[SRU][Xenial][Zesty][PATCH 0/2] Fixes for LP:1729637

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

[SRU][Xenial][Zesty][PATCH 0/2] Fixes for LP:1729637

Joseph Salisbury-3
BugLink: http://bugs.launchpad.net/bugs/1729637

== SRU Justification ==
This bug causes Samba mount and umounts in docker container to trigger
a kernel Oops.  When running 2 docker containers, one as samba server and
another one as samba client that mounts and umounts a smb share a kernel
OOps can be triggered.  

This bug happens in Xenial and Zesty, and is fixed by the following two commits:
76da0704507b ("ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER")
12d94a804946 ("ipv6: fix NULL dereference in ip6_route_dev_notify()")

Both commits are clean cherry picks.  76da0704507b is in mainline as of v4.12.
Commit 12d94a804946 is in mainline as of v4.13-rc6.
   
== Fixes ==
commit 76da0704507bbc51875013f6557877ab308cfd0a
Author: WANG Cong <[hidden email]>
Date:   Tue Jun 20 11:42:27 2017 -0700

    ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER

commit 12d94a804946af291e24b80fc53ec86264765781
Author: Eric Dumazet <[hidden email]>
Date:   Tue Aug 15 04:09:51 2017 -0700

    ipv6: fix NULL dereference in ip6_route_dev_notify()

== Regression Potential ==
Both commits are specific to ipv6 and fix a regression introduced into Xenial and Zesty.

== Test Case ==
A test kernel was built with these patches and tested by the original bug reporter.
The bug reporter states the test kernel resolved the bug.
 


Eric Dumazet (1):
  ipv6: fix NULL dereference in ip6_route_dev_notify()

WANG Cong (1):
  ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER

 include/net/addrconf.h | 10 ++++++++++
 net/ipv6/route.c       | 12 ++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

--
2.7.4


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[SRU][Xenial][Zesty][PATCH 1/2] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER

Joseph Salisbury-3
From: WANG Cong <[hidden email]>

BugLink: http://bugs.launchpad.net/bugs/1729637

In commit 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
I assumed NETDEV_REGISTER and NETDEV_UNREGISTER are paired,
unfortunately, as reported by jeffy, netdev_wait_allrefs()
could rebroadcast NETDEV_UNREGISTER event until all refs are
gone.

We have to add an additional check to avoid this corner case.
For netdev_wait_allrefs() dev->reg_state is NETREG_UNREGISTERED,
for dev_change_net_namespace(), dev->reg_state is
NETREG_REGISTERED. So check for dev->reg_state != NETREG_UNREGISTERED.

Fixes: 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
Reported-by: jeffy <[hidden email]>
Cc: David Ahern <[hidden email]>
Signed-off-by: Cong Wang <[hidden email]>
Acked-by: David Ahern <[hidden email]>
Signed-off-by: David S. Miller <[hidden email]>
(cherry picked from commit 76da0704507bbc51875013f6557877ab308cfd0a)
Signed-off-by: Joseph Salisbury <[hidden email]>
---
 net/ipv6/route.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 89be89a..f2455e1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3395,7 +3395,11 @@ static int ip6_route_dev_notify(struct notifier_block *this,
  net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 #endif
- } else if (event == NETDEV_UNREGISTER) {
+ } else if (event == NETDEV_UNREGISTER &&
+    dev->reg_state != NETREG_UNREGISTERED) {
+ /* NETDEV_UNREGISTER could be fired for multiple times by
+ * netdev_wait_allrefs(). Make sure we only call this once.
+ */
  in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
--
2.7.4


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[SRU][Xenial][Zesty][PATCH 2/2] ipv6: fix NULL dereference in ip6_route_dev_notify()

Joseph Salisbury-3
In reply to this post by Joseph Salisbury-3
From: Eric Dumazet <[hidden email]>

BugLink: http://bugs.launchpad.net/bugs/1729637

Based on a syzkaller report [1], I found that a per cpu allocation
failure in snmp6_alloc_dev() would then lead to NULL dereference in
ip6_route_dev_notify().

It seems this is a very old bug, thus no Fixes tag in this submission.

