linux-kernel - [PATCH v3] ipc/mqueue: fix potential sleeping issue in mqueue_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240119103703.2004155-1-shaozhengchao@huawei.com>
Date: Fri, 19 Jan 2024 18:37:03 +0800
From: Zhengchao Shao <shaozhengchao@...wei.com>
To: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <edumazet@...gle.com>,
	<kuba@...nel.org>, <pabeni@...hat.com>, <brauner@...nel.org>,
	<jlayton@...nel.org>, <riel@...riel.com>, <jack@...e.cz>,
	<viro@...iv.linux.org.uk>, <hdanton@...a.com>, <yuehaibing@...wei.com>,
	<shaozhengchao@...wei.com>
Subject: [PATCH v3] ipc/mqueue: fix potential sleeping issue in mqueue_flush_file

I analyze the potential sleeping issue of the following processes:
Thread A                                Thread B
..                                     netlink_create  //ref = 1
do_mq_notify                            ...
  sock = netlink_getsockbyfilp          ...     //ref = 2
  info->notify_sock = sock;             ...
..                                     netlink_sendmsg
..                                       skb = netlink_alloc_large_skb  //skb->head is vmalloced
..                                       netlink_unicast
..                                         sk = netlink_getsockbyportid //ref = 3
..                                         netlink_sendskb
..                                           __netlink_sendskb
..                                             skb_queue_tail //put skb to sk_receive_queue
..                                         sock_put //ref = 2
..                                     ...
..                                     netlink_release
..                                       deferred_put_nlk_sk //ref = 1
mqueue_flush_file
  spin_lock
  remove_notification
    netlink_sendskb
      sock_put  //ref = 0
        sk_free
          ...
          __sk_destruct
            netlink_sock_destruct
              skb_queue_purge  //get skb from sk_receive_queue
                ...
                __skb_queue_purge_reason
                  kfree_skb_reason
                    __kfree_skb
                    ...
                    skb_release_all
                      skb_release_head_state
                        netlink_skb_destructor
                          vfree(skb->head)  //sleeping while holding spinlock

In netlink_sendmsg, if the memory pointed to by skb->head is allocated by
vmalloc, and is put to sk_receive_queue queue, also the skb is not freed.
When the mqueue executes flush, the sleeping bug will occur. Put sock
after releasing the spinlock.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
---
v3: Put sock after releasing the spinlock.
v2: CCed some networking maintainer & netdev list
---
 ipc/mqueue.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 5eea4dc0509e..4832343b7049 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -664,12 +664,23 @@ static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
 static int mqueue_flush_file(struct file *filp, fl_owner_t id)
 {
 	struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp));
+	struct sock *sk = NULL;
 
 	spin_lock(&info->lock);
-	if (task_tgid(current) == info->notify_owner)
-		remove_notification(info);
+	if (task_tgid(current) == info->notify_owner) {
+		if (info->notify_owner != NULL &&
+		    info->notify.sigev_notify == SIGEV_THREAD) {
+			sk = info->notify_sock;
+			sock_hold(sk);
+		}
 
+		remove_notification(info);
+	}
 	spin_unlock(&info->lock);
+
+	if (sk)
+		sock_put(sk);
+
 	return 0;
 }
 
-- 
2.34.1