mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
802a7dc5cf
(struct nf_conn)->timeout can be read/written locklessly,
add READ_ONCE()/WRITE_ONCE() to prevent load/store tearing.
BUG: KCSAN: data-race in __nf_conntrack_alloc / __nf_conntrack_find_get
write to 0xffff888132e78c08 of 4 bytes by task 6029 on cpu 0:
__nf_conntrack_alloc+0x158/0x280 net/netfilter/nf_conntrack_core.c:1563
init_conntrack+0x1da/0xb30 net/netfilter/nf_conntrack_core.c:1635
resolve_normal_ct+0x502/0x610 net/netfilter/nf_conntrack_core.c:1746
nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901
ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0x72/0x170 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:262 [inline]
NF_HOOK include/linux/netfilter.h:305 [inline]
ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324
inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402
tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680
__tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864
tcp_push_pending_frames include/net/tcp.h:1897 [inline]
tcp_data_snd_check+0x62/0x2e0 net/ipv4/tcp_input.c:5452
tcp_rcv_established+0x880/0x10e0 net/ipv4/tcp_input.c:5947
tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521
sk_backlog_rcv include/net/sock.h:1030 [inline]
__release_sock+0xf2/0x270 net/core/sock.c:2768
release_sock+0x40/0x110 net/core/sock.c:3300
sk_stream_wait_memory+0x435/0x700 net/core/stream.c:145
tcp_sendmsg_locked+0xb85/0x25a0 net/ipv4/tcp.c:1402
tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1440
inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:644
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg net/socket.c:724 [inline]
__sys_sendto+0x21e/0x2c0 net/socket.c:2036
__do_sys_sendto net/socket.c:2048 [inline]
__se_sys_sendto net/socket.c:2044 [inline]
__x64_sys_sendto+0x74/0x90 net/socket.c:2044
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888132e78c08 of 4 bytes by task 17446 on cpu 1:
nf_ct_is_expired include/net/netfilter/nf_conntrack.h:286 [inline]
____nf_conntrack_find net/netfilter/nf_conntrack_core.c:776 [inline]
__nf_conntrack_find_get+0x1c7/0xac0 net/netfilter/nf_conntrack_core.c:807
resolve_normal_ct+0x273/0x610 net/netfilter/nf_conntrack_core.c:1734
nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901
ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0x72/0x170 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:262 [inline]
NF_HOOK include/linux/netfilter.h:305 [inline]
ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324
inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402
__tcp_send_ack+0x1fd/0x300 net/ipv4/tcp_output.c:3956
tcp_send_ack+0x23/0x30 net/ipv4/tcp_output.c:3962
__tcp_ack_snd_check+0x2d8/0x510 net/ipv4/tcp_input.c:5478
tcp_ack_snd_check net/ipv4/tcp_input.c:5523 [inline]
tcp_rcv_established+0x8c2/0x10e0 net/ipv4/tcp_input.c:5948
tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521
sk_backlog_rcv include/net/sock.h:1030 [inline]
__release_sock+0xf2/0x270 net/core/sock.c:2768
release_sock+0x40/0x110 net/core/sock.c:3300
tcp_sendpage+0x94/0xb0 net/ipv4/tcp.c:1114
inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833
rds_tcp_xmit+0x376/0x5f0 net/rds/tcp_send.c:118
rds_send_xmit+0xbed/0x1500 net/rds/send.c:367
rds_send_worker+0x43/0x200 net/rds/threads.c:200
process_one_work+0x3fc/0x980 kernel/workqueue.c:2298
worker_thread+0x616/0xa70 kernel/workqueue.c:2445
kthread+0x2c7/0x2e0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
value changed: 0x00027cc2 -> 0x00000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17446 Comm: kworker/u4:5 Tainted: G W 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_send_worker
Note: I chose an arbitrary commit for the Fixes: tag,
because I do not think we need to backport this fix to very old kernels.
