| Message ID | f4260d000a3a55b9e8b6a3b4e3fffc7da9f82d41.1715359817.git.dcaratti@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 8ec9897ec2e93a412b9e3119e3137583a85969e0 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v5] netlabel: fix RCU annotation for IPv4 options on socket creation | expand |
On 5/10/2024 10:19 AM, Davide Caratti wrote: > Xiumei reports the following splat when netlabel and TCP socket are used: > > ============================= > WARNING: suspicious RCU usage > 6.9.0-rc2+ #637 Not tainted > ----------------------------- > net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage! > > other info that might help us debug this: > > rcu_scheduler_active = 2, debug_locks = 1 > 1 lock held by ncat/23333: > #0: ffffffff906030c0 (rcu_read_lock){....}-{1:2}, at: netlbl_sock_setattr+0x25/0x1b0 > > stack backtrace: > CPU: 11 PID: 23333 Comm: ncat Kdump: loaded Not tainted 6.9.0-rc2+ #637 > Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 > Call Trace: > <TASK> > dump_stack_lvl+0xa9/0xc0 > lockdep_rcu_suspicious+0x117/0x190 > cipso_v4_sock_setattr+0x1ab/0x1b0 > netlbl_sock_setattr+0x13e/0x1b0 > selinux_netlbl_socket_post_create+0x3f/0x80 > selinux_socket_post_create+0x1a0/0x460 > security_socket_post_create+0x42/0x60 > __sock_create+0x342/0x3a0 > __sys_socket_create.part.22+0x42/0x70 > __sys_socket+0x37/0xb0 > __x64_sys_socket+0x16/0x20 > do_syscall_64+0x96/0x180 > ? do_user_addr_fault+0x68d/0xa30 > ? exc_page_fault+0x171/0x280 > ? asm_exc_page_fault+0x22/0x30 > entry_SYSCALL_64_after_hwframe+0x71/0x79 > RIP: 0033:0x7fbc0ca3fc1b > Code: 73 01 c3 48 8b 0d 05 f2 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d5 f1 1b 00 f7 d8 64 89 01 48 > RSP: 002b:00007fff18635208 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 > RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbc0ca3fc1b > RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002 > RBP: 000055d24f80f8a0 R08: 0000000000000003 R09: 0000000000000001 > > R10: 0000000000020000 R11: 0000000000000246 R12: 000055d24f80f8a0 > R13: 0000000000000000 R14: 000055d24f80fb88 R15: 0000000000000000 > </TASK> > > The current implementation of cipso_v4_sock_setattr() replaces IP options > under the assumption that the caller holds the socket lock; however, such > assumption is not true, nor needed, in selinux_socket_post_create() hook. > > Let all callers of cipso_v4_sock_setattr() specify the "socket lock held" > condition, except selinux_socket_post_create() _ where such condition can > safely be set as true even without holding the socket lock. > > v5: > - fix kernel-doc > - adjust #idfefs around prototype of netlbl_sk_lock_check() (thanks Paul Moore) > > v4: > - fix build when CONFIG_LOCKDEP is unset (thanks kernel test robot) > > v3: > - rename variable to 'sk_locked' (thanks Paul Moore) > - keep rcu_replace_pointer() open-coded and re-add NULL check of 'old', > these two changes will be posted in another patch (thanks Paul Moore) > > v2: > - pass lockdep_sock_is_held() through a boolean variable in the stack > (thanks Eric Dumazet, Paul Moore, Casey Schaufler) > - use rcu_replace_pointer() instead of rcu_dereference_protected() + > rcu_assign_pointer() > - remove NULL check of 'old' before kfree_rcu() > > Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt") > Reported-by: Xiumei Mu <xmu@redhat.com> > Acked-by: Paul Moore <paul@paul-moore.com> > Signed-off-by: Davide Caratti <dcaratti@redhat.