[5.10,33/99] sch_cake: do not call cake_destroy() from cake_init()

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit ab443c53916730862cec202078d36fd4008bea79 ]

qdiscs are not supposed to call their own destroy() method
from init(), because core stack already does that.

syzbot was able to trigger use after free:

DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock_common kernel/locking/mutex.c:586 [inline]
WARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740
Modules linked in:
CPU: 0 PID: 21902 Comm: syz-executor189 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:586 [inline]
RIP: 0010:__mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740
Code: 08 84 d2 0f 85 19 08 00 00 8b 05 97 38 4b 04 85 c0 0f 85 27 f7 ff ff 48 c7 c6 20 00 ac 89 48 c7 c7 a0 fe ab 89 e8 bf 76 ba ff <0f> 0b e9 0d f7 ff ff 48 8b 44 24 40 48 8d b8 c8 08 00 00 48 89 f8
RSP: 0018:ffffc9000627f290 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802315d700 RSI: ffffffff815f1db8 RDI: fffff52000c4fe44
RBP: ffff88818f28e000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815ebb5e R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffc9000627f458 R15: 0000000093c30000
FS:  0000555556abc400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fda689c3303 CR3: 000000001cfbb000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 tcf_chain0_head_change_cb_del+0x2e/0x3d0 net/sched/cls_api.c:810
 tcf_block_put_ext net/sched/cls_api.c:1381 [inline]
 tcf_block_put_ext net/sched/cls_api.c:1376 [inline]
 tcf_block_put+0xbc/0x130 net/sched/cls_api.c:1394
 cake_destroy+0x3f/0x80 net/sched/sch_cake.c:2695
 qdisc_create.constprop.0+0x9da/0x10f0 net/sched/sch_api.c:1293
 tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660
 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f1bb06badb9
Code: Unable to access opcode bytes at RIP 0x7f1bb06bad8f.
RSP: 002b:00007fff3012a658 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1bb06badb9
RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000246 R12: 00007fff3012a688
R13: 00007fff3012a6a0 R14: 00007fff3012a6e0 R15: 00000000000013c2
 </TASK>

Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://lore.kernel.org/r/20211210142046.698336-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cake.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

