[5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change()

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

commit 3db09e762dc79584a69c10d74a6b98f89a9979f8 upstream.

We are now able to detect extra put_net() at the moment
they happen, instead of much later in correct code paths.

u32_init_knode() / tcf_exts_init() populates the ->exts.net
pointer, but as mentioned in tcf_exts_init(),
the refcount on netns has not been elevated yet.

The refcount is taken only once tcf_exts_get_net()
is called.

So the two u32_destroy_key() calls from u32_change()
are attempting to release an invalid reference on the netns.

syzbot report:

refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 0 PID: 21708 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 0 PID: 21708 Comm: syz-executor.5 Not tainted 5.18.0-rc2-next-20220412-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 14 b6 b2 09 31 ff 89 de e8 6d e9 89 fd 84 db 75 e0 e8 84 e5 89 fd 48 c7 c7 40 aa 26 8a c6 05 f4 b5 b2 09 01 e8 e5 81 2e 05 <0f> 0b eb c4 e8 68 e5 89 fd 0f b6 1d e3 b5 b2 09 31 ff 89 de e8 38
RSP: 0018:ffffc900051af1b0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff8160a0c8 RDI: fffff52000a35e28
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81604a9e R11: 0000000000000000 R12: 1ffff92000a35e3b
R13: 00000000ffffffef R14: ffff8880211a0194 R15: ffff8880577d0a00
FS:  00007f25d183e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f19c859c028 CR3: 0000000051009000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 ref_tracker_free+0x535/0x6b0 lib/ref_tracker.c:118
 netns_tracker_free include/net/net_namespace.h:327 [inline]
 put_net_track include/net/net_namespace.h:341 [inline]
 tcf_exts_put_net include/net/pkt_cls.h:255 [inline]
 u32_destroy_key.isra.0+0xa7/0x2b0 net/sched/cls_u32.c:394
 u32_change+0xe01/0x3140 net/sched/cls_u32.c:909
 tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:6016
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2495
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:725
 ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f25d0689049
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f25d183e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f25d079c030 RCX: 00007f25d0689049
RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000005
RBP: 00007f25d06e308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd0b752e3f R14: 00007f25d183e300 R15: 0000000000022000
 </TASK>

Fixes: 35c55fc156d8 ("cls_u32: use tcf_exts_get_net() before call_rcu()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_u32.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