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> > --- > include/net/cipso_ipv4.h | 6 ++++-- > include/net/netlabel.h | 12 ++++++++++-- > net/ipv4/cipso_ipv4.c | 7 ++++--- > net/netlabel/netlabel_kapi.c | 31 ++++++++++++++++++++++++++++--- > security/selinux/netlabel.c | 5 ++++- > security/smack/smack_lsm.c | 3 ++- > 6 files changed, 52 insertions(+), 12 deletions(-) > > diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h > index 53dd7d988a2d..c9111bb2f59b 100644 > --- a/include/net/cipso_ipv4.h > +++ b/include/net/cipso_ipv4.h > @@ -183,7 +183,8 @@ int cipso_v4_getattr(const unsigned char *cipso, > struct netlbl_lsm_secattr *secattr); > int cipso_v4_sock_setattr(struct sock *sk, > const struct cipso_v4_doi *doi_def, > - const struct netlbl_lsm_secattr *secattr); > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked); > void cipso_v4_sock_delattr(struct sock *sk); > int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); > int cipso_v4_req_setattr(struct request_sock *req, > @@ -214,7 +215,8 @@ static inline int cipso_v4_getattr(const unsigned char *cipso, > > static inline int cipso_v4_sock_setattr(struct sock *sk, > const struct cipso_v4_doi *doi_def, > - const struct netlbl_lsm_secattr *secattr) > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked) > { > return -ENOSYS; > } > diff --git a/include/net/netlabel.h b/include/net/netlabel.h > index f3ab0b8a4b18..2133ad723fc1 100644 > --- a/include/net/netlabel.h > +++ b/include/net/netlabel.h > @@ -470,7 +470,8 @@ void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state); > int netlbl_enabled(void); > int netlbl_sock_setattr(struct sock *sk, > u16 family, > - const struct netlbl_lsm_secattr *secattr); > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked); > void netlbl_sock_delattr(struct sock *sk); > int netlbl_sock_getattr(struct sock *sk, > struct netlbl_lsm_secattr *secattr); > @@ -487,6 +488,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb, > u16 family, > struct netlbl_lsm_secattr *secattr); > void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway); > +bool netlbl_sk_lock_check(struct sock *sk); > > /* > * LSM label mapping cache operations > @@ -614,7 +616,8 @@ static inline int netlbl_enabled(void) > } > static inline int netlbl_sock_setattr(struct sock *sk, > u16 family, > - const struct netlbl_lsm_secattr *secattr) > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked) > { > return -ENOSYS; > } > @@ -673,6 +676,11 @@ static inline struct audit_buffer *netlbl_audit_start(int type, > { > return NULL; > } > + > +static inline bool netlbl_sk_lock_check(struct sock *sk) > +{ > + return true; > +} > #endif /* CONFIG_NETLABEL */ > > const struct netlbl_calipso_ops * > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c > index 8b17d83e5fde..dd6d46015058 100644 > --- a/net/ipv4/cipso_ipv4.c > +++ b/net/ipv4/cipso_ipv4.c > @@ -1815,6 +1815,7 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len, > * @sk: the socket > * @doi_def: the CIPSO DOI to use > * @secattr: the specific security attributes of the socket > + * @sk_locked: true if caller holds the socket lock > * > * Description: > * Set the CIPSO option on the given socket using the DOI definition and > @@ -1826,7 +1827,8 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len, > */ > int cipso_v4_sock_setattr(struct sock *sk, > const struct cipso_v4_doi *doi_def, > - const struct netlbl_lsm_secattr *secattr) > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked) > { > int ret_val = -EPERM; > unsigned char *buf = NULL; > @@ -1876,8 +1878,7 @@ int cipso_v4_sock_setattr(struct sock *sk, > > sk_inet = inet_sk(sk); > > - old = rcu_dereference_protected(sk_inet->inet_opt, > - lockdep_sock_is_held(sk)); > + old = rcu_dereference_protected(sk_inet->inet_opt, sk_locked); > if (inet_test_bit(IS_ICSK, sk)) { > sk_conn = inet_csk(sk); > if (old) > diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c > index 1ba4f58e1d35..cd9160bbc919 100644 > --- a/net/netlabel/netlabel_kapi.c > +++ b/net/netlabel/netlabel_kapi.c > @@ -965,6 +965,7 @@ int netlbl_enabled(void) > * @sk: the socket to label > * @family: protocol family > * @secattr: the security attributes > + * @sk_locked: true if caller holds the socket lock > * > * Description: > * Attach the correct label to the given socket using the security attributes > @@ -977,7 +978,8 @@ int netlbl_enabled(void) > */ > int netlbl_sock_setattr(struct sock *sk, > u16 family, > - const struct netlbl_lsm_secattr *secattr) > + const