lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAF=yD-JcOHDuOHibSJ1JCst_eKc8Qef_SKtVNGf-y+-VR93UVQ@mail.gmail.com> Date: Thu, 25 May 2023 11:23:43 -0400 From: Willem de Bruijn <willemdebruijn.kernel@...il.com> To: Kuniyuki Iwashima <kuniyu@...zon.com> Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Pavel Emelyanov <xemul@...allels.com>, Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, syzkaller <syzkaller@...glegroups.com> Subject: Re: [PATCH v1 net] af_packet: Fix data-races of pkt_sk(sk)->num. On Wed, May 24, 2023 at 7:30 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote: > > syzkaller found a data race of pkt_sk(sk)->num. > > The value is changed under lock_sock() and po->bind_lock, so we > need READ_ONCE() to access pkt_sk(sk)->num without these locks in > packet_bind_spkt(), packet_bind(), and sk_diag_fill(). > > Note that WRITE_ONCE() is already added by commit c7d2ef5dd4b0 > ("net/packet: annotate accesses to po->bind"). > > BUG: KCSAN: data-race in packet_bind / packet_do_bind > > write (marked) to 0xffff88802ffd1cee of 2 bytes by task 7322 on cpu 0: > packet_do_bind+0x446/0x640 net/packet/af_packet.c:3236 > packet_bind+0x99/0xe0 net/packet/af_packet.c:3321 > __sys_bind+0x19b/0x1e0 net/socket.c:1803 > __do_sys_bind net/socket.c:1814 [inline] > __se_sys_bind net/socket.c:1812 [inline] > __x64_sys_bind+0x40/0x50 net/socket.c:1812 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x72/0xdc > > read to 0xffff88802ffd1cee of 2 bytes by task 7318 on cpu 1: > packet_bind+0xbf/0xe0 net/packet/af_packet.c:3322 > __sys_bind+0x19b/0x1e0 net/socket.c:1803 > __do_sys_bind net/socket.c:1814 [inline] > __se_sys_bind net/socket.c:1812 [inline] > __x64_sys_bind+0x40/0x50 net/socket.c:1812 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x72/0xdc > > value changed: 0x0300 -> 0x0000 > > Reported by Kernel Concurrency Sanitizer on: > CPU: 1 PID: 7318 Comm: syz-executor.4 Not tainted 6.3.0-13380-g7fddb5b5300c #4 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > > Fixes: 96ec6327144e ("packet: Diag core and basic socket info dumping") > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Reported-by: syzkaller <syzkaller@...glegroups.com> > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com> Reviewed-by: Willem de Bruijn <willemb@...gle.com>
Powered by blists - more mailing lists