Revision 4e43e64d0f1332fcc503babad4dc31aead7131ca authored by Eric Dumazet on 28 June 2022, 12:12:48 UTC, committed by Jakub Kicinski on 30 June 2022, 03:41:09 UTC
As reported by syzbot, we should not use rcu_dereference()
when rcu_read_lock() is not held.

WARNING: suspicious RCU usage
5.19.0-rc2-syzkaller #0 Not tainted

net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz-executor326/3617:
 #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223

stack backtrace:
CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175
 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300
 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275
 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380
 netlink_dump_start include/linux/netlink.h:245 [inline]
 rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546
 __sys_sendmsg net/socket.c:2575 [inline]
 __do_sys_sendmsg net/socket.c:2584 [inline]
 __se_sys_sendmsg net/socket.c:2582 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent fa152f6
History
File Mode Size
atomic
basic
clang-tools
coccinelle
dtc
dummy-tools
gcc-plugins
gdb
genksyms
kconfig
ksymoops
mod
package
selinux
tracing
.gitignore -rw-r--r-- 146 bytes
Kbuild.include -rw-r--r-- 7.5 KB
Kconfig.include -rw-r--r-- 2.6 KB
Lindent -rwxr-xr-x 502 bytes
Makefile -rw-r--r-- 1.5 KB
Makefile.asm-generic -rw-r--r-- 1.8 KB
Makefile.build -rw-r--r-- 16.1 KB
Makefile.clang -rw-r--r-- 1.7 KB
Makefile.clean -rw-r--r-- 1.9 KB
Makefile.compiler -rw-r--r-- 2.7 KB
Makefile.debug -rw-r--r-- 706 bytes
Makefile.dtbinst -rw-r--r-- 999 bytes
Makefile.extrawarn -rw-r--r-- 3.0 KB
Makefile.gcc-plugins -rw-r--r-- 2.6 KB
Makefile.headersinst -rw-r--r-- 2.9 KB
Makefile.host -rw-r--r-- 4.6 KB
Makefile.kasan -rw-r--r-- 1.7 KB
Makefile.kcov -rw-r--r-- 333 bytes
Makefile.kcsan -rw-r--r-- 1004 bytes
Makefile.lib -rw-r--r-- 19.5 KB
Makefile.modfinal -rw-r--r-- 2.7 KB
Makefile.modinst -rw-r--r-- 2.4 KB
Makefile.modpost -rw-r--r-- 4.2 KB
Makefile.package -rw-r--r-- 6.9 KB
Makefile.randstruct -rw-r--r-- 511 bytes
Makefile.ubsan -rw-r--r-- 770 bytes
Makefile.userprogs -rw-r--r-- 1.6 KB
Makefile.vmlinux -rw-r--r-- 890 bytes
Makefile.vmlinux_o -rw-r--r-- 2.6 KB
adjust_autoksyms.sh -rwxr-xr-x 2.1 KB
as-version.sh -rwxr-xr-x 2.0 KB
asn1_compiler.c -rw-r--r-- 35.3 KB
bin2c.c -rw-r--r-- 743 bytes
bloat-o-meter -rwxr-xr-x 3.4 KB
bootgraph.pl -rwxr-xr-x 5.6 KB
bpf_doc.py -rwxr-xr-x 29.3 KB
cc-can-link.sh -rwxr-xr-x 166 bytes
cc-version.sh -rwxr-xr-x 1.5 KB
check-blacklist-hashes.awk -rwxr-xr-x 1.0 KB
check-local-export -rwxr-xr-x 1.9 KB
check-sysctl-docs -rwxr-xr-x 4.4 KB
check_extable.sh -rwxr-xr-x 4.9 KB
checkdeclares.pl -rwxr-xr-x 1.1 KB
checkincludes.pl -rwxr-xr-x 1.9 KB
checkkconfigsymbols.py -rwxr-xr-x 15.4 KB
checkpatch.pl -rwxr-xr-x 225.6 KB
checkstack.pl -rwxr-xr-x 5.9 KB
checksyscalls.sh -rwxr-xr-x 7.4 KB
checkversion.pl -rwxr-xr-x 2.2 KB
cleanfile -rwxr-xr-x 3.5 KB
cleanpatch -rwxr-xr-x 5.1 KB
coccicheck -rwxr-xr-x 7.9 KB
