Eric Dumazet
3fe9be220c
net: icmp: fix data-race in cmp_global_allow() ...
commit bbab7ef235031f6733b5429ae7877bfa22339712 upstream.
This code reads two global variables without protection
of a lock. We need READ_ONCE()/WRITE_ONCE() pairs to
avoid load/store-tearing and better document the intent.
KCSAN reported :
BUG: KCSAN: data-race in icmp_global_allow / icmp_global_allow
read to 0xffffffff861a8014 of 4 bytes by task 11201 on cpu 0:
icmp_global_allow+0x36/0x1b0 net/ipv4/icmp.c:254
icmpv6_global_allow net/ipv6/icmp.c:184 [inline]
icmpv6_global_allow net/ipv6/icmp.c:179 [inline]
icmp6_send+0x493/0x1140 net/ipv6/icmp.c:514
icmpv6_send+0x71/0xb0 net/ipv6/ip6_icmp.c:43
ip6_link_failure+0x43/0x180 net/ipv6/route.c:2640
dst_link_failure include/net/dst.h:419 [inline]
vti_xmit net/ipv4/ip_vti.c:243 [inline]
vti_tunnel_xmit+0x27f/0xa50 net/ipv4/ip_vti.c:279
__netdev_start_xmit include/linux/netdevice.h:4420 [inline]
netdev_start_xmit include/linux/netdevice.h:4434 [inline]
xmit_one net/core/dev.c:3280 [inline]
dev_hard_start_xmit+0xef/0x430 net/core/dev.c:3296
__dev_queue_xmit+0x14c9/0x1b60 net/core/dev.c:3873
dev_queue_xmit+0x21/0x30 net/core/dev.c:3906
neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
neigh_output include/net/neighbour.h:511 [inline]
ip6_finish_output2+0x7a6/0xec0 net/ipv6/ip6_output.c:116
__ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
__ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
dst_output include/net/dst.h:436 [inline]
ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
write to 0xffffffff861a8014 of 4 bytes by task 11183 on cpu 1:
icmp_global_allow+0x174/0x1b0 net/ipv4/icmp.c:272
icmpv6_global_allow net/ipv6/icmp.c:184 [inline]
icmpv6_global_allow net/ipv6/icmp.c:179 [inline]
icmp6_send+0x493/0x1140 net/ipv6/icmp.c:514
icmpv6_send+0x71/0xb0 net/ipv6/ip6_icmp.c:43
ip6_link_failure+0x43/0x180 net/ipv6/route.c:2640
dst_link_failure include/net/dst.h:419 [inline]
vti_xmit net/ipv4/ip_vti.c:243 [inline]
vti_tunnel_xmit+0x27f/0xa50 net/ipv4/ip_vti.c:279
__netdev_start_xmit include/linux/netdevice.h:4420 [inline]
netdev_start_xmit include/linux/netdevice.h:4434 [inline]
xmit_one net/core/dev.c:3280 [inline]
dev_hard_start_xmit+0xef/0x430 net/core/dev.c:3296
__dev_queue_xmit+0x14c9/0x1b60 net/core/dev.c:3873
dev_queue_xmit+0x21/0x30 net/core/dev.c:3906
neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
neigh_output include/net/neighbour.h:511 [inline]
ip6_finish_output2+0x7a6/0xec0 net/ipv6/ip6_output.c:116
__ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
__ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 11183 Comm: syz-executor.2 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Fixes: 4cdf507d5452 ("icmp: add a global rate limitation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:18:40 +01:00
2019-07-06 12:50:01 +02:00
2019-09-27 15:10:34 -07:00
2019-06-19 17:09:55 +02:00
2019-10-24 14:53:49 -07:00
2019-09-24 16:37:18 +02:00
2019-11-18 17:08:20 -08:00
2019-09-24 16:37:18 +02:00
2019-10-28 16:39:07 -07:00
2019-12-31 16:44:33 +01:00
2019-07-25 18:00:41 -07:00
2019-07-12 16:03:16 -07:00
2020-01-04 19:18:38 +01:00
2019-10-28 13:33:41 -07:00
2019-12-31 16:45:56 +01:00
2019-09-16 12:06:25 +02:00
2019-12-31 16:41:37 +01:00
2019-05-30 11:29:52 -07:00
2019-12-18 16:08:40 +01:00
2019-10-28 13:33:41 -07:00
2019-07-10 18:43:43 -07:00
2019-11-16 12:23:53 -08:00
2019-06-07 11:00:14 -07:00
2019-12-18 16:08:54 +01:00
2019-10-24 14:53:48 -07:00
2019-09-26 08:56:17 +02:00
2020-01-04 19:18:40 +01:00
2019-12-18 16:08:42 +01:00
2019-07-29 10:26:14 -07:00
2019-09-27 10:27:14 +02:00
2019-07-08 19:48:57 -07:00
2019-12-18 16:08:40 +01:00
2019-06-23 13:24:17 -07:00
2019-06-17 20:20:36 -07:00
2019-10-09 21:42:59 -07:00
2019-12-31 16:45:44 +01:00
2019-05-30 11:26:41 -07:00
2019-12-18 16:08:42 +01:00
2019-09-19 18:04:40 -07:00
2019-12-18 16:08:47 +01:00
2019-09-01 11:45:02 -07:00
2019-06-14 19:50:33 -07:00
2019-10-24 14:53:48 -07:00
2019-12-31 16:41:23 +01:00
2019-06-19 17:09:55 +02:00
2019-12-18 16:08:56 +01:00
2019-12-31 16:41:12 +01:00
2019-10-28 13:33:41 -07:00
2019-12-04 22:30:54 +01:00
2019-09-21 18:45:46 -07:00
2019-11-16 12:59:08 -08:00
2019-12-13 08:43:18 +01:00
2019-10-24 14:53:48 -07:00
2019-10-31 12:23:09 -07:00
2019-12-18 16:08:59 +01:00
2020-01-04 19:18:34 +01:00
2020-01-04 19:18:37 +01:00
2019-06-22 08:59:24 -04:00
2019-12-13 08:42:34 +01:00
2019-05-30 11:26:32 -07:00
2019-12-18 16:08:42 +01:00
2019-12-18 16:08:31 +01:00
2019-10-28 13:33:41 -07:00
2019-11-08 12:17:50 -08:00
2019-08-10 15:25:47 -07:00
2019-10-30 10:11:18 +01:00
2019-10-09 21:42:59 -07:00
2019-10-23 20:22:11 -07:00
2019-11-12 08:24:38 +01:00
2019-05-31 15:30:03 -06:00
2019-08-17 12:40:08 -07:00
2019-12-04 22:30:44 +01:00
2019-05-21 10:50:45 +02:00
3fe9be220c