Eric Dumazet a1865f2e7d netlink: annotate lockless accesses to nlk->max_recvmsg_len ... syzbot reported a data-race in data-race in netlink_recvmsg() [1] Indeed, netlink_recvmsg() can be run concurrently, and netlink_dump() also needs protection. [1] BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg read to 0xffff888141840b38 of 8 bytes by task 23057 on cpu 0: netlink_recvmsg+0xea/0x730 net/netlink/af_netlink.c:1988 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] __sys_recvfrom+0x1ee/0x2e0 net/socket.c:2194 __do_sys_recvfrom net/socket.c:2212 [inline] __se_sys_recvfrom net/socket.c:2208 [inline] __x64_sys_recvfrom+0x78/0x90 net/socket.c:2208 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffff888141840b38 of 8 bytes by task 23037 on cpu 1: netlink_recvmsg+0x114/0x730 net/netlink/af_netlink.c:1989 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] ____sys_recvmsg+0x156/0x310 net/socket.c:2720 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0x0000000000001000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23037 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00195-g5a57b48fdfcb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fixes: 9063e21fb0 ("netlink: autosize skb lengthes") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20230403214643.768555-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-04-04 18:57:13 -07:00
..
6lowpan
9p	9p patches for 6.3 merge window (part 1)	2023-03-01 08:52:49 -08:00
802	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
8021q	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
appletalk
atm	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
ax25	ax25: af_ax25: Remove unnecessary (void*) conversions	2022-11-16 13:31:03 +00:00
batman-adv	batman-adv: tvlv: prepare for tvlv enabled multicast packet type	2023-01-21 19:01:59 +01:00
bluetooth	Bluetooth: HCI: Fix global-out-of-bounds	2023-03-23 13:09:38 -07:00
bpf	bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES	2023-03-06 11:15:54 -08:00
bpfilter
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf	2023-02-22 21:25:23 -08:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-02 22:22:07 -08:00
can	can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write	2023-03-27 14:40:45 +02:00
ceph	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
core	net: don't let netpoll invoke NAPI if in xmit context	2023-04-02 13:26:21 +01:00
dcb	net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps	2023-01-20 09:33:22 +00:00
dccp	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.	2023-02-10 19:53:42 -08:00
devlink	devlink: drop leftover duplicate/unused code	2023-02-20 11:38:35 +00:00
dns_resolver	cred: Do not default to init_cred in prepare_kernel_cred()	2022-11-01 10:04:52 -07:00
dsa	net: dsa: sync unicast and multicast addresses for VLAN filters too	2023-03-30 11:32:46 -07:00
ethernet	net: ethernet: use sysfs_emit() to instead of scnprintf()	2022-12-07 20:02:44 -08:00
ethtool	ethtool: reset #lanes when lanes is omitted	2023-04-04 18:57:10 -07:00
hsr	hsr: ratelimit only when errors are printed	2023-03-16 21:11:03 -07:00
ieee802154	net: ieee802154: remove an unnecessary null pointer check	2023-03-17 09:13:53 +01:00
ife
ipv4	ping: Fix potentail NULL deref for /proc/net/icmp.	2023-04-04 18:56:58 -07:00
ipv6	raw: Fix NULL deref in raw_get_next().	2023-04-04 18:56:58 -07:00
iucv	net/iucv: Fix size of interrupt data	2023-03-16 17:34:40 -07:00
kcm	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
key	af_key: Fix heap information leak	2023-02-13 09:30:14 +00:00
l2tp	l2tp: generate correct module alias strings	2023-03-31 09:25:12 +01:00
l3mdev
lapb
llc
mac80211	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta	2023-03-30 11:19:53 +02:00
mac802154	Merge tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next	2023-02-20 16:40:52 -08:00
mctp	net: mctp: purge receive queues on sk destruction	2023-01-28 00:26:09 -08:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-15 10:26:37 +00:00
mptcp	mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()	2023-03-10 21:42:56 -08:00
ncsi	net: Use of_property_read_bool() for boolean properties	2023-03-16 17:41:28 +00:00
netfilter	netfilter: nft_redir: correct value of inet type .maxattrs	2023-03-08 12:26:42 +01:00
netlabel
netlink	netlink: annotate lockless accesses to nlk->max_recvmsg_len	2023-04-04 18:57:13 -07:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-01-30 07:30:47 +00:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-07 13:37:05 -08:00
nsh
openvswitch	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
packet	net: no longer support SOCK_REFCNT_DEBUG feature	2023-02-15 10:25:21 +00:00
phonet	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
psample
qrtr	net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT	2023-04-03 10:15:45 +01:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-02-13 09:33:39 +00:00
rfkill	rfkill: Use sysfs_emit() to instead of sprintf()	2023-02-14 12:21:14 +01:00
rose	net/rose: Fix to not accept on connected socket	2023-01-28 00:19:57 -08:00
rxrpc	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
sched	net/sched: act_api: add specific EXT_WARN_MSG for tc action	2023-03-16 21:25:45 -07:00
sctp	sctp: check send stream number after wait_for_sndbuf	2023-04-02 13:44:58 +01:00
smc	net/smc: Fix device de-init sequence	2023-03-15 08:15:19 +00:00
strparser
sunrpc	nfsd-6.3 fixes:	2023-03-25 13:32:43 -07:00
switchdev
tipc	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
tls	net: tls: fix device-offloaded sendpage straddling records	2023-03-06 13:26:16 -08:00
unix	af_unix: fix struct pid leaks in OOB support	2023-03-08 23:26:03 -08:00
vmw_vsock	vsock/vmci: convert VMCI error code to -ENOMEM on send	2023-03-31 09:42:30 +01:00
wireless	Including fixes from netfilter, wifi and ipsec.	2023-03-17 13:31:16 -07:00
x25	net/x25: Fix to not accept on connected socket	2023-01-25 09:51:04 +00:00
xdp	xsk: Add missing overflow check in xdp_umem_reg	2023-03-16 16:02:55 +01:00
xfrm	ipsec-2023-03-15	2023-03-16 17:23:48 -07:00
compat.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-01-05 22:12:00 -08:00
socket.c	net: avoid double iput when sock_alloc_file fails	2023-03-08 23:26:51 -08:00
sysctl_net.c