Message ID	20211220143030.476050958@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, syzbot <syzkaller@googlegroups.com>, =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 33/99] sch_cake: do not call cake_destroy() from cake_init() Date: Mon, 20 Dec 2021 15:34:06 +0100 Message-Id: <20211220143030.476050958@linuxfoundation.org> In-Reply-To: <20211220143029.352940568@linuxfoundation.org> References: <20211220143029.352940568@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,02/99] KVM: downgrade two BUG_ONs to WARN_ON_ONCE [5.10,03/99] mac80211: fix regression in SSN handling of addba tx [5.10,04/99] mac80211: mark TX-during-stop for TX in in_reconfig [5.10,05/99] mac80211: send ADDBA requests using the tid/queue of the aggregation session [5.10,06/99] mac80211: validate extended element ID is present [5.10,07/99] firmware: arm_scpi: Fix string overflow in SCPI genpd driver [5.10,08/99] bpf: Fix signed bounds propagation after mov32 [5.10,09/99] bpf: Make 32->64 bounds propagation slightly more robust [5.10,10/99] bpf, selftests: Add test case trying to taint map value pointer [5.10,11/99] virtio_ring: Fix querying of maximum DMA mapping size for virtio device [5.10,12/99] vdpa: check that offsets are within bounds [5.10,13/99] recordmcount.pl: look for jgnop instruction as well as bcrl on s390 [5.10,14/99] dm btree remove: fix use after free in rebalance_children() [5.10,15/99] audit: improve robustness of the audit queue handling [5.10,16/99] arm64: dts: imx8m: correct assigned clocks for FEC [5.10,17/99] arm64: dts: imx8mp-evk: Improve the Ethernet PHY description [5.10,18/99] arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge [5.10,19/99] arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply [5.10,20/99] arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply [5.10,21/99] arm64: dts: rockchip: fix audio-supply for Rock Pi 4 [5.10,22/99] mac80211: track only QoS data frames for admission control [5.10,23/99] hv: utils: add PTP_1588_CLOCK to Kconfig to fix build [5.10,24/99] tee: amdtee: fix an IS_ERR() vs NULL bug [5.10,25/99] ceph: fix duplicate increment of opened_inodes metric [5.10,26/99] ceph: initialize pathlen variable in reconnect_caps_cb [5.10,27/99] ARM: socfpga: dts: fix qspi node compatible [5.10,28/99] clk: Dont parent clks until the parent is fully registered [5.10,29/99] soc: imx: Register SoC device only on i.MX boards [5.10,30/99] virtio/vsock: fix the transport to work with VMADDR_CID_ANY [5.10,31/99] selftests: net: Correct ping6 expected rc from 2 to 1 [5.10,32/99] s390/kexec_file: fix error handling when applying relocations [5.10,33/99] sch_cake: do not call cake_destroy() from cake_init() [5.10,34/99] inet_diag: fix kernel-infoleak for UDP sockets [5.10,35/99] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg [5.10,36/99] selftests: Add duplicate config only for MD5 VRF tests [5.10,37/99] selftests: Fix raw socket bind tests with VRF [5.10,38/99] selftests: Fix IPv6 address bind tests [5.10,39/99] dmaengine: st_fdma: fix MODULE_ALIAS [5.10,40/99] net/sched: sch_ets: dont remove idle classes from the round-robin list [5.10,41/99] selftest/net/forwarding: declare NETIFS p9 p10 [5.10,42/99] drm/ast: potential dereference of null pointer [5.10,43/99] mac80211: agg-tx: dont schedule_and_wake_txq() under sta->lock [5.10,44/99] mac80211: fix lookup when adding AddBA extension element [5.10,45/99] flow_offload: return EOPNOTSUPP for the unsupported mpls action type [5.10,46/99] rds: memory leak in __rds_conn_create() [5.10,47/99] drm/amd/pm: fix a potential gpu_metrics_table memory leak [5.10,48/99] mptcp: clear kern flag from fallback sockets [5.10,49/99] soc/tegra: fuse: Fix bitwise vs. logical OR warning [5.10,50/99] igb: Fix removal of unicast MAC filters of VFs [5.10,51/99] igbvf: fix double free in `igbvf_probe` [5.10,52/99] igc: Fix typo in i225 LTR functions [5.10,53/99] ixgbe: Document how to enable NBASE-T support [5.10,54/99] ixgbe: set X550 MDIO speed before talking to PHY [5.10,55/99] netdevsim: Zero-initialize memory for new maps value in function nsim_bpf_map_alloc [5.10,56/99] net/packet: rx_owner_map depends on pg_vec [5.10,57/99] sfc_ef100: potential dereference of null pointer [5.10,58/99] net: Fix double 0x prefix print in SKB dump [5.10,59/99] net/smc: Prevent smc_release() from long blocking [5.10,60/99] net: systemport: Add global locking for descriptor lifecycle [5.10,61/99] sit: do not call ipip6_dev_free() from sit_init_net() [5.10,62/99] bpf, selftests: Fix racing issue in btf_skc_cls_ingress test [5.10,63/99] powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n [5.10,64/99] USB: gadget: bRequestType is a bitfield, not a enum [5.10,65/99] Revert "usb: early: convert to readl_poll_timeout_atomic()" [5.10,66/99] KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILI... [5.10,67/99] tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous [5.10,68/99] USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) [5.10,69/99] usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe [5.10,70/99] PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error [5.10,71/99] PCI/MSI: Mask MSI-X vectors only on success [5.10,72/99] usb: xhci: Extend support for runtime power management for AMDs Yellow carp. [5.10,73/99] USB: serial: cp210x: fix CP2105 GPIO registration [5.10,74/99] USB: serial: option: add Telit FN990 compositions [5.10,75/99] btrfs: fix memory leak in __add_inode_ref() [5.10,76/99] btrfs: fix double free of anon_dev after failure to create subvolume [5.10,77/99] zonefs: add MODULE_ALIAS_FS [5.10,78/99] iocost: Fix divide-by-zero on donation from low hweight cgroup [5.10,79/99] serial: 8250_fintek: Fix garbled text for console [5.10,80/99] timekeeping: Really make sure wall_to_monotonic isnt positive [5.10,81/99] libata: if T_LENGTH is zero, dma direction should be DMA_NONE [5.10,82/99] drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE [5.10,83/99] Input: touchscreen - avoid bitwise vs logical OR warning [5.10,84/99] ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name [5.10,85/99] xsk: Do not sleep in poll() when need_wakeup set [5.10,86/99] media: mxl111sf: change mutex_init() location [5.10,87/99] fuse: annotate lock in fuse_reverse_inval_entry() [5.10,88/99] ovl: fix warning in ovl_create_real() [5.10,89/99] scsi: scsi_debug: Dont call kcalloc() if size arg is zero [5.10,90/99] scsi: scsi_debug: Fix type in min_t to avoid stack OOB [5.10,91/99] scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() [5.10,92/99] rcu: Mark accesses to rcu_state.n_force_qs [5.10,93/99] bus: ti-sysc: Fix variable set but not used warning for reinit_modules [5.10,94/99] Revert "xsk: Do not sleep in poll() when need_wakeup set" [5.10,95/99] xen/blkfront: harden blkfront against event channel storms [5.10,96/99] xen/netfront: harden netfront against event channel storms [5.10,97/99] xen/console: harden hvc_xen against event channel storms [5.10,98/99] xen/netback: fix rx queue stall detection [5.10,99/99] xen/netback: dont queue unlimited number of packages

[5.10,33/99] sch_cake: do not call cake_destroy() from cake_init()

Commit Message

Patch