• Greg Hackmann's avatar
    net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() · 0dcd7876
    Greg Hackmann authored
    f7c83bcb ("net: xfrm: use __this_cpu_read per-cpu helper") added a
    __this_cpu_read() call inside ipcomp_alloc_tfms().
    
    At the time, __this_cpu_read() required the caller to either not care
    about races or to handle preemption/interrupt issues.  3.15 tightened
    the rules around some per-cpu operations, and now __this_cpu_read()
    should never be used in a preemptible context.  On 3.15 and later, we
    need to use this_cpu_read() instead.
    
    syzkaller reported this leading to the following kernel BUG while
    fuzzing sendmsg:
    
    BUG: using __this_cpu_read() in preemptible [00000000] code: repro/3101
    caller is ipcomp_init_state+0x185/0x990
    CPU: 3 PID: 3101 Comm: repro Not tainted 4.16.0-rc4-00123-g86f84779 #154
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
    Call Trace:
     dump_stack+0xb9/0x115
     check_preemption_disabled+0x1cb/0x1f0
     ipcomp_init_state+0x185/0x990
     ? __xfrm_init_state+0x876/0xc20
     ? lock_downgrade+0x5e0/0x5e0
     ipcomp4_init_state+0xaa/0x7c0
     __xfrm_init_state+0x3eb/0xc20
     xfrm_init_state+0x19/0x60
     pfkey_add+0x20df/0x36f0
     ? pfkey_broadcast+0x3dd/0x600
     ? pfkey_sock_destruct+0x340/0x340
     ? pfkey_seq_stop+0x80/0x80
     ? __skb_clone+0x236/0x750
     ? kmem_cache_alloc+0x1f6/0x260
     ? pfkey_sock_destruct+0x340/0x340
     ? pfkey_process+0x62a/0x6f0
     pfkey_process+0x62a/0x6f0
     ? pfkey_send_new_mapping+0x11c0/0x11c0
     ? mutex_lock_io_nested+0x1390/0x1390
     pfkey_sendmsg+0x383/0x750
     ? dump_sp+0x430/0x430
     sock_sendmsg+0xc0/0x100
     ___sys_sendmsg+0x6c8/0x8b0
     ? copy_msghdr_from_user+0x3b0/0x3b0
     ? pagevec_lru_move_fn+0x144/0x1f0
     ? find_held_lock+0x32/0x1c0
     ? do_huge_pmd_anonymous_page+0xc43/0x11e0
     ? lock_downgrade+0x5e0/0x5e0
     ? get_kernel_page+0xb0/0xb0
     ? _raw_spin_unlock+0x29/0x40
     ? do_huge_pmd_anonymous_page+0x400/0x11e0
     ? __handle_mm_fault+0x553/0x2460
     ? __fget_light+0x163/0x1f0
     ? __sys_sendmsg+0xc7/0x170
     __sys_sendmsg+0xc7/0x170
     ? SyS_shutdown+0x1a0/0x1a0
     ? __do_page_fault+0x5a0/0xca0
     ? lock_downgrade+0x5e0/0x5e0
     SyS_sendmsg+0x27/0x40
     ? __sys_sendmsg+0x170/0x170
     do_syscall_64+0x19f/0x640
     entry_SYSCALL_64_after_hwframe+0x42/0xb7
    RIP: 0033:0x7f0ee73dfb79
    RSP: 002b:00007ffe14fc15a8 EFLAGS: 00000207 ORIG_RAX: 000000000000002e
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ee73dfb79
    RDX: 0000000000000000 RSI: 00000000208befc8 RDI: 0000000000000004
    RBP: 00007ffe14fc15b0 R08: 00007ffe14fc15c0 R09: 00007ffe14fc15c0
    R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000400440
    R13: 00007ffe14fc16b0 R14: 0000000000000000 R15: 0000000000000000
    Signed-off-by: default avatarGreg Hackmann <ghackmann@google.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    0dcd7876
xfrm_ipcomp.c 7.63 KB