| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <6915a10c-cc57-4a68-9f91-a5efdf42091d@rbox.co>
Date: Tue, 14 May 2024 12:13:36 +0200
From: Michal Luczaj <mhal@...x.co>
To: Kuniyuki Iwashima <kuniyu@...zon.com>,
"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Cc: Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
Billy Jheng Bing-Jhong <billy@...rlabs.sg>
Subject: Re: [PATCH v4 net] af_unix: Update unix_sk(sk)->oob_skb under
sk_receive_queue lock.
On 5/14/24 04:52, Kuniyuki Iwashima wrote:
> ...
> diff --git a/net/unix/garbage.c b/net/unix/garbage.c
> index 0104be9d4704..b87e48e2b51b 100644
> --- a/net/unix/garbage.c
> +++ b/net/unix/garbage.c
> @@ -342,10 +342,12 @@ static void __unix_gc(struct work_struct *work)
> scan_children(&u->sk, inc_inflight, &hitlist);
>
> #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
> + spin_lock(&u->sk.sk_receive_queue.lock);
> if (u->oob_skb) {
> - kfree_skb(u->oob_skb);
> + WARN_ON_ONCE(skb_unref(u->oob_skb));
> u->oob_skb = NULL;
> }
> + spin_unlock(&u->sk.sk_receive_queue.lock);
> #endif
> }
I've realised this part of GC is broken for embryos. And adding a rq lock
here turns a warning into a possible deadlock, so below is my attempt at
fixing the underlying problem.
It's based it on top of your patch, so should I post it now or wait until
your patch lands in net?
---
Subject: [PATCH] af_unix: Fix garbage collection of embryos carrying
OOB/SCM_RIGHTS
GC attempts to explicitly drop oob_skb before purging the hit list. The
problem is with embryos: instead of trying to kfree_skb(u->oob_skb) of an
embryo socket, GC goes for its parent-listener socket, which never carries
u->oob_skb. Effectively oob_skb is removed from the receive queue, but
remains reachable via u->oob_skb.
Tell GC to dispose the right socket's oob_skb.
Fixes: aa82ac51d633 ("af_unix: Drop oob_skb ref before purging queue in GC.")
Signed-off-by: Michal Luczaj <mhal@...x.co>
---
from array import array
from socket import *
addr = 'unix-oob-splat'
lis = socket(AF_UNIX, SOCK_STREAM)
lis.bind(addr)
lis.listen(1)
s = socket(AF_UNIX, SOCK_STREAM)
s.connect(addr)
scm = (SOL_SOCKET, SCM_RIGHTS, array('i', [lis.fileno()]))
s.sendmsg([b'x'], [scm], MSG_OOB)
lis.close()
[ 22.208683] WARNING: CPU: 2 PID: 546 at net/unix/garbage.c:371 __unix_gc+0x50e/0x520
[ 22.208687] Modules linked in: 9p netfs kvm_intel kvm 9pnet_virtio 9pnet i2c_piix4 zram crct10dif_pclmul crc32_pclmul crc32c_intel virtio_blk ghash_clmulni_intel serio_raw fuse qemu_fw_cfg virtio_console
[ 22.208701] CPU: 2 PID: 546 Comm: kworker/u32:5 Not tainted 6.9.0-rc7nokasan+ #28
[ 22.208703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
[ 22.208704] Workqueue: events_unbound __unix_gc
[ 22.208706] RIP: 0010:__unix_gc+0x50e/0x520
[ 22.208708] Code: 83 fa 01 0f 84 07 fe ff ff 85 d2 0f 8f 01 fe ff ff be 03 00 00 00 e8 f1 f7 9a ff e9 f2 fd ff ff e8 b7 f9 ff ff e9 28 fd ff ff <0f> 0b e9 07 ff ff ff e8 36 0a 1a 00 66 0f 1f 44 00 00 90 90 90 90
[ 22.208710] RSP: 0018:ffffc9000051fd90 EFLAGS: 00010283
[ 22.208712] RAX: ffff88810b316f30 RBX: ffffffff83563230 RCX: 0000000000000001
[ 22.208713] RDX: 0000000000000001 RSI: ffffffff82956cfb RDI: ffffffff83563880
