpc: Fix call ref leak 2019-11-06 12:43:37 +01:00
sched net/flow_dissector: switch to siphash 2019-11-10 11:25:37 +01:00
sctp inet: stop leaking jiffies on the wire 2019-11-10 11:25:37 +01:00
smc net/smc: make sure EPOLLOUT is raised 2019-09-06 10:20:50 +02:00
strparser strparser: Remove early eaten to fix full tcp receive buffer stall 2018-07-22 14:28:47 +02:00
sunrpc net :sunrpc :clnt :Fix xps refcount imbalance on the error path 2019-07-21 09:04:29 +02:00
switchdev
tipc net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
tls net/tls: Fixed return value when tls_complete_pending_work() fails 2018-12-05 19:41:11 +01:00
unix net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
vmw_vsock net: use skb_queue_empty_lockless() in poll() handlers 2019-11-10 11:25:34 +01:00
wimax
wireless nl80211: fix validation of mesh path nexthop 2019-11-06 12:43:34 +01:00
x25 net/x25: fix a race in x25_bind() 2019-03-19 13:13:23 +01:00
xfrm xfrm: clean up xfrm protocol checks 2019-09-16 08:20:44 +02:00
compat.c sock: Make sock->sk_stamp thread-safe 2019-01-09 17:14:46 +01:00
Kconfig
Makefile
socket.c bpf: get rid of pure_initcall dependency to enable jits 2019-08-25 10:50:02 +02:00
sysctl_net.c