linux-kernel - [PATCH v2] rxrpc: Fix oops due to abort delegated to rxrpc_input_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <167180558793.2561318.3676238255553061658.stgit@warthog.procyon.org.uk>
Date:   Fri, 23 Dec 2022 14:26:27 +0000
From:   David Howells <dhowells@...hat.com>
To:     marc.dionne@...istor.com
Cc:     dhowells@...hat.com, linux-afs@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v2] rxrpc: Fix oops due to abort delegated to
 rxrpc_input_call_event()

When sendmsg or recvmsg delegate an abort to the I/O thread, this is
processed by rxrpc_input_call_event().  But this may get called before the
call is connected, in which case call->conn might be NULL still.  This can
cause an oops, whereby we go on from aborting the call to trying to emit
ACKs and the attempt to allocate a txbuf for the ACK goes splat:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    ...
    RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157
    ...
    Call Trace:
     rxrpc_send_ACK+0x50/0x13b
     rxrpc_input_call_event+0x1bc/0x68b
     rxrpc_io_thread+0x1b6/0x45f
     kthread+0xe7/0xef
     ret_from_fork+0x22/0x30

Fix this by going to the cleanup in rxrpc_input_call_event() and skipping
the ACK generation stuff, etc. if we complete the delegation of an ABORT
packet.

The problem was caused by doing a "git clone" as that uses an alarm to
report progress, which interrupts waiting calls and causes them to get
prematurely aborted.

A futher problem can happen in call disconnection, where the bundle is
referenced via call->conn - which isn't set yet.  Switch this to
call->bundle instead.

Signed-off-by: David Howells <dhowells@...hat.com>
cc: Marc Dionne <marc.dionne@...istor.com>
cc: linux-afs@...ts.infradead.org
---

 net/rxrpc/call_event.c  |    4 +++-
 net/rxrpc/conn_object.c |    2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index 148bb7fc0415..ce3cad298449 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -395,9 +395,11 @@ bool rxrpc_input_call_event(struct rxrpc_call *call, struct sk_buff *skb)
 	}
 
 	abort_code = smp_load_acquire(&call->send_abort);
-	if (abort_code)
+	if (abort_code) {
 		rxrpc_abort_call(call, 0, call->send_abort, call->send_abort_err,
 				 call->send_abort_why);
+		goto out;
+	}
 
 	if (skb && skb->mark == RXRPC_SKB_MARK_ERROR)
 		goto out;
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 694f94d5a49d..960884c6f87e 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -206,7 +206,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)
 	}
 
 	if (rxrpc_is_client_call(call)) {
-		rxrpc_disconnect_client_call(conn->bundle, call);
+		rxrpc_disconnect_client_call(call->bundle, call);
 	} else {
 		__rxrpc_disconnect_call(conn, call);
 		conn->idle_timestamp = jiffies;