[5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp

From: Shmulik Ladkani <shmulik@metanetworks.com>

From: Shmulik Ladkani <shmulik@metanetworks.com>

[ Upstream commit 56ce7c25ae1525d83cf80a880cf506ead1914250 ]

When setting xfrm replay_window to values higher than 32, a rare
page-fault occurs in xfrm_replay_advance_bmp:

  BUG: unable to handle page fault for address: ffff8af350ad7920
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD ad001067 P4D ad001067 PUD 0
  Oops: 0002 [#1] SMP PTI
  CPU: 3 PID: 30 Comm: ksoftirqd/3 Kdump: loaded Not tainted 5.4.52-050452-generic #202007160732
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
  RIP: 0010:xfrm_replay_advance_bmp+0xbb/0x130
  RSP: 0018:ffffa1304013ba40 EFLAGS: 00010206
  RAX: 000000000000010d RBX: 0000000000000002 RCX: 00000000ffffff4b
  RDX: 0000000000000018 RSI: 00000000004c234c RDI: 00000000ffb3dbff
  RBP: ffffa1304013ba50 R08: ffff8af330ad7920 R09: 0000000007fffffa
  R10: 0000000000000800 R11: 0000000000000010 R12: ffff8af29d6258c0
  R13: ffff8af28b95c700 R14: 0000000000000000 R15: ffff8af29d6258fc
  FS:  0000000000000000(0000) GS:ffff8af339ac0000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff8af350ad7920 CR3: 0000000015ee4000 CR4: 00000000001406e0
  Call Trace:
   xfrm_input+0x4e5/0xa10
   xfrm4_rcv_encap+0xb5/0xe0
   xfrm4_udp_encap_rcv+0x140/0x1c0

Analysis revealed offending code is when accessing:

	replay_esn->bmp[nr] |= (1U << bitnr);

with 'nr' being 0x07fffffa.

This happened in an SMP system when reordering of packets was present;
A packet arrived with a "too old" sequence number (outside the window,
i.e 'diff > replay_window'), and therefore the following calculation:

			bitnr = replay_esn->replay_window - (diff - pos);

yields a negative result, but since bitnr is u32 we get a large unsigned
quantity (in crash dump above: 0xffffff4b seen in ecx).

This was supposed to be protected by xfrm_input()'s former call to:

		if (x->repl->check(x, skb, seq)) {

However, the state's spinlock x->lock is *released* after '->check()'
is performed, and gets re-acquired before '->advance()' - which gives a
chance for a different core to update the xfrm state, e.g. by advancing
'replay_esn->seq' when it encounters more packets - leading to a
'diff > replay_window' situation when original core continues to
xfrm_replay_advance_bmp().

An attempt to fix this issue was suggested in commit bcf66bf54aab
("xfrm: Perform a replay check after return from async codepaths"),
by calling 'x->repl->recheck()' after lock is re-acquired, but fix
applied only to asyncronous crypto algorithms.

Augment the fix, by *always* calling 'recheck()' - irrespective if we're
using async crypto.

