linux_dsm_epyc7002/net/tipc
Xin Long f473789db5 tipc: increment the tmp aead refcnt before attaching it
[ Upstream commit 2a2403ca3add03f542f6b34bef9f74649969b06d ]

Li Shuang found a NULL pointer dereference crash in her testing:

  [] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  [] RIP: 0010:tipc_crypto_rcv_complete+0xc8/0x7e0 [tipc]
  [] Call Trace:
  []  <IRQ>
  []  tipc_crypto_rcv+0x2d9/0x8f0 [tipc]
  []  tipc_rcv+0x2fc/0x1120 [tipc]
  []  tipc_udp_recv+0xc6/0x1e0 [tipc]
  []  udpv6_queue_rcv_one_skb+0x16a/0x460
  []  udp6_unicast_rcv_skb.isra.35+0x41/0xa0
  []  ip6_protocol_deliver_rcu+0x23b/0x4c0
  []  ip6_input+0x3d/0xb0
  []  ipv6_rcv+0x395/0x510
  []  __netif_receive_skb_core+0x5fc/0xc40

This is caused by NULL returned by tipc_aead_get(), and then crashed when
dereferencing it later in tipc_crypto_rcv_complete(). This might happen
when tipc_crypto_rcv_complete() is called by two threads at the same time:
the tmp attached by tipc_crypto_key_attach() in one thread may be released
by the one attached by that in the other thread.

This patch is to fix it by incrementing the tmp's refcnt before attaching
it instead of calling tipc_aead_get() after attaching it.

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Reported-by: Li Shuang <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-14 08:42:11 +02:00
..
addr.c
addr.h
bcast.c tipc: fix incorrect setting window for bcast link 2020-10-16 14:09:12 -07:00
bcast.h
bearer.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
bearer.h
core.c tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
core.h tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
crypto.c tipc: increment the tmp aead refcnt before attaching it 2021-04-14 08:42:11 +02:00
crypto.h tipc: add automatic rekeying for encryption key 2020-09-18 13:58:37 -07:00
diag.c
discover.c
discover.h
eth_media.c
group.c tipc: Fix memory leak in tipc_group_create_member() 2020-09-14 16:36:20 -07:00
group.h
ib_media.c
Kconfig
link.c tipc: fix NULL deref in tipc_link_xmit() 2021-01-23 16:04:00 +01:00
link.h
Makefile
monitor.c
monitor.h
msg.c tipc: fix memory leak caused by tipc_buf_append() 2020-10-29 09:51:52 -07:00
msg.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
name_distr.c tipc: fix NULL pointer dereference in tipc_named_rcv 2020-10-09 18:29:06 -07:00
name_distr.h
name_table.c
name_table.h
net.c tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
net.h tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
netlink_compat.c genetlink: move to smaller ops wherever possible 2020-10-02 19:11:11 -07:00
netlink.c tipc: add automatic rekeying for encryption key 2020-09-18 13:58:37 -07:00
netlink.h
node.c tipc: better validate user input in tipc_nl_retrieve_key() 2021-03-30 14:31:59 +02:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c net:tipc: Fix a double free in tipc_sk_mcast_rcv 2021-04-14 08:42:08 +02:00
socket.h
subscr.c
subscr.h
sysctl.c tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
topsrv.c tipc: fix memory leak in tipc_topsrv_start() 2020-11-11 14:39:23 -08:00
topsrv.h
trace.c
trace.h
udp_media.c net: tipc: Supply missing udp_media.h include file 2020-09-18 14:56:44 -07:00
udp_media.h