Greg Hackmann
0dcd787602
net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
...
f7c83bcbfa ("net: xfrm: use __this_cpu_read per-cpu helper") added a
__this_cpu_read() call inside ipcomp_alloc_tfms().
At the time, __this_cpu_read() required the caller to either not care
about races or to handle preemption/interrupt issues. 3.15 tightened
the rules around some per-cpu operations, and now __this_cpu_read()
should never be used in a preemptible context. On 3.15 and later, we
need to use this_cpu_read() instead.
syzkaller reported this leading to the following kernel BUG while
fuzzing sendmsg:
BUG: using __this_cpu_read() in preemptible [00000000] code: repro/3101
caller is ipcomp_init_state+0x185/0x990
CPU: 3 PID: 3101 Comm: repro Not tainted 4.16.0-rc4-00123-g86f84779d8e9 #154
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Call Trace:
dump_stack+0xb9/0x115
check_preemption_disabled+0x1cb/0x1f0
ipcomp_init_state+0x185/0x990
? __xfrm_init_state+0x876/0xc20
? lock_downgrade+0x5e0/0x5e0
ipcomp4_init_state+0xaa/0x7c0
__xfrm_init_state+0x3eb/0xc20
xfrm_init_state+0x19/0x60
pfkey_add+0x20df/0x36f0
? pfkey_broadcast+0x3dd/0x600
? pfkey_sock_destruct+0x340/0x340
? pfkey_seq_stop+0x80/0x80
? __skb_clone+0x236/0x750
? kmem_cache_alloc+0x1f6/0x260
? pfkey_sock_destruct+0x340/0x340
? pfkey_process+0x62a/0x6f0
pfkey_process+0x62a/0x6f0
? pfkey_send_new_mapping+0x11c0/0x11c0
? mutex_lock_io_nested+0x1390/0x1390
pfkey_sendmsg+0x383/0x750
? dump_sp+0x430/0x430
sock_sendmsg+0xc0/0x100
___sys_sendmsg+0x6c8/0x8b0
? copy_msghdr_from_user+0x3b0/0x3b0
? pagevec_lru_move_fn+0x144/0x1f0
? find_held_lock+0x32/0x1c0
? do_huge_pmd_anonymous_page+0xc43/0x11e0
? lock_downgrade+0x5e0/0x5e0
? get_kernel_page+0xb0/0xb0
? _raw_spin_unlock+0x29/0x40
? do_huge_pmd_anonymous_page+0x400/0x11e0
? __handle_mm_fault+0x553/0x2460
? __fget_light+0x163/0x1f0
? __sys_sendmsg+0xc7/0x170
__sys_sendmsg+0xc7/0x170
? SyS_shutdown+0x1a0/0x1a0
? __do_page_fault+0x5a0/0xca0
? lock_downgrade+0x5e0/0x5e0
SyS_sendmsg+0x27/0x40
? __sys_sendmsg+0x170/0x170
do_syscall_64+0x19f/0x640
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f0ee73dfb79
RSP: 002b:00007ffe14fc15a8 EFLAGS: 00000207 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ee73dfb79
RDX: 0000000000000000 RSI: 00000000208befc8 RDI: 0000000000000004
RBP: 00007ffe14fc15b0 R08: 00007ffe14fc15c0 R09: 00007ffe14fc15c0
R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000400440
R13: 00007ffe14fc16b0 R14: 0000000000000000 R15: 0000000000000000
Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2018-03-13 07:46:37 +01:00
arch
Merge branch 'work.whack-a-mole' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-31 19:18:12 -08:00
block
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
certs
crypto
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2018-01-31 14:22:45 -08:00
Documentation
Documentation updates for 4.16. New stuff includes refcount_t
2018-01-31 19:25:25 -08:00
drivers
net: pxa168_eth: add netconsole support
2018-02-01 14:58:37 -05:00
firmware
kbuild: remove all dummy assignments to obj-
2017-11-18 11:46:06 +09:00
fs
Documentation updates for 4.16. New stuff includes refcount_t
2018-01-31 19:25:25 -08:00
include
xfrm: reuse uncached_list to track xdsts
2018-02-16 07:03:33 +01:00
init
init_task out-of-lining
2018-01-29 09:08:34 -08:00
ipc
Merge branch 'work.mqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 18:32:21 -08:00
kernel
Merge branch 'akpm' (patches from Andrew)
2018-01-31 18:46:22 -08:00
lib
Documentation updates for 4.16. New stuff includes refcount_t
2018-01-31 19:25:25 -08:00
LICENSES
LICENSES: Add MPL-1.1 license
2018-01-06 10:59:44 -07:00
mm
mm/swap.c: make functions and their kernel-doc agree
2018-01-31 17:18:40 -08:00
net
net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
2018-03-13 07:46:37 +01:00
samples
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2018-01-31 14:31:10 -08:00
scripts
Documentation updates for 4.16. New stuff includes refcount_t
2018-01-31 19:25:25 -08:00
security
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2018-01-31 14:31:10 -08:00
sound
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-31 09:25:20 -08:00
tools
Merge branch 'akpm' (patches from Andrew)
2018-01-31 18:46:22 -08:00
usr
virt
mm, mmu_notifier: annotate mmu notifiers with blockable invalidate callbacks
2018-01-31 17:18:38 -08:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
Kbuild misc updates for v4.15
2017-11-17 17:51:33 -08:00
.mailmap
mailmap: update Mark Yao's email address
2018-01-04 16:45:09 -08:00
COPYING
CREDITS
Kbuild
Kbuild updates for v4.15
2017-11-17 17:45:29 -08:00
Kconfig
MAINTAINERS
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2018-01-31 14:31:10 -08:00
Makefile
Linux 4.15
2018-01-28 13:20:33 -08:00
README