struct netlbl_lsm_secattr *secattr, > + bool sk_locked) > { > int ret_val; > struct netlbl_dom_map *dom_entry; > @@ -997,7 +999,7 @@ int netlbl_sock_setattr(struct sock *sk, > case NETLBL_NLTYPE_CIPSOV4: > ret_val = cipso_v4_sock_setattr(sk, > dom_entry->def.cipso, > - secattr); > + secattr, sk_locked); > break; > case NETLBL_NLTYPE_UNLABELED: > ret_val = 0; > @@ -1090,6 +1092,28 @@ int netlbl_sock_getattr(struct sock *sk, > return ret_val; > } > > +/** > + * netlbl_sk_lock_check - Check if the socket lock has been acquired. > + * @sk: the socket to be checked > + * > + * Return: true if socket @sk is locked or if lock debugging is disabled at > + * runtime or compile-time; false otherwise > + * > + */ > +#ifdef CONFIG_LOCKDEP > +bool netlbl_sk_lock_check(struct sock *sk) > +{ > + if (debug_locks) > + return lockdep_sock_is_held(sk); > + return true; > +} > +#else > +bool netlbl_sk_lock_check(struct sock *sk) > +{ > + return true; > +} > +#endif > + > /** > * netlbl_conn_setattr - Label a connected socket using the correct protocol > * @sk: the socket to label > @@ -1126,7 +1150,8 @@ int netlbl_conn_setattr(struct sock *sk, > switch (entry->type) { > case NETLBL_NLTYPE_CIPSOV4: > ret_val = cipso_v4_sock_setattr(sk, > - entry->cipso, secattr); > + entry->cipso, secattr, > + netlbl_sk_lock_check(sk)); > break; > case NETLBL_NLTYPE_UNLABELED: > /* just delete the protocols we support for right now > diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c > index 8f182800e412..55885634e880 100644 > --- a/security/selinux/netlabel.c > +++ b/security/selinux/netlabel.c > @@ -402,7 +402,10 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) > secattr = selinux_netlbl_sock_genattr(sk); > if (secattr == NULL) > return -ENOMEM; > - rc = netlbl_sock_setattr(sk, family, secattr); > + /* On socket creation, replacement of IP options is safe even if > + * the caller does not hold the socket lock. > + */ > + rc = netlbl_sock_setattr(sk, family, secattr, true); > switch (rc) { > case 0: > sksec->nlbl_state = NLBL_LABELED; > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index 146667937811..efeac8365ad0 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -2565,7 +2565,8 @@ static int smack_netlbl_add(struct sock *sk) > local_bh_disable(); > bh_lock_sock_nested(sk); > > - rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); > + rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel, > + netlbl_sk_lock_check(sk)); > switch (rc) { > case 0: > ssp->smk_state = SMK_NETLBL_LABELED;
On Fri, May 10, 2024 at 1:19 PM Davide Caratti <dcaratti@redhat.com> wrote: > > Xiumei reports the following splat when netlabel and TCP socket are used: > > ============================= > WARNING: suspicious RCU usage > 6.9.0-rc2+ #637 Not tainted > ----------------------------- > net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage! > > other info that might help us debug this: > > rcu_scheduler_active = 2, debug_locks = 1 > 1 lock held by ncat/23333: > #0: ffffffff906030c0 (rcu_read_lock){....}-{1:2}, at: netlbl_sock_setattr+0x25/0x1b0 > > stack backtrace: > CPU: 11 PID: 23333 Comm: ncat Kdump: loaded Not tainted 6.9.0-rc2+ #637 > Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 > Call Trace: > <TASK> > dump_stack_lvl+0xa9/0xc0 > lockdep_rcu_suspicious+0x117/0x190 > cipso_v4_sock_setattr+0x1ab/0x1b0 > netlbl_sock_setattr+0x13e/0x1b0 > selinux_netlbl_socket_post_create+0x3f/0x80 > selinux_socket_post_create+0x1a0/0x460 > security_socket_post_create+0x42/0x60 > __sock_create+0x342/0x3a0 > __sys_socket_create.part.22+0x42/0x70 > __sys_socket+0x37/0xb0 > __x64_sys_socket+0x16/0x20 > do_syscall_64+0x96/0x180 > ? do_user_addr_fault+0x68d/0xa30 > ? exc_page_fault+0x171/0x280 > ? asm_exc_page_fault+0x22/0x30 > entry_SYSCALL_64_after_hwframe+0x71/0x79 > RIP: 0033:0x7fbc0ca3fc1b > Code: 73 01 c3 48 8b 0d 05 f2 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d5 f1 1b 00 f7 d8 64 89 01 48 > RSP: 002b:00007fff18635208 