linux-kernel - Re: [syzbot] [can?] possible deadlock in j1939_sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0000000000009e59f4060035f595@google.com>
Date:   Tue, 11 Jul 2023 06:20:14 -0700
From:   syzbot <syzbot+1591462f226d9cbf0564@...kaller.appspotmail.com>
To:     hdanton@...a.com
Cc:     hdanton@...a.com, linux-kernel@...r.kernel.org,
        syzkaller@...glegroups.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [can?] possible deadlock in j1939_sk_errqueue (2)

> On Mon, 10 Jul 2023 10:53:57 -0700
>> HEAD commit:    e40939bbfc68 Merge branch 'for-next/core' into for-kernelci
>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=178f78d4a80000
>
> Put session without the session list lock held.
>
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git  e40939bbfc68

Your commands are accepted, but please keep syzkaller-bugs@...glegroups.com mailing list in CC next time. It serves as a history of what happened with each bug report. Thank you.

>
> --- x/net/can/j1939/transport.c
> +++ y/net/can/j1939/transport.c
> @@ -1083,7 +1083,6 @@ static bool j1939_session_deactivate_loc
>  
>  		list_del_init(&session->active_session_list_entry);
>  		session->state = J1939_SESSION_DONE;
> -		j1939_session_put(session);
>  	}
>  
>  	return active;
> @@ -1098,6 +1097,9 @@ static bool j1939_session_deactivate(str
>  	active = j1939_session_deactivate_locked(session);
>  	j1939_session_list_unlock(priv);
>  
> +	if (active)
> +		j1939_session_put(session);
> +
>  	return active;
>  }
>  
> @@ -2178,6 +2180,7 @@ void j1939_simple_recv(struct j1939_priv
>  int j1939_cancel_active_session(struct j1939_priv *priv, struct sock *sk)
>  {
>  	struct j1939_session *session, *saved;
> +	LIST_HEAD(active);
>  
>  	netdev_dbg(priv->ndev, "%s, sk: %p\n", __func__, sk);
>  	j1939_session_list_lock(priv);
> @@ -2191,10 +2194,16 @@ int j1939_cancel_active_session(struct j
>  				j1939_session_put(session);
>  
>  			session->err = ESHUTDOWN;
> -			j1939_session_deactivate_locked(session);
> +			if (j1939_session_deactivate_locked(session))
> +				list_move(&session->active_session_list_entry, &active);
>  		}
>  	}
>  	j1939_session_list_unlock(priv);
> +
> +	list_for_each_entry_safe(session, saved, &active, active_session_list_entry) {
> +		list_del_init(&session->active_session_list_entry);
> +		j1939_session_put(session);
> +	}
>  	return NOTIFY_DONE;
>  }
>  
> --