config -rwxr-xr-x 4.7 KB
const_structs.checkpatch -rw-r--r-- 1.4 KB
decode_stacktrace.sh -rwxr-xr-x 6.9 KB
decodecode -rwxr-xr-x 2.9 KB
depmod.sh -rwxr-xr-x 1.4 KB
dev-needs.sh -rwxr-xr-x 6.1 KB
diffconfig -rwxr-xr-x 3.7 KB
documentation-file-ref-check -rwxr-xr-x 5.7 KB
export_report.pl -rwxr-xr-x 4.5 KB
extract-ikconfig -rwxr-xr-x 1.7 KB
extract-module-sig.pl -rwxr-xr-x 3.7 KB
extract-sys-certs.pl -rwxr-xr-x 3.7 KB
extract-vmlinux -rwxr-xr-x 1.7 KB
extract_xc3028.pl -rwxr-xr-x 44.6 KB
faddr2line -rwxr-xr-x 8.1 KB
file-size.sh -rwxr-xr-x 86 bytes
find-unused-docs.sh -rwxr-xr-x 1.3 KB
gcc-goto.sh -rwxr-xr-x 511 bytes
gcc-ld -rwxr-xr-x 711 bytes
gcc-x86_32-has-stack-protector.sh -rwxr-xr-x 408 bytes
gcc-x86_64-has-stack-protector.sh -rwxr-xr-x 198 bytes
gen-randstruct-seed.sh -rwxr-xr-x 228 bytes
gen_autoksyms.sh -rwxr-xr-x 1.4 KB
gen_ksymdeps.sh -rwxr-xr-x 556 bytes
generate_initcall_order.pl -rwxr-xr-x 5.9 KB
get_abi.pl -rwxr-xr-x 25.3 KB
get_dvb_firmware -rwxr-xr-x 24.5 KB
get_feat.pl -rwxr-xr-x 14.6 KB
get_maintainer.pl -rwxr-xr-x 67.2 KB
gfp-translate -rwxr-xr-x 1.7 KB
headerdep.pl -rwxr-xr-x 3.5 KB
headers_install.sh -rwxr-xr-x 3.4 KB
insert-sys-cert.c -rw-r--r-- 8.9 KB
install.sh -rwxr-xr-x 986 bytes
jobserver-exec -rwxr-xr-x 2.2 KB
kallsyms.c -rw-r--r-- 18.2 KB
kernel-doc -rwxr-xr-x 65.9 KB
ld-version.sh -rwxr-xr-x 1.7 KB
leaking_addresses.pl -rwxr-xr-x 12.8 KB
link-vmlinux.sh -rwxr-xr-x 8.9 KB
makelst -rwxr-xr-x 808 bytes
markup_oops.pl -rwxr-xr-x 7.9 KB
min-tool-version.sh -rwxr-xr-x 504 bytes
mkcompile_h -rwxr-xr-x 2.6 KB
mksysmap -rwxr-xr-x 1.3 KB
mkuboot.sh -rwxr-xr-x 414 bytes
module.lds.S -rw-r--r-- 1.5 KB
modules-check.sh -rwxr-xr-x 427 bytes
nsdeps -rw-r--r-- 1.6 KB
objdiff -rwxr-xr-x 2.8 KB
objdump-func -rwxr-xr-x 711 bytes
pahole-flags.sh -rwxr-xr-x 585 bytes
pahole-version.sh -rwxr-xr-x 269 bytes
parse-maintainers.pl -rwxr-xr-x 4.5 KB
patch-kernel -rwxr-xr-x 9.9 KB
profile2linkerlist.pl -rwxr-xr-x 414 bytes
prune-kernel -rwxr-xr-x 912 bytes
recordmcount.c -rw-r--r-- 16.7 KB
recordmcount.h -rw-r--r-- 19.4 KB
recordmcount.pl -rwxr-xr-x 17.5 KB
remove-stale-files -rwxr-xr-x 1.6 KB
setlocalversion -rwxr-xr-x 3.6 KB
show_delta -rwxr-xr-x 3.0 KB
sign-file.c -rw-r--r-- 9.9 KB
sorttable.c -rw-r--r-- 7.7 KB
sorttable.h -rw-r--r-- 12.9 KB
spdxcheck-test.sh -rw-r--r-- 284 bytes
spdxcheck.py -rwxr-xr-x 15.2 KB
spdxexclude -rw-r--r-- 417 bytes
spelling.txt -rw-r--r-- 32.5 KB
sphinx-pre-install -rwxr-xr-x 24.4 KB
split-man.pl -rwxr-xr-x 604 bytes
stackdelta -rwxr-xr-x 1.8 KB
stackusage -rwxr-xr-x 794 bytes
subarch.include -rw-r--r-- 647 bytes
syscallhdr.sh -rwxr-xr-x 1.9 KB
syscallnr.sh -rwxr-xr-x 1.5 KB
syscalltbl.sh -rwxr-xr-x 1.5 KB
tags.sh -rwxr-xr-x 10.4 KB
test_fortify.sh -rw-r--r-- 2.2 KB
tools-support-relr.sh -rwxr-xr-x 546 bytes
unifdef.c -rw-r--r-- 34.8 KB
ver_linux -rwxr-xr-x 2.6 KB
xen-hypercalls.sh -rwxr-xr-x 386 bytes
xz_wrap.sh -rwxr-xr-x 563 bytes

back to top