• Eric Dumazet's avatar
    inet: remove races in inet{6}_getname() · 9dfc685e
    Eric Dumazet authored
    syzbot reported data-races in inet_getname() multiple times,
    it is time we fix this instead of pretending applications
    should not trigger them.
    
    getsockname() and getpeername() are not really considered fast path.
    
    v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
        needed when CONFIG_CGROUP_BPF=n, as reported by
        kernel test robot <lkp@intel.com>
    
    syzbot typical report:
    
    BUG: KCSAN: data-race in __inet_hash_connect / inet_getname
    
    write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
     __inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
     inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
     tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
     __inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
     inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
     __sys_connect_file net/socket.c:1896 [inline]
     __sys_connect+0x254/0x290 net/socket.c:1913
     __do_sys_connect net/socket.c:1923 [inline]
     __se_sys_connect net/socket.c:1920 [inline]
     __x64_sys_connect+0x3d/0x50 net/socket.c:1920
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
     inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
     __sys_getsockname+0x11d/0x1b0 net/socket.c:1946
     __do_sys_getsockname net/socket.c:1961 [inline]
     __se_sys_getsockname net/socket.c:1958 [inline]
     __x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0x0000 -> 0xdee0
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    9dfc685e
af_inet6.c 31 KB