Xin Long 692803b39a tipc: force a dst refcount before doing decryption ... [ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ] As it says in commit 3bc07321cc ("xfrm: Force a dst refcount before entering the xfrm type handlers"): "Crypto requests might return asynchronous. In this case we leave the rcu protected region, so force a refcount on the skb's destination entry before we enter the xfrm type input/output handlers." On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a possible crash. Shuang reported this issue when this warning is triggered: [] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug [] Workqueue: crypto cryptd_queue_worker [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Call Trace: [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc] [] tipc_rcv+0xcf5/0x1060 [tipc] [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc] [] cryptd_aead_crypt+0xdb/0x190 [] cryptd_queue_worker+0xed/0x190 [] process_one_work+0x93d/0x17e0 Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication") Reported-by: Shuang Li <shuali@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://lore.kernel.org/r/fbe3195fad6997a4eec62d9bf076b2ad03ac336b.1718476040.git.lucien.xin@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-07-05 09:14:30 +02:00
..
Kconfig	…
Makefile	…
addr.c	…
addr.h	…
bcast.c	…
bcast.h	…
bearer.c	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-23 08:54:58 +01:00
bearer.h	…
core.c	…
core.h	…
crypto.c	…
crypto.h	…
diag.c	…
discover.c	…
discover.h	…
eth_media.c	…
group.c	…
group.h	…
ib_media.c	…
link.c	…
link.h	…
monitor.c	…
monitor.h	…
msg.c	tipc: fix UAF in error path	2024-05-17 11:51:04 +02:00
msg.h	…
name_distr.c	…
name_distr.h	…
name_table.c	…
name_table.h	…
net.c	…
net.h	…
netlink.c	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING	2023-11-20 11:08:28 +01:00
netlink.h	…
netlink_compat.c	tipc: Fix kernel-infoleak due to uninitialized TLV value	2023-11-28 16:56:23 +00:00
node.c	tipc: force a dst refcount before doing decryption	2024-07-05 09:14:30 +02:00
node.h	…
socket.c	…
socket.h	…
subscr.c	…
subscr.h	…
sysctl.c	…
topsrv.c	…
topsrv.h	…
trace.c	…
trace.h	…
udp_media.c	…
udp_media.h	…