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 > RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbc0ca3fc1b > RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002 > RBP: 000055d24f80f8a0 R08: 0000000000000003 R09: 0000000000000001 > > R10: 0000000000020000 R11: 0000000000000246 R12: 000055d24f80f8a0 > R13: 0000000000000000 R14: 000055d24f80fb88 R15: 0000000000000000 > </TASK> > > The current implementation of cipso_v4_sock_setattr() replaces IP options > under the assumption that the caller holds the socket lock; however, such > assumption is not true, nor needed, in selinux_socket_post_create() hook. > > Let all callers of cipso_v4_sock_setattr() specify the "socket lock held" > condition, except selinux_socket_post_create() _ where such condition can > safely be set as true even without holding the socket lock. > > v5: > - fix kernel-doc > - adjust #idfefs around prototype of netlbl_sk_lock_check() (thanks Paul Moore) > > v4: > - fix build when CONFIG_LOCKDEP is unset (thanks kernel test robot) > > v3: > - rename variable to 'sk_locked' (thanks Paul Moore) > - keep rcu_replace_pointer() open-coded and re-add NULL check of 'old', > these two changes will be posted in another patch (thanks Paul Moore) > > v2: > - pass lockdep_sock_is_held() through a boolean variable in the stack > (thanks Eric Dumazet, Paul Moore, Casey Schaufler) > - use rcu_replace_pointer() instead of rcu_dereference_protected() + > rcu_assign_pointer() > - remove NULL check of 'old' before kfree_rcu() > > Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt") > Reported-by: Xiumei Mu <xmu@redhat.com> > Acked-by: Paul Moore <paul@paul-moore.com> > Signed-off-by: Davide Caratti <dcaratti@redhat.com> > --- > include/net/cipso_ipv4.h | 6 ++++-- > include/net/netlabel.h | 12 ++++++++++-- > net/ipv4/cipso_ipv4.c | 7 ++++--- > net/netlabel/netlabel_kapi.c | 31 ++++++++++++++++++++++++++++--- > security/selinux/netlabel.c | 5 ++++- > security/smack/smack_lsm.c | 3 ++- > 6 files changed, 52 insertions(+), 12 deletions(-) Thanks Davide. Acked-by: Paul Moore <paul@paul-moore.com>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Fri, 10 May 2024 19:19:12 +0200 you wrote: > Xiumei reports the following splat when netlabel and TCP socket are used: > > ============================= > WARNING: suspicious RCU usage > 6.9.0-rc2+ #637 Not tainted > ----------------------------- > net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage! > > [...] Here is the summary with links: - [net,v5] netlabel: fix RCU annotation for IPv4 options on socket creation https://git.kernel.org/netdev/net/c/8ec9897ec2e9 You are awesome, thank you!
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h index 53dd7d988a2d..c9111bb2f59b 100644 --- a/include/net/cipso_ipv4.h +++ b/include/net/cipso_ipv4.h @@ -183,7 +183,8 @@ int cipso_v4_getattr(const unsigned char *cipso, struct netlbl_lsm_secattr *secattr); int cipso_v4_sock_setattr(struct sock *sk, const struct cipso_v4_doi *doi_def, - const struct netlbl_lsm_secattr *secattr); + const struct netlbl_lsm_secattr *secattr, + bool sk_locked); void cipso_v4_sock_delattr(struct sock *sk); int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); int cipso_v4_req_setattr(struct request_sock *req, @@ -214,7 +215,8 @@ static inline int cipso_v4_getattr(const unsigned char *cipso, static inline int cipso_v4_sock_setattr(struct sock *sk, const struct cipso_v4_doi *doi_def, - const struct netlbl_lsm_secattr *secattr) + const struct netlbl_lsm_secattr *secattr, + bool sk_locked) { return -ENOSYS; } diff --git a/include/net/netlabel.h b/include/net/netlabel.h index f3ab0b8a4b18..2133ad723fc1 100644 --- a/include/net/netlabel.h +++ b/include/net/netlabel.h @@ -470,7 +470,8 @@ void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state); int netlbl_enabled(void); int netlbl_sock_setattr(struct sock *sk, u16 family, - const struct netlbl_lsm_secattr *secattr); + const struct netlbl_lsm_secattr *secattr, + bool sk_locked); void netlbl_sock_delattr(struct sock *sk); int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); @@ -487,6 +488,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb, u16 family, struct netlbl_lsm_secattr *secattr); void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway); +bool netlbl_sk_lock_check(struct sock *sk); /* * LSM label mapping cache operations @@ -614,7 +616,8 @@ static inline int netlbl_enabled(void) } static inline int netlbl_sock_setattr(struct sock *sk, u16 family, - const struct netlbl_lsm_secattr *secattr) + const struct netlbl_lsm_secattr *secattr, + bool sk_locked) { return -ENOSYS; } @@ -673,6 +676,11 @@ static inline struct audit_buffer *netlbl_audit_start(int type, { return NULL; } + +static inline bool netlbl_sk_lock_check(struct sock *sk) +{ + return true; +} #endif /* CONFIG_NETLABEL */ const struct netlbl_calipso_ops * diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index 8b17d83e5fde..dd6d46015058 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -1815,6 +1815,7 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len, * @sk: the socket * @doi_def: the CIPSO DOI to use * @secattr: the specific security attributes of the socket + * @sk_locked: true if caller holds the socket lock * * Description: * Set the CIPSO option on the given socket using the DOI definition and @@ -1826,7 +1827,8 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len, */ int cipso_v4_sock_setattr(struct sock *sk, const struct cipso_v4_doi *doi_def, - const struct netlbl_lsm_secattr *secattr) + const struct netlbl_lsm_secattr *secattr, + bool sk_locked) { int ret_val = -EPERM; unsigned char *buf = NULL; @@ -1876,8 +1878,7 @@ int cipso_v4_sock_setattr(struct sock *sk, sk_inet = inet_sk(sk); - old = rcu_dereference_protected(sk_inet->inet_opt, - lockdep_sock_is_held(sk)); + old = rcu_dereference_protected(sk_inet->inet_opt, sk_locked); if (inet_test_bit(IS_ICSK, sk)) { sk_conn = inet_csk(sk); if (old) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 1ba4f58e1d35..cd9160bbc919 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -965,6 +965,7 @@ int netlbl_enabled(void) * @sk: the socket to label * @family: protocol family * @secattr: the security attributes + * @sk_locked: true if caller holds the socket lock * * Description: * Attach the correct label to the given socket using the security attributes @@ -977,7 +978,8 @@ int netlbl_enabled(void) */ int netlbl_sock_setattr(struct sock *sk, u16 family, - const struct netlbl_lsm_secattr *secattr) + const struct netlbl_lsm_secattr *secattr, + bool sk_locked) { int ret_val; struct netlbl_dom_map *dom_entry; @@ -997,7 +999,7 @@ int netlbl_sock_setattr(struct sock *sk, case NETLBL_NLTYPE_CIPSOV4: ret_val = cipso_v4_sock_setattr(sk, dom_entry->def.cipso, - secattr); + secattr, sk_locked); break; case NETLBL_NLTYPE_UNLABELED: ret_val = 0; @@ -1090,6 +1092,28 @@ int netlbl_sock_getattr(struct sock *sk, return ret_val; } +/** + * netlbl_sk_lock_check - Check if the socket lock has been acquired. + * @sk: the socket to be checked + * + * Return: true if socket @sk is locked or if lock debugging is disabled at + * runtime or compile-time; false otherwise + * + */ +#ifdef CONFIG_LOCKDEP +bool netlbl_sk_lock_check(struct sock *sk) +{ + if (debug_locks) + return lockdep_sock_is_held(sk); + return true; +} +#else +bool netlbl_sk_lock_check(struct sock *sk) +{ + return true; +} +#endif + /** * netlbl_conn_setattr - Label a connected socket using the correct protocol * @sk: the socket to label @@ -1126,7 +1150,8 @@ int netlbl_conn_setattr(struct sock *sk, switch (entry->type) { case NETLBL_NLTYPE_CIPSOV4: ret_val = cipso_v4_sock_setattr(sk, - entry->cipso, secattr); + entry->cipso, secattr, + netlbl_sk_lock_check(sk)); break; case NETLBL_NLTYPE_UNLABELED: /* just delete the protocols we support for right now diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 8f182800e412..55885634e880 