From patchwork Mon Jul 12 06:06:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 474585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C08DFC07E9B for ; Mon, 12 Jul 2021 06:17:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ACA8761130 for ; Mon, 12 Jul 2021 06:17:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234098AbhGLGUp (ORCPT ); Mon, 12 Jul 2021 02:20:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:37428 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234106AbhGLGUF (ORCPT ); Mon, 12 Jul 2021 02:20:05 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 223D3610A7; Mon, 12 Jul 2021 06:17:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626070636; bh=cEN97SvzMg5VrAxZQlw1lJ7Xs+m2pTjcjaXQoyzNsoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vzg/jMa5WDV6YadT5V7BhKrQkvFgM5wnZbCwhW9zw/o5TN/OFYzQkRYjoJ9KVFIeR HEVnkiP8QhUOQ4qqoHE//ITSdf8EZJtZbqE5SRj0RVggLREyaQ2NhzVz5HARgjnQKT Tk6YBmpqxI3LIeX0mHcxnMU9psfWwceX493mv4Jk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com, Norbert Slusarek , Thadeu Lima de Souza Cascardo , Oliver Hartkopp , Marc Kleine-Budde Subject: [PATCH 5.4 032/348] can: bcm: delay release of struct bcm_op after synchronize_rcu() Date: Mon, 12 Jul 2021 08:06:56 +0200 Message-Id: <20210712060705.262616979@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210712060659.886176320@linuxfoundation.org> References: <20210712060659.886176320@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Thadeu Lima de Souza Cascardo commit d5f9023fa61ee8b94f37a93f08e94b136cf1e463 upstream. can_rx_register() callbacks may be called concurrently to the call to can_rx_unregister(). The callbacks and callback data, though, are protected by RCU and the struct sock reference count. So the callback data is really attached to the life of sk, meaning that it should be released on sk_destruct. However, bcm_remove_op() calls tasklet_kill(), and RCU callbacks may be called under RCU softirq, so that cannot be used on kernels before the introduction of HRTIMER_MODE_SOFT. However, bcm_rx_handler() is called under RCU protection, so after calling can_rx_unregister(), we may call synchronize_rcu() in order to wait for any RCU read-side critical sections to finish. That is, bcm_rx_handler() won't be called anymore for those ops. So, we only free them, after we do that synchronize_rcu(). Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") Link: https://lore.kernel.org/r/20210619161813.2098382-1-cascardo@canonical.com Cc: linux-stable Reported-by: syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com Reported-by: Norbert Slusarek Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- net/can/bcm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -787,6 +787,7 @@ static int bcm_delete_rx_op(struct list_ bcm_rx_handler, op); list_del(&op->list); + synchronize_rcu(); bcm_remove_op(op); return 1; /* done */ } @@ -1535,9 +1536,13 @@ static int bcm_release(struct socket *so REGMASK(op->can_id), bcm_rx_handler, op); - bcm_remove_op(op); } + synchronize_rcu(); + + list_for_each_entry_safe(op, next, &bo->rx_ops, list) + bcm_remove_op(op); + #if IS_ENABLED(CONFIG_PROC_FS) /* remove procfs entry */ if (net->can.bcmproc_dir && bo->bcm_proc_read)