Fixes:
|
||
---|---|---|
.. | ||
ipset | ||
ipvs | ||
core.c | ||
Kconfig | ||
Makefile | ||
nf_conncount.c | ||
nf_conntrack_acct.c | ||
nf_conntrack_amanda.c | ||
nf_conntrack_broadcast.c | ||
nf_conntrack_core.c | ||
nf_conntrack_ecache.c | ||
nf_conntrack_expect.c | ||
nf_conntrack_extend.c | ||
nf_conntrack_ftp.c | ||
nf_conntrack_h323_asn1.c | ||
nf_conntrack_h323_main.c | ||
nf_conntrack_h323_types.c | ||
nf_conntrack_helper.c | ||
nf_conntrack_irc.c | ||
nf_conntrack_labels.c | ||
nf_conntrack_netbios_ns.c | ||
nf_conntrack_netlink.c | ||
nf_conntrack_pptp.c | ||
nf_conntrack_proto.c | ||
nf_conntrack_proto_dccp.c | ||
nf_conntrack_proto_generic.c | ||
nf_conntrack_proto_gre.c | ||
nf_conntrack_proto_icmp.c | ||
nf_conntrack_proto_icmpv6.c | ||
nf_conntrack_proto_sctp.c | ||
nf_conntrack_proto_tcp.c | ||
nf_conntrack_proto_udp.c | ||
nf_conntrack_sane.c | ||
nf_conntrack_seqadj.c | ||
nf_conntrack_sip.c | ||
nf_conntrack_snmp.c | ||
nf_conntrack_standalone.c | ||
nf_conntrack_tftp.c | ||
nf_conntrack_timeout.c | ||
nf_conntrack_timestamp.c | ||
nf_dup_netdev.c | ||
nf_flow_table_core.c | ||
nf_flow_table_inet.c | ||
nf_flow_table_ip.c | ||
nf_flow_table_offload.c | ||
nf_hooks_lwtunnel.c | ||
nf_internals.h | ||
nf_log.c | ||
nf_log_syslog.c | ||
nf_nat_amanda.c | ||
nf_nat_core.c | ||
nf_nat_ftp.c | ||
nf_nat_helper.c | ||
nf_nat_irc.c | ||
nf_nat_masquerade.c | ||
nf_nat_proto.c | ||
nf_nat_redirect.c | ||
nf_nat_sip.c | ||
nf_nat_tftp.c | ||
nf_queue.c | ||
nf_sockopt.c | ||
nf_synproxy_core.c | ||
nf_tables_api.c | ||
nf_tables_core.c | ||
nf_tables_offload.c | ||
nf_tables_trace.c | ||
nfnetlink.c | ||
nfnetlink_acct.c | ||
nfnetlink_cthelper.c | ||
nfnetlink_cttimeout.c | ||
nfnetlink_hook.c | ||
nfnetlink_log.c | ||
nfnetlink_osf.c | ||
nfnetlink_queue.c | ||
nft_bitwise.c | ||
nft_byteorder.c | ||
nft_chain_filter.c | ||
nft_chain_nat.c | ||
nft_chain_route.c | ||
nft_cmp.c | ||
nft_compat.c | ||
nft_connlimit.c | ||
nft_counter.c | ||
nft_ct.c | ||
nft_dup_netdev.c | ||
nft_dynset.c | ||
nft_exthdr.c | ||
nft_fib.c | ||
nft_fib_inet.c | ||
nft_fib_netdev.c | ||
nft_flow_offload.c | ||
nft_fwd_netdev.c | ||
nft_hash.c | ||
nft_immediate.c | ||
nft_last.c | ||
nft_limit.c | ||
nft_log.c | ||
nft_lookup.c | ||
nft_masq.c | ||
nft_meta.c | ||
nft_nat.c | ||
nft_numgen.c | ||
nft_objref.c | ||
nft_osf.c | ||
nft_payload.c | ||
nft_queue.c | ||
nft_quota.c | ||
nft_range.c | ||
nft_redir.c | ||
nft_reject.c | ||
nft_reject_inet.c | ||
nft_reject_netdev.c | ||
nft_rt.c | ||
nft_set_bitmap.c | ||
nft_set_hash.c | ||
nft_set_pipapo.c | ||
nft_set_pipapo.h | ||
nft_set_pipapo_avx2.c | ||
nft_set_pipapo_avx2.h | ||
nft_set_rbtree.c | ||
nft_socket.c | ||
nft_synproxy.c | ||
nft_tproxy.c | ||
nft_tunnel.c | ||
nft_xfrm.c | ||
utils.c | ||
x_tables.c | ||
xt_addrtype.c | ||
xt_AUDIT.c | ||
xt_bpf.c | ||
xt_cgroup.c | ||
xt_CHECKSUM.c | ||
xt_CLASSIFY.c | ||
xt_cluster.c | ||
xt_comment.c | ||
xt_connbytes.c | ||
xt_connlabel.c | ||
xt_connlimit.c | ||
xt_connmark.c | ||
xt_CONNSECMARK.c | ||
xt_conntrack.c | ||
xt_cpu.c | ||
xt_CT.c | ||
xt_dccp.c | ||
xt_devgroup.c | ||
xt_DSCP.c | ||
xt_dscp.c | ||
xt_ecn.c | ||
xt_esp.c | ||
xt_hashlimit.c | ||
xt_helper.c | ||
xt_HL.c | ||
xt_hl.c | ||
xt_HMARK.c | ||
xt_IDLETIMER.c | ||
xt_ipcomp.c | ||
xt_iprange.c | ||
xt_ipvs.c | ||
xt_l2tp.c | ||
xt_LED.c | ||
xt_length.c | ||
xt_limit.c | ||
xt_LOG.c | ||
xt_mac.c | ||
xt_mark.c | ||
xt_MASQUERADE.c | ||
xt_multiport.c | ||
xt_nat.c | ||
xt_NETMAP.c | ||
xt_nfacct.c | ||
xt_NFLOG.c | ||
xt_NFQUEUE.c | ||
xt_osf.c | ||
xt_owner.c | ||
xt_physdev.c | ||
xt_pkttype.c | ||
xt_policy.c | ||
xt_quota.c | ||
xt_RATEEST.c | ||
xt_rateest.c | ||
xt_realm.c | ||
xt_recent.c | ||
xt_REDIRECT.c | ||
xt_repldata.h | ||
xt_sctp.c | ||
xt_SECMARK.c | ||
xt_set.c | ||
xt_socket.c | ||
xt_state.c | ||
xt_statistic.c | ||
xt_string.c | ||
xt_TCPMSS.c | ||
xt_tcpmss.c | ||
xt_TCPOPTSTRIP.c | ||
xt_tcpudp.c | ||
xt_TEE.c | ||
xt_time.c | ||
xt_TPROXY.c | ||
xt_TRACE.c | ||
xt_u32.c |