linux-kernel - Re: net/ipv4: deadlock in ip_ra

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAeHK+wYR=DnbotEu0nneEv2o8MZsStGV6MCZg_3Dy90cb0iJw@mail.gmail.com>
Date:   Wed, 12 Apr 2017 14:05:47 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        David Miller <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        James Morris <jmorris@...ei.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Patrick McHardy <kaber@...sh.net>,
        Eric Dumazet <edumazet@...gle.com>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/ipv4: deadlock in ip_ra_control

On Mon, Mar 6, 2017 at 3:04 AM, Cong Wang <xiyou.wangcong@...il.com> wrote:
> On Fri, Mar 3, 2017 at 10:43 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>> On Thu, Mar 2, 2017 at 10:40 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>>> On Wed, Mar 1, 2017 at 6:18 PM, Cong Wang <xiyou.wangcong@...il.com> wrote:
>>>> On Wed, Mar 1, 2017 at 2:44 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>>>>> Hello,
>>>>>
>>>>> I've got the following deadlock report while running syzkaller fuzzer
>>>>> on linux-next/51788aebe7cae79cb334ad50641347465fc188fd:
>>>>>
>>>>> ======================================================
>>>>> [ INFO: possible circular locking dependency detected ]
>>>>> 4.10.0-next-20170301+ #1 Not tainted
>>>>> -------------------------------------------------------
>>>>> syz-executor1/3394 is trying to acquire lock:
>>>>>  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff838864cc>] lock_sock
>>>>> include/net/sock.h:1460 [inline]
>>>>>  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff838864cc>]
>>>>> do_ip_setsockopt.isra.12+0x21c/0x3540 net/ipv4/ip_sockglue.c:652
>>>>>
>>>>> but task is already holding lock:
>>>>>  (rtnl_mutex){+.+.+.}, at: [<ffffffff836fbd97>] rtnl_lock+0x17/0x20
>>>>> net/core/rtnetlink.c:70
>>>>>
>>>>> which lock already depends on the new lock.
>>>>>
>>>>>
>>>>> the existing dependency chain (in reverse order) is:
>>>>>
>>>>> -> #1 (rtnl_mutex){+.+.+.}:
>>>>>        validate_chain kernel/locking/lockdep.c:2265 [inline]
>>>>>        __lock_acquire+0x2149/0x3430 kernel/locking/lockdep.c:3338
>>>>>        lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3753
>>>>>        __mutex_lock_common kernel/locking/mutex.c:754 [inline]
>>>>>        __mutex_lock+0x172/0x1730 kernel/locking/mutex.c:891
>>>>>        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:906
>>>>>        rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
>>>>>        mrtsock_destruct+0x86/0x2c0 net/ipv4/ipmr.c:1281
>>>>>        ip_ra_control+0x459/0x600 net/ipv4/ip_sockglue.c:372
>>>>>        do_ip_setsockopt.isra.12+0x1064/0x3540 net/ipv4/ip_sockglue.c:1161
>>>>>        ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1264
>>>>>        raw_setsockopt+0xb7/0xd0 net/ipv4/raw.c:839
>>>>>        sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2725
>>>>>        SYSC_setsockopt net/socket.c:1786 [inline]
>>>>>        SyS_setsockopt+0x25c/0x390 net/socket.c:1765
>>>>>        entry_SYSCALL_64_fastpath+0x1f/0xc2
>>>>>
>>>>> -> #0 (sk_lock-AF_INET){+.+.+.}:
>>>>>        check_prev_add kernel/locking/lockdep.c:1828 [inline]
>>>>>        check_prevs_add+0xa8f/0x19f0 kernel/locking/lockdep.c:1938
>>>>>        validate_chain kernel/locking/lockdep.c:2265 [inline]
>>>>>        __lock_acquire+0x2149/0x3430 kernel/locking/lockdep.c:3338
>>>>>        lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3753
>>>>>        lock_sock_nested+0xcb/0x120 net/core/sock.c:2530
>>>>>        lock_sock include/net/sock.h:1460 [inline]
>>>>>        do_ip_setsockopt.isra.12+0x21c/0x3540 net/ipv4/ip_sockglue.c:652
>>>>>        ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1264
>>>>>        tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2721
>>>>>        sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2725
>>>>>        SYSC_setsockopt net/socket.c:1786 [inline]
>>>>>        SyS_setsockopt+0x25c/0x390 net/socket.c:1765
>>>>>        entry_SYSCALL_64_fastpath+0x1f/0xc2
>>>>>
>>>>
>>>> Please try the attached patch (compile only).
>>>
>>>
>>> Pushed the patch to the bots.
>>> Thanks
>>
>>
>> This patch triggers:
>
> Ah, update the patch to fix this.

Hi Cong,

I now have a reproducer for this bug (attached) and your patch fixes it.

Could you send it?

Thanks!

>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@...glegroups.com.
> For more options, visit https://groups.google.com/d/optout.

View attachment "ipv4-ra-control-deadlock-poc.c" of type "text/x-csrc" (6612 bytes)