netdev - Re: [PATCH net] xfrm: fix a data-race in xfrm_gen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 9 Sep 2023 08:54:30 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, eric.dumazet@...il.com,
	syzbot <syzkaller@...glegroups.com>,
	Steffen Klassert <steffen.klassert@...unet.com>
Subject: Re: [PATCH net] xfrm: fix a data-race in xfrm_gen_index()

On Fri, Sep 08, 2023 at 06:13:59PM +0000, Eric Dumazet wrote:
> xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock.
> 
> This means we must use a per-netns idx_generator variable,
> instead of a static one.
> Alternative would be to use an atomic variable.
> 
> syzbot reported:
> 
> BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert
> 
> write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0:
> xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline]
> xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347
> xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
> do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
> ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
> rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
> sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
> __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
> __do_sys_setsockopt net/socket.c:2274 [inline]
> __se_sys_setsockopt net/socket.c:2271 [inline]
> __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1:
> xfrm_sk_policy_insert+0x13e/0x640
> xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
> do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
> ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
> rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
> sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
> __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
> __do_sys_setsockopt net/socket.c:2274 [inline]
> __se_sys_setsockopt net/socket.c:2271 [inline]
> __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> value changed: 0x00006ad8 -> 0x00006b18
> 
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
> 
> Fixes: 1121994c803f ("netns xfrm: policy insertion in netns")
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Steffen Klassert <steffen.klassert@...unet.com>
> Cc: Herbert Xu <herbert@...dor.apana.org.au>
> ---
>  include/net/netns/xfrm.h | 1 +
>  net/xfrm/xfrm_policy.c   | 6 ++----
>  2 files changed, 3 insertions(+), 4 deletions(-)

Acked-by: Herbert Xu <herbert@...dor.apana.org.au>

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt