• Davide Caratti's avatar
    netlabel: fix RCU annotation for IPv4 options on socket creation · 8ec9897e
    Davide Caratti authored
    Xiumei reports the following splat when netlabel and TCP socket are used:
    
     =============================
     WARNING: suspicious RCU usage
     6.9.0-rc2+ #637 Not tainted
     -----------------------------
     net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage!
    
     other info that might help us debug this:
    
     rcu_scheduler_active = 2, debug_locks = 1
     1 lock held by ncat/23333:
      #0: ffffffff906030c0 (rcu_read_lock){....}-{1:2}, at: netlbl_sock_setattr+0x25/0x1b0
    
     stack backtrace:
     CPU: 11 PID: 23333 Comm: ncat Kdump: loaded Not tainted 6.9.0-rc2+ #637
     Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013
     Call Trace:
      <TASK>
      dump_stack_lvl+0xa9/0xc0
      lockdep_rcu_suspicious+0x117/0x190
      cipso_v4_sock_setattr+0x1ab/0x1b0
      netlbl_sock_setattr+0x13e/0x1b0
      selinux_netlbl_socket_post_create+0x3f/0x80
      selinux_socket_post_create+0x1a0/0x460
      security_socket_post_create+0x42/0x60
      __sock_create+0x342/0x3a0
      __sys_socket_create.part.22+0x42/0x70
      __sys_socket+0x37/0xb0
      __x64_sys_socket+0x16/0x20
      do_syscall_64+0x96/0x180
      ? do_user_addr_fault+0x68d/0xa30
      ? exc_page_fault+0x171/0x280
      ? asm_exc_page_fault+0x22/0x30
      entry_SYSCALL_64_after_hwframe+0x71/0x79
     RIP: 0033:0x7fbc0ca3fc1b
     Code: 73 01 c3 48 8b 0d 05 f2 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d5 f1 1b 00 f7 d8 64 89 01 48
     RSP: 002b:00007fff18635208 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
     RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbc0ca3fc1b
     RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
     RBP: 000055d24f80f8a0 R08: 0000000000000003 R09: 0000000000000001
    
    R10: 0000000000020000 R11: 0000000000000246 R12: 000055d24f80f8a0
     R13: 0000000000000000 R14: 000055d24f80fb88 R15: 0000000000000000
      </TASK>
    
    The current implementation of cipso_v4_sock_setattr() replaces IP options
    under the assumption that the caller holds the socket lock; however, such
    assumption is not true, nor needed, in selinux_socket_post_create() hook.
    
    Let all callers of cipso_v4_sock_setattr() specify the "socket lock held"
    condition, except selinux_socket_post_create() _ where such condition can
    safely be set as true even without holding the socket lock.
    
    Fixes: f6d8bd05 ("inet: add RCU protection to inet->opt")
    Reported-by: default avatarXiumei Mu <xmu@redhat.com>
    Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
    Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    Acked-by: default avatarPaul Moore <paul@paul-moore.com>
    Link: https://lore.kernel.org/r/f4260d000a3a55b9e8b6a3b4e3fffc7da9f82d41.1715359817.git.dcaratti@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    8ec9897e
netlabel.h 20.2 KB