korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-29 15:14:18 +08:00
Code Issues Packages Projects Releases Wiki Activity
044011fdf1
linux/include
History
Eric Dumazet 9cb7c01342 ipv6: make ip6_rt_gc_expire an atomic_t 
Reads and Writes to ip6_rt_gc_expire always have been racy,
as syzbot reported lately [1]

There is a possible risk of under-flow, leading
to unexpected high value passed to fib6_run_gc(),
although I have not observed this in the field.

Hosts hitting ip6_dst_gc() very hard are under pretty bad
state anyway.

[1]
BUG: KCSAN: data-race in ip6_dst_gc / ip6_dst_gc

read-write to 0xffff888102110744 of 4 bytes by task 13165 on cpu 1:
 ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311
 dst_alloc+0x9b/0x160 net/core/dst.c:86
 ip6_dst_alloc net/ipv6/route.c:344 [inline]
 icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261
 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807
 mld_send_cr net/ipv6/mcast.c:2119 [inline]
 mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651
 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
 worker_thread+0x618/0xa70 kernel/workqueue.c:2436
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

read-write to 0xffff888102110744 of 4 bytes by task 11607 on cpu 0:
 ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311
 dst_alloc+0x9b/0x160 net/core/dst.c:86
 ip6_dst_alloc net/ipv6/route.c:344 [inline]
 icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261
 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807
 mld_send_cr net/ipv6/mcast.c:2119 [inline]
 mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651
 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
 worker_thread+0x618/0xa70 kernel/workqueue.c:2436
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

value changed: 0x00000bb3 -> 0x00000ba9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11607 Comm: kworker/0:21 Not tainted 5.18.0-rc1-syzkaller-00037-g42e7a03d3bad-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: mld mld_ifc_work

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220413181333.649424-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-04-15 14:28:50 -07:00
..
acpi ACPI: bus: Eliminate acpi_bus_get_device() 2022-04-05 19:49:26 +02:00
asm-generic arm64 fixes for -rc2 2022-04-08 07:09:17 -10:00
clocksource
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2022-03-21 16:02:36 -07:00
drm
dt-bindings RTC for 5.18 2022-04-01 09:37:18 -07:00
keys KEYS: Introduce link restriction for machine keys 2022-03-08 13:55:52 +02:00
kunit
kvm
linux fscache fixes 2022-04-14 10:51:20 -07:00
math-emu
media
memory
misc
net ipv6: make ip6_rt_gc_expire an atomic_t 2022-04-15 14:28:50 -07:00
pcmcia
ras mm/memory-failure.c: fix race with changing page compound again 2022-03-22 15:57:07 -07:00
rdma
scsi SCSI misc on 20220324 2022-03-24 19:37:53 -07:00
soc drm for 5.18-rc1 2022-03-24 16:19:43 -07:00
sound sound fixes for 5.18-rc3 2022-04-14 11:08:12 -07:00
target scsi: target: Add iscsi/cpus_allowed_list in configfs 2022-03-14 23:40:36 -04:00
trace NFSD bug fixes for 5.18-rc: 2022-04-12 14:23:19 -10:00
uapi hardening fixes for v5.18-rc3 2022-04-12 14:29:40 -10:00
vdso
video
xen xen/grant-table: remove readonly parameter from functions 2022-03-15 20:34:40 -05:00