linux_dsm_epyc7002/drivers/net
Taehee Yoo 43511a6a16 bonding: fix suspicious RCU usage in bond_ipsec_del_sa()
[ Upstream commit a22c39b831a081da9b2c488bd970a4412d926f30 ]

To dereference bond->curr_active_slave, it uses rcu_dereference().
But it and the caller doesn't acquire RCU so a warning occurs.
So add rcu_read_lock().

Test commands:
    ip netns add A
    ip netns exec A bash
    modprobe netdevsim
    echo "1 1" > /sys/bus/netdevsim/new_device
    ip link add bond0 type bond
    ip link set eth0 master bond0
    ip link set eth0 up
    ip link set bond0 up
    ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi 0x07 mode \
transport reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
0x44434241343332312423222114131211f4f3f2f1 128 sel src 14.0.0.52/24 \
dst 14.0.0.70/24 proto tcp offload dev bond0 dir in
    ip x s f

Splat looks like:
=============================
WARNING: suspicious RCU usage
5.13.0-rc3+ #1168 Not tainted
-----------------------------
drivers/net/bonding/bond_main.c:448 suspicious rcu_dereference_check()
usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by ip/705:
 #0: ffff888106701780 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{3:3},
at: xfrm_netlink_rcv+0x59/0x80 [xfrm_user]
 #1: ffff8880075b0098 (&x->lock){+.-.}-{2:2},
at: xfrm_state_delete+0x16/0x30

stack backtrace:
CPU: 6 PID: 705 Comm: ip Not tainted 5.13.0-rc3+ #1168
Call Trace:
 dump_stack+0xa4/0xe5
 bond_ipsec_del_sa+0x16a/0x1c0 [bonding]
 __xfrm_state_delete+0x51f/0x730
 xfrm_state_delete+0x1e/0x30
 xfrm_state_flush+0x22f/0x390
 xfrm_flush_sa+0xd8/0x260 [xfrm_user]
 ? xfrm_flush_policy+0x290/0x290 [xfrm_user]
 xfrm_user_rcv_msg+0x331/0x660 [xfrm_user]
 ? rcu_read_lock_sched_held+0x91/0xc0
 ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
 ? find_held_lock+0x3a/0x1c0
 ? mutex_lock_io_nested+0x1210/0x1210
 ? sched_clock_cpu+0x18/0x170
 netlink_rcv_skb+0x121/0x350
[ ... ]

Fixes: 18cb261afd ("bonding: support hardware encryption offload to slaves")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-28 14:35:33 +02:00
..
appletalk net: appletalk: cops: Fix data race in cops_probe1 2021-06-16 12:01:37 +02:00
arcnet
bonding bonding: fix suspicious RCU usage in bond_ipsec_del_sa() 2021-07-28 14:35:33 +02:00
caif net: caif: fix memory leak in ldisc_open 2021-06-30 08:47:21 -04:00
can can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path 2021-07-14 16:55:41 +02:00
dsa net: dsa: mv88e6xxx: enable devlink ATU hash param for Topaz 2021-07-25 14:36:18 +02:00
ethernet ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops 2021-07-28 14:35:33 +02:00
fddi net: fddi: fix UAF in fza_probe 2021-07-25 14:36:20 +02:00
fjes fjes: check return value after calling platform_get_resource() 2021-07-19 09:44:49 +02:00
hamradio net: hamradio: fix memory leak in mkiss_close 2021-06-23 14:42:46 +02:00
hippi
hyperv
ieee802154 ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() 2021-07-14 16:56:26 +02:00
ipa net: ipa: Add missing of_node_put() in ipa_firmware_load() 2021-07-19 09:44:51 +02:00
ipvlan
mdio net: mdio: ipq8064: add regmap config to disable REGCACHE 2021-07-19 09:44:39 +02:00
netdevsim net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops 2021-07-25 14:36:19 +02:00
pcs
phy net: phy: realtek: add delay to fix RXC generation issue 2021-07-19 09:44:49 +02:00
plip
ppp
slip
team
usb r8152: Avoid memcpy() over-reading of ETH_SS_STATS 2021-06-30 08:47:22 -04:00
vmxnet3 vmxnet3: fix cksum offload issues for tunnels with non-default udp ports 2021-07-25 14:36:19 +02:00
wan net: lapbether: Prevent racing when checking whether the netif is running 2021-05-14 09:50:29 +02:00
wimax
wireguard wireguard: allowedips: free empty intermediate nodes when removing single node 2021-06-10 13:39:24 +02:00
wireless ath11k: unlock on error path in ath11k_mac_op_add_interface() 2021-07-19 09:44:55 +02:00
xen-netback xen-netback: take a reference to the RX task thread 2021-06-10 13:39:29 +02:00
bareudp.c
dummy.c
eql.c
geneve.c net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb 2021-05-14 09:50:43 +02:00
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c net: macsec: fix the length used to copy the key for offloading 2021-07-14 16:56:28 +02:00
macvlan.c
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c
veth.c
virtio_net.c virtio_net: move tx vq operation under tx queue lock 2021-07-20 16:05:52 +02:00
vrf.c vrf: do not push non-ND strict packets with a source LLA through packet taps again 2021-07-14 16:56:24 +02:00
vsockmon.c
vxlan.c vxlan: add missing rcu_read_lock() in neigh_reduce() 2021-07-14 16:56:25 +02:00
xen-netfront.c