netdev - Re: [PATCH net] ipvs: move old_secure_tcp into struct netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 24 Oct 2019 12:08:55 +0200
From:   Simon Horman <horms@...ge.net.au>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        syzbot <syzkaller@...glegroups.com>,
        Wensong Zhang <wensong@...ux-vs.org>,
        Julian Anastasov <ja@....bg>
Subject: Re: [PATCH net] ipvs: move old_secure_tcp into struct netns_ipvs

On Wed, Oct 23, 2019 at 09:53:03AM -0700, Eric Dumazet wrote:
> syzbot reported the following issue :
> 
> BUG: KCSAN: data-race in update_defense_level / update_defense_level
> 
> read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1:
>  update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177
>  defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
>  process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
>  worker_thread+0xa0/0x800 kernel/workqueue.c:2415
>  kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
> 
> write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0:
>  update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205
>  defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
>  process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
>  worker_thread+0xa0/0x800 kernel/workqueue.c:2415
>  kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
> 
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: events defense_work_handler
> 
> Indeed, old_secure_tcp is currently a static variable, while it
> needs to be a per netns variable.
> 
> Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Cc: Wensong Zhang <wensong@...ux-vs.org>
> Cc: Simon Horman <horms@...ge.net.au>
> Cc: Julian Anastasov <ja@....bg>

Thanks Eric,

I will apply this to the ipvs tree which feeds into the nf tree.