Eric Dumazet f8bc4b708b xfrm: fix a data-race in xfrm_gen_index() ... commit 3e4bc23926 upstream. xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock. This means we must use a per-netns idx_generator variable, instead of a static one. Alternative would be to use an atomic variable. syzbot reported: BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0: xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline] xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263 __do_sys_setsockopt net/socket.c:2274 [inline] __se_sys_setsockopt net/socket.c:2271 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1: xfrm_sk_policy_insert+0x13e/0x640 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263 __do_sys_setsockopt net/socket.c:2274 [inline] __se_sys_setsockopt net/socket.c:2271 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00006ad8 -> 0x00006b18 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Fixes: 1121994c80 ("netns xfrm: policy insertion in netns") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-10-25 11:58:56 +02:00
..
bpf.h	bpf, netns: Keep a list of attached bpf_link's	2020-06-30 10:45:08 -07:00
can.h	can: remove obsolete version strings	2020-10-12 10:06:39 +02:00
conntrack.h	netfilter: ecache: remove nf_exp_event_notifier structure	2021-08-25 12:50:38 +02:00
core.h	sock: Hide unused variable when !CONFIG_PROC_FS.	2017-12-19 09:58:14 -05:00
generic.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hash.h	netns: provide pure entropy for net_hash_mix()	2019-03-28 17:00:45 -07:00
ieee802154_6lowpan.h	net: dynamically allocate fqdir structures	2019-05-26 14:08:05 -07:00
ipv4.h	ipv4/tcp: do not use per netns ctl sockets	2022-07-29 17:25:11 +02:00
ipv6.h	net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down	2023-06-14 11:13:01 +02:00
mctp.h	mctp: Allow per-netns default networks	2021-07-29 15:06:50 +01:00
mib.h	net: reorganize fields in netns_mib	2021-04-02 14:31:44 -07:00
mpls.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netfilter.h	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
nexthop.h	nexthop: Convert to blocking notification chain	2020-09-15 16:31:17 -07:00
nftables.h	net: remove obsolete members from struct net	2021-04-06 00:34:53 +02:00
packet.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
sctp.h	sctp: add probe_interval in sysctl and sock/asoc/transport	2021-06-22 11:28:51 -07:00
smc.h	net/smc: Make SMC statistics network namespace aware	2021-06-16 12:54:02 -07:00
unix.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xdp.h	net: xsk: track AF_XDP sockets on a per-netns list	2019-01-25 01:50:03 +01:00
xfrm.h	xfrm: fix a data-race in xfrm_gen_index()	2023-10-25 11:58:56 +02:00