Fixes: 0ebea8ef3559 ("[IPSEC]: Move state lock into x->type->input")
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20210202133000.926674036@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C421C43331 for <stable@archiver.kernel.org>; Tue, 2 Feb 2021 19:42:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0E4EE64F51 for <stable@archiver.kernel.org>; Tue, 2 Feb 2021 19:42:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238492AbhBBTm3 (ORCPT <rfc822;stable@archiver.kernel.org>); Tue, 2 Feb 2021 14:42:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:40700 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233272AbhBBNx0 (ORCPT <rfc822;stable@vger.kernel.org>); Tue, 2 Feb 2021 08:53:26 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 24E8764FCB; Tue, 2 Feb 2021 13:44:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1612273446; bh=Y5g0K2kIHO1Yvult+K6kvCAozywjd/W7LH+QmaO2Ed0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qh2Ju/r/53XikYcFwncxkFnS9c+uE+UCH9xqpkJLbAArmkuauJfP2JcbmGoM9acD6 Tf6hh3lGY1Oxz8S2DYIu0jWE4qW6nVVNQQoJrCviIkPFQ/a6XRZYsK6Avuf3nZiYhr Uf7NstHI2MPKJ868+U98iJrbmKbPW5++EHHs0qu0= From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Shmulik Ladkani <shmulik.ladkani@gmail.com>, Steffen Klassert <steffen.klassert@secunet.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 078/142] xfrm: Fix oops in xfrm_replay_advance_bmp Date: Tue, 2 Feb 2021 14:37:21 +0100 Message-Id: <20210202133000.926674036@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210202132957.692094111@linuxfoundation.org> References: <20210202132957.692094111@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: <stable.vger.kernel.org> X-Mailing-List: stable@vger.kernel.org
Series	None \| expand [5.10,002/142] nbd: freeze the queue while were adding connections [5.10,003/142] tty: avoid using vfs_iocb_iter_write() for redirected console writes [5.10,004/142] ACPI: sysfs: Prefer "compatible" modalias [5.10,005/142] ACPI: thermal: Do not call acpi_thermal_check() directly [5.10,006/142] kernel: kexec: remove the lock operation of system_transition_mutex [5.10,007/142] ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 [5.10,008/142] ALSA: hda/via: Apply the workaround generically for Clevo machines [5.10,009/142] parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES [5.10,010/142] media: cec: add stm32 driver [5.10,011/142] media: cedrus: Fix H264 decoding [5.10,012/142] media: hantro: Fix reset_raw_fmt initialization [5.10,013/142] media: rc: fix timeout handling after switch to microsecond durations [5.10,014/142] media: rc: ite-cir: fix min_timeout calculation [5.10,015/142] media: rc: ensure that uevent can be read directly after rc device register [5.10,016/142] ARM: dts: tbs2910: rename MMC node aliases [5.10,017/142] ARM: dts: ux500: Reserve memory carveouts [5.10,018/142] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming [5.10,019/142] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() [5.10,020/142] x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled [5.10,021/142] ASoC: AMD Renoir - refine DMI entries for some Lenovo products [5.10,022/142] Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)" [5.10,023/142] drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors [5.10,024/142] drm/i915: Always flush the active worker before returning from the wait [5.10,025/142] drm/i915/gt: Always try to reserve GGTT address 0x0 [5.10,026/142] drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes [5.10,027/142] bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FE... [5.10,028/142] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family [5.10,029/142] s390: uv: Fix sysfs max number of VCPUs reporting [5.10,030/142] s390/vfio-ap: No need to disable IRQ after queue reset [5.10,031/142] PM: hibernate: flush swap writer after marking [5.10,032/142] x86/entry: Emit a symbol for register restoring thunk [5.10,033/142] efi/apple-properties: Reinstate support for boolean properties [5.10,034/142] crypto: marvel/cesa - Fix tdma descriptor on 64-bit [5.10,035/142] drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs [5.10,036/142] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] [5.10,037/142] btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch [5.10,038/142] btrfs: fix possible free space tree corruption with online conversion [5.10,039/142] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] [5.10,040/142] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() [5.10,041/142] KVM: arm64: Filter out v8.1+ events on v8.0 HW [5.10,042/142] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit [5.10,043/142] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX [5.10,044/142] KVM: nVMX: Sync unsyncd vmcs02 state to vmcs12 on migration [5.10,045/142] KVM: x86: get smi pending status correctly [5.10,046/142] KVM: Forbid the use of tagged userspace addresses for memslots [5.10,047/142] io_uring: fix wqe->lock/completion_lock deadlock [5.10,048/142] xen: Fix XenStore initialisation for XS_LOCAL [5.10,049/142] leds: trigger: fix potential deadlock with libata [5.10,050/142] arm64: dts: broadcom: Fix USB DMA address translation for Stingray [5.10,051/142] mt7601u: fix kernel crash unplugging the device [5.10,052/142] mt76: mt7663s: fix rx buffer refcounting [5.10,053/142] mt7601u: fix rx buffer refcounting [5.10,054/142] iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit. [5.10,055/142] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals [5.10,056/142] drm/i915/pmu: Dont grab wakeref when enabling events [5.10,057/142] net/mlx5e: Fix IPSEC stats [5.10,058/142] ARM: dts: imx6qdl-kontron-samx6i: fix pwms for lcd-backlight [5.10,059/142] drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices [5.10,060/142] drm/vc4: Correct lbm size and calculation [5.10,061/142] drm/vc4: Correct POS1_SCL for hvs5 [5.10,062/142] drm/nouveau/dispnv50: Restore pushing of all data. [5.10,063/142] drm/i915: Check for all subplatform bits [5.10,064/142] drm/i915/selftest: Fix potential memory leak [5.10,065/142] uapi: fix big endian definition of ipv6_rpl_sr_hdr [5.10,066/142] KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM [5.10,067/142] tee: optee: replace might_sleep with cond_resched [5.10,068/142] xen-blkfront: allow discard-* nodes to be optional [5.10,069/142] blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue [5.10,070/142] clk: imx: fix Kconfig warning for i.MX SCU clk [5.10,071/142] clk: mmp2: fix build without CONFIG_PM [5.10,072/142] clk: qcom: gcc-sm250: Use floor ops for sdcc clks [5.10,073/142] ARM: imx: build suspend-imx6.S with arm instruction set [5.10,074/142] ARM: zImage: atags_to_fdt: Fix node names on added root nodes [5.10,075/142] netfilter: nft_dynset: add timeout extension to template [5.10,076/142] Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion" [5.10,077/142] Revert "block: simplify set_init_blocksize" to regain lost performance [5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp [5.10,079/142] xfrm: fix disable_xfrm sysctl when used on xfrm interfaces [5.10,080/142] selftests: xfrm: fix test return value override issue in xfrm_policy.sh [5.10,081/142] xfrm: Fix wraparound in xfrm_policy_addr_delta() [5.10,082/142] arm64: dts: ls1028a: fix the offset of the reset register [5.10,083/142] ARM: imx: fix imx8m dependencies [5.10,084/142] ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status [5.10,085/142] ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms [5.10,086/142] arm64: dts: imx8mp: Correct the gpio ranges of gpio3 [5.10,087/142] firmware: imx: select SOC_BUS to fix firmware build [5.10,088/142] RDMA/cxgb4: Fix the reported max_recv_sge value [5.10,089/142] ASoC: dt-bindings: lpass: Fix and common up lpass dai ids [5.10,090/142] ASoC: qcom: Fix incorrect volatile registers [5.10,091/142] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY [5.10,092/142] ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field [5.10,093/142] spi: altera: Fix memory leak on error path [5.10,094/142] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete [5.10,095/142] powerpc/64s: prevent recursive replay_soft_interrupts causing superfluous interrupt [5.10,096/142] pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() [5.10,097/142] pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn [5.10,098/142] ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies [5.10,099/142] ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup [5.10,100/142] iwlwifi: pcie: avoid potential PNVM leaks [5.10,101/142] iwlwifi: pnvm: dont skip everything when not reloading [5.10,102/142] iwlwifi: pnvm: dont try to load after failures [5.10,103/142] iwlwifi: pcie: set LTR on more devices [5.10,104/142] iwlwifi: pcie: use jiffies for memory read spin time limit [5.10,105/142] iwlwifi: pcie: reschedule in long-running memory reads [5.10,106/142] mac80211: pause TX while changing interface type [5.10,107/142] ice: fix FDir IPv6 flexbyte [5.10,108/142] ice: Implement flow for IPv6 next header (extension header) [5.10,109/142] ice: update dev_addr in ice_set_mac_address even if HW filter exists [5.10,110/142] ice: Dont allow more channels than LAN MSI-X available [5.10,111/142] ice: Fix MSI-X vector fallback logic [5.10,112/142] i40e: acquire VSI pointer only after VF is initialized [5.10,113/142] igc: fix link speed advertising [5.10,114/142] net/mlx5: Fix memory leak on flow table creation error flow [5.10,115/142] net/mlx5e: E-switch, Fix rate calculation for overflow [5.10,116/142] net/mlx5e: free page before return [5.10,117/142] net/mlx5e: Reduce tc unsupported key print level [5.10,118/142] net/mlx5: Maintain separate page trees for ECPF and PF functions [5.10,119/142] net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled [5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion [5.10,121/142] net/mlx5e: Correctly handle changing the number of queues when the interface is down [5.10,122/142] net/mlx5e: Revert parameters on errors when changing trust state without reset [5.10,123/142] net/mlx5e: Revert parameters on errors when changing MTU and LRO state without reset [5.10,124/142] net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat rhashtable [5.10,125/142] can: dev: prevent potential information leak in can_fill_info() [5.10,126/142] ACPI/IORT: Do not blindly trust DMA masks from firmware [5.10,127/142] of/device: Update dma_range_map only when dev has valid dma-ranges [5.10,128/142] iommu/amd: Use IVHD EFR for early initialization of IOMMU features [5.10,129/142] iommu/vt-d: Correctly check addr alignment in qi_flush_dev_iotlb_pasid() [5.10,130/142] nvme-multipath: Early exit if no path is available [5.10,131/142] selftests: forwarding: Specify interface when invoking mausezahn [5.10,132/142] rxrpc: Fix memory leak in rxrpc_lookup_local [5.10,133/142] NFC: fix resource leak when target index is invalid [5.10,134/142] NFC: fix possible resource leak [5.10,135/142] ASoC: mediatek: mt8183-da7219: ignore TDM DAI link by default [5.10,136/142] ASoC: mediatek: mt8183-mt6358: ignore TDM DAI link by default [5.10,137/142] ASoC: topology: Properly unregister DAI on removal [5.10,138/142] ASoC: topology: Fix memory corruption in soc_tplg_denum_create_values() [5.10,139/142] scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit [5.10,140/142] team: protect features update by RCU to avoid deadlock [5.10,141/142] tcp: make TCP_USER_TIMEOUT accurate for zero window probes [5.10,142/142] tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN

[5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp

Commit Message

Patch