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -402,7 +402,10 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) secattr = selinux_netlbl_sock_genattr(sk); if (secattr == NULL) return -ENOMEM; - rc = netlbl_sock_setattr(sk, family, secattr); + /* On socket creation, replacement of IP options is safe even if + * the caller does not hold the socket lock. + */ + rc = netlbl_sock_setattr(sk, family, secattr, true); switch (rc) { case 0: sksec->nlbl_state = NLBL_LABELED; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 146667937811..efeac8365ad0 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2565,7 +2565,8 @@ static int smack_netlbl_add(struct sock *sk) local_bh_disable(); bh_lock_sock_nested(sk); - rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); + rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel, + netlbl_sk_lock_check(sk)); switch (rc) { case 0: ssp->smk_state = SMK_NETLBL_LABELED;
Xiumei reports the following splat when netlabel and TCP socket are used: ============================= WARNING: suspicious RCU usage 6.9.0-rc2+ #637 Not tainted ----------------------------- net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ncat/23333: #0: ffffffff906030c0 (rcu_read_lock){....}-{1:2}, at: netlbl_sock_setattr+0x25/0x1b0 stack backtrace: CPU: 11 PID: 23333 Comm: ncat Kdump: loaded Not tainted 6.9.0-rc2+ #637 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <TASK> dump_stack_lvl+0xa9/0xc0 lockdep_rcu_suspicious+0x117/0x190 cipso_v4_sock_setattr+0x1ab/0x1b0 netlbl_sock_setattr+0x13e/0x1b0 selinux_netlbl_socket_post_create+0x3f/0x80 selinux_socket_post_create+0x1a0/0x460 security_socket_post_create+0x42/0x60 __sock_create+0x342/0x3a0 __sys_socket_create.part.22+0x42/0x70 __sys_socket+0x37/0xb0 __x64_sys_socket+0x16/0x20 do_syscall_64+0x96/0x180 ? do_user_addr_fault+0x68d/0xa30 ? exc_page_fault+0x171/0x280 ? asm_exc_page_fault+0x22/0x30 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7fbc0ca3fc1b Code: 73 01 c3 48 8b 0d 05 f2 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d5 f1 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff18635208 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbc0ca3fc1b RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 000055d24f80f8a0 R08: 0000000000000003 R09: 0000000000000001 R10: 0000000000020000 R11: 0000000000000246 R12: 000055d24f80f8a0 R13: 0000000000000000 R14: 000055d24f80fb88 R15: 0000000000000000 </TASK> The current implementation of cipso_v4_sock_setattr() replaces IP options under the assumption that the caller holds the socket lock; however, such assumption is not true, nor needed, in selinux_socket_post_create() hook. Let all callers of cipso_v4_sock_setattr() specify the "socket lock held" condition, except selinux_socket_post_create() _ where such condition can safely be set as true even without holding the socket lock. v5: - fix kernel-doc - adjust #idfefs around prototype of netlbl_sk_lock_check() (thanks Paul Moore) v4: - fix build when CONFIG_LOCKDEP is unset (thanks kernel test robot) v3: - rename variable to 'sk_locked' (thanks Paul Moore) - keep rcu_replace_pointer() open-coded and re-add NULL check of 'old', these two changes will be posted in another patch (thanks Paul Moore) v2: - pass lockdep_sock_is_held() through a boolean variable in the stack (thanks Eric Dumazet, Paul Moore, Casey Schaufler) - use rcu_replace_pointer() instead of rcu_dereference_protected() + rcu_assign_pointer() - remove NULL check of 'old' before kfree_rcu() Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt") Reported-by: Xiumei Mu <xmu@redhat.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Davide Caratti <dcaratti@redhat.com> --- include/net/cipso_ipv4.h | 6 ++++-- include/net/netlabel.h | 12 ++++++++++-- net/ipv4/cipso_ipv4.c | 7 ++++--- net/netlabel/netlabel_kapi.c | 31 ++++++++++++++++++++++++++++--- security/selinux/netlabel.c | 5 ++++- security/smack/smack_lsm.c | 3 ++- 6 files changed, 52 insertions(+), 12 deletions(-)