[ 22.208714] RBP: ffffc9000051fe38 R08: 00000000cba2db62 R09: 00000000000003e5
[ 22.208715] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000051fdb0
[ 22.208716] R13: ffff88810b316a00 R14: ffffc9000051fd90 R15: ffffffff83563860
[ 22.208717] FS: 0000000000000000(0000) GS:ffff88842fb00000(0000) knlGS:0000000000000000
[ 22.208718] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 22.208719] CR2: 0000557b30b7406c CR3: 000000011e5be000 CR4: 0000000000750ef0
[ 22.208722] PKRU: 55555554
[ 22.208723] Call Trace:
[ 22.208724] <TASK>
[ 22.208725] ? __warn.cold+0xb1/0x13e
[ 22.208728] ? __unix_gc+0x50e/0x520
[ 22.208730] ? report_bug+0xe6/0x170
[ 22.208733] ? handle_bug+0x3c/0x80
[ 22.208735] ? exc_invalid_op+0x13/0x60
[ 22.208737] ? asm_exc_invalid_op+0x16/0x20
[ 22.208741] ? __unix_gc+0x50e/0x520
[ 22.208747] process_one_work+0x21f/0x590
[ 22.208750] ? move_linked_works+0x70/0xa0
[ 22.208753] worker_thread+0x1bf/0x3d0
[ 22.208756] ? __pfx_worker_thread+0x10/0x10
[ 22.208757] kthread+0xdd/0x110
[ 22.208759] ? __pfx_kthread+0x10/0x10
[ 22.208761] ret_from_fork+0x2d/0x50
[ 22.208763] ? __pfx_kthread+0x10/0x10
[ 22.208765] ret_from_fork_asm+0x1a/0x30
[ 22.208770] </TASK>
[ 22.208771] irq event stamp: 198563
[ 22.208772] hardirqs last enabled at (198569): [<ffffffff811b617d>] console_unlock+0x10d/0x140
[ 22.208775] hardirqs last disabled at (198574): [<ffffffff811b6162>] console_unlock+0xf2/0x140
[ 22.208777] softirqs last enabled at (196450): [<ffffffff81110f4d>] __irq_exit_rcu+0x9d/0x100
[ 22.208778] softirqs last disabled at (196445): [<ffffffff81110f4d>] __irq_exit_rcu+0x9d/0x100
net/unix/garbage.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index b87e48e2b51b..beecd0bfbf48 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -170,10 +170,11 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
/* Process the descriptors of this socket */
int nfd = UNIXCB(skb).fp->count;
struct file **fp = UNIXCB(skb).fp->fp;
+ struct unix_sock *u;
while (nfd--) {
/* Get the socket the fd matches if it indeed does so */
- struct unix_sock *u = unix_get_socket(*fp++);
+ u = unix_get_socket(*fp++);
/* Ignore non-candidates, they could have been added
* to the queues after starting the garbage collection
@@ -187,6 +188,14 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
if (hit && hitlist != NULL) {
__skb_unlink(skb, &x->sk_receive_queue);
__skb_queue_tail(hitlist, skb);
+
+#if IS_ENABLED(CONFIG_AF_UNIX_OOB)
+ u = unix_sk(x);
+ if (u->oob_skb == skb) {
+ WARN_ON_ONCE(skb_unref(u->oob_skb));
+ u->oob_skb = NULL;
+ }
+#endif
}
}
}
@@ -338,19 +347,9 @@ static void __unix_gc(struct work_struct *work)
* which are creating the cycle(s).
*/
skb_queue_head_init(&hitlist);
- list_for_each_entry(u, &gc_candidates, link) {
+ list_for_each_entry(u, &gc_candidates, link)
scan_children(&u->sk, inc_inflight, &hitlist);
-#if IS_ENABLED(CONFIG_AF_UNIX_OOB)
- spin_lock(&u->sk.sk_receive_queue.lock);
- if (u->oob_skb) {
- WARN_ON_ONCE(skb_unref(u->oob_skb));
- u->oob_skb = NULL;
- }
- spin_unlock(&u->sk.sk_receive_queue.lock);
-#endif
- }
-
/* not_cycle_list contains those sockets which do not make up a
* cycle. Restore these to the inflight list.
*/
--
2.45.0
Powered by blists - more mailing lists