netdev - Re: [PATCH net] tipc: call rcu_read_lock() in tipc_aead_encrypt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200820.164258.1142916452755887278.davem@davemloft.net>
Date:   Thu, 20 Aug 2020 16:42:58 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     lucien.xin@...il.com
Cc:     netdev@...r.kernel.org, jmaloy@...hat.com, ying.xue@...driver.com,
        tipc-discussion@...ts.sourceforge.net, tuong.t.lien@...tech.com.au
Subject: Re: [PATCH net] tipc: call rcu_read_lock() in
 tipc_aead_encrypt_done()

From: Xin Long <lucien.xin@...il.com>
Date: Thu, 20 Aug 2020 15:34:47 +0800

> b->media->send_msg() requires rcu_read_lock(), as we can see
> elsewhere in tipc,  tipc_bearer_xmit, tipc_bearer_xmit_skb
> and tipc_bearer_bc_xmit().
> 
> Syzbot has reported this issue as:
> 
>   net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage!
>   Workqueue: cryptd cryptd_queue_worker
>   Call Trace:
>    tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466
>    tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761
>    cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739
>    cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181
>    process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
>    worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
>    kthread+0x3b5/0x4a0 kernel/kthread.c:291
>    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
> 
> So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done()
> for b->media->send_msg().
> 
> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
> Reported-by: syzbot+47bbc6b678d317cccbe0@...kaller.appspotmail.com
> Signed-off-by: Xin Long <lucien.xin@...il.com>

Applied and queued up for -stable, thank you.