• Eric Dumazet's avatar
    netlink: do not reset transport header in netlink_recvmsg() · d5076fe4
    Eric Dumazet authored
    netlink_recvmsg() does not need to change transport header.
    
    If transport header was needed, it should have been reset
    by the producer (netlink_dump()), not the consumer(s).
    
    The following trace probably happened when multiple threads
    were using MSG_PEEK.
    
    BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg
    
    write to 0xffff88811e9f15b2 of 2 bytes by task 32012 on cpu 1:
     skb_reset_transport_header include/linux/skbuff.h:2760 [inline]
     netlink_recvmsg+0x1de/0x790 net/netlink/af_netlink.c:1978
     sock_recvmsg_nosec net/socket.c:948 [inline]
     sock_recvmsg net/socket.c:966 [inline]
     __sys_recvfrom+0x204/0x2c0 net/socket.c:2097
     __do_sys_recvfrom net/socket.c:2115 [inline]
     __se_sys_recvfrom net/socket.c:2111 [inline]
     __x64_sys_recvfrom+0x74/0x90 net/socket.c:2111
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    write to 0xffff88811e9f15b2 of 2 bytes by task 32005 on cpu 0:
     skb_reset_transport_header include/linux/skbuff.h:2760 [inline]
     netlink_recvmsg+0x1de/0x790 net/netlink/af_netlink.c:1978
     ____sys_recvmsg+0x162/0x2f0
     ___sys_recvmsg net/socket.c:2674 [inline]
     __sys_recvmsg+0x209/0x3f0 net/socket.c:2704
     __do_sys_recvmsg net/socket.c:2714 [inline]
     __se_sys_recvmsg net/socket.c:2711 [inline]
     __x64_sys_recvmsg+0x42/0x50 net/socket.c:2711
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0xffff -> 0x0000
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 32005 Comm: syz-executor.4 Not tainted 5.18.0-rc1-syzkaller-00328-ge1f700eb-dirty #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Link: https://lore.kernel.org/r/20220505161946.2867638-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    d5076fe4
af_netlink.c 68.1 KB