Message ID	20220426081750.269597052@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, syzbot <syzkaller@googlegroups.com>, Cong Wang <xiyou.wangcong@gmail.com>, Jiri Pirko <jiri@resnulli.us>, Jamal Hadi Salim <jhs@mojatatu.com>, Jakub Kicinski <kuba@kernel.org> Subject: [PATCH 5.17 007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() Date: Tue, 26 Apr 2022 10:20:02 +0200 Message-Id: <20220426081750.269597052@linuxfoundation.org> In-Reply-To: <20220426081750.051179617@linuxfoundation.org> References: <20220426081750.051179617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/146] perf tools: Fix segfault accessing sample_id xyarray [5.17,003/146] drm/amd/display: Only set PSR version when valid [5.17,004/146] block/compat_ioctl: fix range check in BLKGETSIZE [5.17,005/146] gfs2: assign rgrp glock before compute_bitstructs [5.17,006/146] scsi: ufs: core: scsi_get_lba() error fix [5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.17,008/146] ALSA: usb-audio: Clear MIDI port active flag after draining [5.17,009/146] ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. [5.17,010/146] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.17,011/146] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.17,012/146] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.17,013/146] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.17,014/146] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.17,015/146] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.17,016/146] dmaengine: idxd: fix device cleanup on disable [5.17,017/146] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.17,018/146] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.17,019/146] dmaengine: dw-edma: Fix unaligned 64bit access [5.17,020/146] spi: spi-mtk-nor: initialize spi controller after resume [5.17,021/146] firmware: cs_dsp: Fix overrun of unterminated control name string [5.17,022/146] esp: limit skb_page_frag_refill use to a single page [5.17,023/146] spi: cadence-quadspi: fix incorrect supports_op() return value [5.17,024/146] igc: Fix infinite loop in release_swfw_sync [5.17,025/146] igc: Fix BUG: scheduling while atomic [5.17,026/146] igc: Fix suspending when PTM is active [5.17,027/146] ice: allow creating VFs for !CONFIG_NET_SWITCHDEV [5.17,028/146] ice: fix crash in switchdev mode [5.17,029/146] ice: Fix memory leak in ice_get_orom_civd_data() [5.17,030/146] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.17,031/146] rxrpc: Restore removed timer deletion [5.17,032/146] net/smc: Fix sock leak when release after smc_shutdown() [5.17,033/146] net/packet: fix packet_sock xmit return value checking [5.17,034/146] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.17,035/146] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.17,036/146] net: restore alpha order to Ethernet devices in config [5.17,037/146] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.17,038/146] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.17,039/146] ipv6: make ip6_rt_gc_expire an atomic_t [5.17,040/146] can: isotp: stop timeout monitoring when no first frame was sent [5.17,041/146] net: dsa: hellcreek: Calculate checksums in tagger [5.17,042/146] net: mscc: ocelot: fix broken IP multicast flooding [5.17,043/146] netlink: reset network and mac headers in netlink_dump() [5.17,044/146] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.17,045/146] RISC-V: KVM: Remove s & u as valid ISA extension [5.17,046/146] RISC-V: KVM: Restrict the extensions that can be disabled [5.17,047/146] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.17,048/146] dmaengine: idxd: match type for retries var in idxd_enqcmds() [5.17,049/146] dmaengine: idxd: fix retry value to be constant for duration of function call [5.17,050/146] dmaengine: idxd: add RO check for wq max_batch_size write [5.17,051/146] dmaengine: idxd: add RO check for wq max_transfer_size write [5.17,052/146] dmaengine: idxd: skip clearing device context when device is read-only [5.17,053/146] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.17,054/146] selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets [5.17,055/146] userfaultfd: mark uffd_wp regardless of VM_WRITE flag [5.17,056/146] arm64: mm: fix p?d_leaf() [5.17,057/146] XArray: Disallow sibling entries of nodes [5.17,058/146] drm/msm/gpu: Rename runtime suspend/resume functions [5.17,059/146] drm/msm/gpu: Remove mutex from wait_event condition [5.17,060/146] ARM: vexpress/spc: Avoid negative array index when !SMP [5.17,061/146] reset: renesas: Check return value of reset_control_deassert() [5.17,062/146] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.17,063/146] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.17,064/146] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.17,065/146] drm/msm/disp: check the return value of kzalloc() [5.17,066/146] selftests: KVM: Free the GIC FD when cleaning up in arch_timer [5.17,067/146] ALSA: hda: intel-dsp-config: update AlderLake PCI IDs [5.17,068/146] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.17,069/146] vxlan: fix error return code in vxlan_fdb_append [5.17,070/146] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.17,071/146] net: atlantic: Avoid out-of-bounds indexing [5.17,072/146] mt76: Fix undefined behavior due to shift overflowing the constant [5.17,073/146] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.17,074/146] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.17,075/146] drm/msm/mdp5: check the return of kzalloc() [5.17,076/146] KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU [5.17,077/146] net: macb: Restart tx only if queue pointer is lagging [5.17,078/146] scsi: iscsi: Release endpoint ID when its freed [5.17,079/146] scsi: iscsi: Merge suspend fields [5.17,080/146] scsi: iscsi: Fix NOP handling during conn recovery [5.17,081/146] scsi: qedi: Fix failed disconnect handling [5.17,082/146] stat: fix inconsistency between struct stat and struct compat_stat [5.17,083/146] VFS: filename_create(): fix incorrect intent. [5.17,084/146] nvme: add a quirk to disable namespace identifiers [5.17,085/146] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.17,086/146] nvme-pci: disable namespace identifiers for Qemu controllers [5.17,087/146] irq_work: use kasan_record_aux_stack_noalloc() record callstack [5.17,088/146] EDAC/synopsys: Read the error count from the correct register [5.17,089/146] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.17,090/146] memcg: sync flush only if periodic flush is delayed [5.17,091/146] mm, hugetlb: allow for "high" userspace addresses [5.17,092/146] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.17,093/146] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.17,094/146] ata: pata_marvell: Check the bmdma_addr beforing reading [5.17,095/146] dma: at_xdmac: fix a missing check on list iterator [5.17,096/146] dmaengine: imx-sdma: fix init of uart scripts [5.17,097/146] net: atlantic: invert deep par in pm functions, preventing null derefs [5.17,098/146] drm/radeon: fix logic inversion in radeon_sync_resv [5.17,099/146] io_uring: free iovec if file assignment fails [5.17,100/146] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.17,101/146] scsi: sr: Do not leak information in ioctl [5.17,102/146] sched/pelt: Fix attach_entity_load_avg() corner case [5.17,103/146] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.17,104/146] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.17,105/146] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.17,106/146] powerpc/time: Always set decrementer in timer_interrupt() [5.17,107/146] KVM: PPC: Fix TCE handling for VFIO [5.17,108/146] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.17,109/146] powerpc/perf: Fix power9 event alternatives [5.17,110/146] powerpc/perf: Fix power10 event alternatives [5.17,111/146] arm/xen: Fix some refcount leaks [5.17,112/146] perf script: Always allow field data_src for auxtrace [5.17,113/146] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.17,114/146] fs: fix acl translation [5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts() [5.17,116/146] cifs: use correct lock type in cifs_reconnect() [5.17,117/146] xtensa: patch_text: Fixup last cpu should be master [5.17,118/146] xtensa: fix a7 clobbering in coprocessor context load/store [5.17,119/146] openvswitch: fix OOB access in reserve_sfa_size() [5.17,120/146] gpio: Request interrupts after IRQ is initialized [5.17,121/146] ASoC: rt5682: fix an incorrect NULL check on list iterator [5.17,122/146] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.17,123/146] e1000e: Fix possible overflow in LTR decoding [5.17,124/146] codecs: rt5682s: fix an incorrect NULL check on list iterator [5.17,125/146] ARC: entry: fix syscall_trace_exit argument [5.17,126/146] drm/vmwgfx: Fix gem refcounting and memory evictions [5.17,127/146] arm_pmu: Validate single/group leader events [5.17,128/146] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.17,129/146] KVM: x86: Dont re-acquire SRCU lock in complete_emulated_io() [5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.17,131/146] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.17,132/146] KVM: SVM: Simplify and harden helper to flush SEV guest page(s) [5.17,133/146] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.17,134/146] ext4: fix fallocate to use file_modified to update permissions consistently [5.17,135/146] ext4: fix symlink file size not match to file content [5.17,136/146] ext4: fix use-after-free in ext4_search_dir [5.17,137/146] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.17,138/146] ext4, doc: fix incorrect h_reserved size [5.17,139/146] ext4: fix overhead calculation to account for the reserved gdt blocks [5.17,140/146] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.17,141/146] ext4: update the cached overhead value in the superblock [5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort [5.17,143/146] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.17,144/146] ASoC: SOF: topology: cleanup dailinks on widget unload [5.17,145/146] io_uring: fix leaks on IOPOLL and CQE_SKIP [5.17,146/146] arm64: dts: qcom: add IPA qcom,qmp property

[5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change()

Commit Message

Patch