From patchwork Sat Jun 19 16:18:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 12333059 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A2F1C48BE5 for ; Sat, 19 Jun 2021 16:19:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 406E060FDB for ; Sat, 19 Jun 2021 16:19:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234728AbhFSQVg (ORCPT ); Sat, 19 Jun 2021 12:21:36 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:57506 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232640AbhFSQVe (ORCPT ); Sat, 19 Jun 2021 12:21:34 -0400 Received: from 1.general.cascardo.us.vpn ([10.172.70.58] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1ludgn-0006fD-1c; Sat, 19 Jun 2021 16:19:21 +0000 From: Thadeu Lima de Souza Cascardo To: linux-can@vger.kernel.org Cc: Oliver Hartkopp , Marc Kleine-Budde , "David S. Miller" , Jakub Kicinski , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Thadeu Lima de Souza Cascardo , syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com, Norbert Slusarek Subject: [PATCH] can: bcm: delay release of struct bcm_op after synchronize_rcu Date: Sat, 19 Jun 2021 13:18:13 -0300 Message-Id: <20210619161813.2098382-1-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org can_rx_register callbacks may be called concurrently to the call to can_rx_unregister. The callbacks and callback data, though, are protected by RCU and the struct sock reference count. So the callback data is really attached to the life of sk, meaning that it should be released on sk_destruct. However, bcm_remove_op calls tasklet_kill, and RCU callbacks may be called under RCU softirq, so that cannot be used on kernels before the introduction of HRTIMER_MODE_SOFT. However, bcm_rx_handler is called under RCU protection, so after calling can_rx_unregister, we may call synchronize_rcu in order to wait for any RCU read-side critical sections to finish. That is, bcm_rx_handler won't be called anymore for those ops. So, we only free them, after we do that synchronize_rcu. Reported-by: syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com Reported-by: Norbert Slusarek Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Oliver Hartkopp --- net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/can/bcm.c b/net/can/bcm.c index f3e4d9528fa3..c67916020e63 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -785,6 +785,7 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh, bcm_rx_handler, op); list_del(&op->list); + synchronize_rcu(); bcm_remove_op(op); return 1; /* done */ } @@ -1533,6 +1534,11 @@ static int bcm_release(struct socket *sock) REGMASK(op->can_id), bcm_rx_handler, op); + } + + synchronize_rcu(); + + list_for_each_entry_safe(op, next, &bo->rx_ops, list) { bcm_remove_op(op); }