WSL2-Linux-Kernel/net/tipc
Hoang Le cd7789e659 tipc: fix use-after-free Read in tipc_named_reinit
[ Upstream commit 911600bf5a ]

syzbot found the following issue on:
==================================================================
BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0
net/tipc/name_distr.c:413
Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764

CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted
5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Workqueue: events tipc_net_finalize_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495
mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413
 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
[...]
==================================================================

In the commit
d966ddcc38 ("tipc: fix a deadlock when flushing scheduled work"),
the cancel_work_sync() function just to make sure ONLY the work
tipc_net_finalize_work() is executing/pending on any CPU completed before
tipc namespace is destroyed through tipc_exit_net(). But this function
is not guaranteed the work is the last queued. So, the destroyed instance
may be accessed in the work which will try to enqueue later.

In order to completely fix, we re-order the calling of cancel_work_sync()
to make sure the work tipc_net_finalize_work() was last queued and it
must be completed by calling cancel_work_sync().

Reported-by: syzbot+47af19f3307fc9c5c82e@syzkaller.appspotmail.com
Fixes: d966ddcc38 ("tipc: fix a deadlock when flushing scheduled work")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-29 09:03:22 +02:00
..
Kconfig
Makefile
addr.c tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
addr.h tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
bcast.c net: tipc: fix FB_MTU eat two pages 2021-06-28 13:31:57 -07:00
bcast.h
bearer.c tipc: check attribute length for bearer name 2022-06-14 18:36:13 +02:00
bearer.h net: tipc: Fix spelling errors in net/tipc module 2021-04-07 14:29:29 -07:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-29 09:03:22 +02:00
core.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
crypto.c tipc: fix a bit overflow in tipc_crypto_key_rcv() 2022-03-08 19:12:30 +01:00
crypto.h
diag.c
discover.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
discover.h
eth_media.c
group.c
group.h
ib_media.c
link.c tipc: fix incorrect order of state message data sanity check 2022-03-16 14:23:38 +01:00
link.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
monitor.c tipc: improve size validations for received domain records 2022-02-11 09:10:26 +01:00
monitor.h
msg.c net: tipc: replace align() with ALIGN in msg.c 2021-06-28 13:31:57 -07:00
msg.h net: tipc: fix FB_MTU eat two pages 2021-06-28 13:31:57 -07:00
name_distr.c tipc: rate limit warning for received illegal binding update 2022-02-16 12:56:30 +01:00
name_distr.h
name_table.c tipc: Fix end of loop tests for list_for_each_entry() 2022-03-02 11:47:56 +01:00
name_table.h tipc: simplify handling of lookup scope during multicast message reception 2021-06-03 14:06:39 -07:00
net.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
net.h
netlink.c
netlink.h
netlink_compat.c tipc: convert dest node's address to network order 2021-03-11 18:06:54 -08:00
node.c tipc: fix wrong notification node addresses 2022-02-23 12:03:14 +01:00
node.h
socket.c tipc: fix the timer expires after interval 100ms 2022-04-08 14:23:43 +02:00
socket.h
subscr.c tipc:subscr.c: fix a spelling mistake 2021-06-10 13:48:43 -07:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c
topsrv.c
topsrv.h
trace.c
trace.h
udp_media.c tipc: wait and exit until all work queues are done 2021-05-17 14:07:48 -07:00
udp_media.h