Let's add in6_dev_put_clear() helper, as we will probably use
it elsewhere (once available/present in net-next)

[1]
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 17294 Comm: syz-executor6 Not tainted 4.13.0-rc2+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88019f456680 task.stack: ffff8801c6e58000
RIP: 0010:__read_once_size include/linux/compiler.h:250 [inline]
RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:26 [inline]
RIP: 0010:refcount_sub_and_test+0x7d/0x1b0 lib/refcount.c:178
RSP: 0018:ffff8801c6e5f1b0 EFLAGS: 00010202
RAX: 0000000000000037 RBX: dffffc0000000000 RCX: ffffc90005d25000
RDX: ffff8801c6e5f218 RSI: ffffffff82342bbf RDI: 0000000000000001
RBP: ffff8801c6e5f240 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff10038dcbe37
R13: 0000000000000006 R14: 0000000000000001 R15: 00000000000001b8
FS:  00007f21e0429700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001ddbc22000 CR3: 00000001d632b000 CR4: 00000000001426e0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 refcount_dec_and_test+0x1a/0x20 lib/refcount.c:211
 in6_dev_put include/net/addrconf.h:335 [inline]
 ip6_route_dev_notify+0x1c9/0x4a0 net/ipv6/route.c:3732
 notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
 call_netdevice_notifiers_info+0x51/0x90 net/core/dev.c:1678
 call_netdevice_notifiers net/core/dev.c:1694 [inline]
 rollback_registered_many+0x91c/0xe80 net/core/dev.c:7107
 rollback_registered+0x1be/0x3c0 net/core/dev.c:7149
 register_netdevice+0xbcd/0xee0 net/core/dev.c:7587
 register_netdev+0x1a/0x30 net/core/dev.c:7669
 loopback_net_init+0x76/0x160 drivers/net/loopback.c:214
 ops_init+0x10a/0x570 net/core/net_namespace.c:118
 setup_net+0x313/0x710 net/core/net_namespace.c:294
 copy_net_ns+0x27c/0x580 net/core/net_namespace.c:418
 create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
 unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
 SYSC_unshare kernel/fork.c:2347 [inline]
 SyS_unshare+0x653/0xfa0 kernel/fork.c:2297
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x4512c9
RSP: 002b:00007f21e0428c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 0000000000718150 RCX: 00000000004512c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062020200
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b973d
R13: 00000000ffffffff R14: 000000002001d000 R15: 00000000000002dd
Code: 50 2b 34 82 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 c7 40 08 f3 f3
f3 f3 e8 a1 43 39 ff 4c 89 f8 48 8b 95 70 ff ff ff 48 c1 e8 03 <0f> b6
0c 18 4c 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RIP: __read_once_size include/linux/compiler.h:250 [inline] RSP:
ffff8801c6e5f1b0
RIP: atomic_read arch/x86/include/asm/atomic.h:26 [inline] RSP:
ffff8801c6e5f1b0
RIP: refcount_sub_and_test+0x7d/0x1b0 lib/refcount.c:178 RSP:
ffff8801c6e5f1b0
---[ end trace e441d046c6410d31 ]---

Signed-off-by: Eric Dumazet <[hidden email]>
Reported-by: Dmitry Vyukov <[hidden email]>
Signed-off-by: David S. Miller <[hidden email]>
(cherry picked from commit 12d94a804946af291e24b80fc53ec86264765781)
Signed-off-by: Joseph Salisbury <[hidden email]>
---
 include/net/addrconf.h | 10 ++++++++++
 net/ipv6/route.c       |  6 +++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 18dd7a3..eb4af1c 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -301,6 +301,16 @@ static inline void in6_dev_put(struct inet6_dev *idev)
  in6_dev_finish_destroy(idev);
 }
 
+static inline void in6_dev_put_clear(struct inet6_dev **pidev)
+{
+ struct inet6_dev *idev = *pidev;
+
+ if (idev) {
+ in6_dev_put(idev);
+ *pidev = NULL;
+ }
+}
+
 static inline void __in6_dev_put(struct inet6_dev *idev)
 {
  atomic_dec(&idev->refcnt);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f2455e1..09f2644 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3400,10 +3400,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
  /* NETDEV_UNREGISTER could be fired for multiple times by
  * netdev_wait_allrefs(). Make sure we only call this once.
  */
- in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+ in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
- in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
- in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+ in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
+ in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
  }
 
--
2.7.4


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [SRU][Xenial][Zesty][PATCH 0/2] Fixes for LP:1729637

Stefan Bader-2
In reply to this post by Joseph Salisbury-3
On 08.11.2017 21:44, Joseph Salisbury wrote:

> BugLink: http://bugs.launchpad.net/bugs/1729637
>
> == SRU Justification ==
> This bug causes Samba mount and umounts in docker container to trigger
> a kernel Oops.  When running 2 docker containers, one as samba server and
> another one as samba client that mounts and umounts a smb share a kernel
> OOps can be triggered.  
>
> This bug happens in Xenial and Zesty, and is fixed by the following two commits:
> 76da0704507b ("ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER")
> 12d94a804946 ("ipv6: fix NULL dereference in ip6_route_dev_notify()")
>
> Both commits are clean cherry picks.  76da0704507b is in mainline as of v4.12.
> Commit 12d94a804946 is in mainline as of v4.13-rc6.
>    
> == Fixes ==
> commit 76da0704507bbc51875013f6557877ab308cfd0a
> Author: WANG Cong <[hidden email]>
> Date:   Tue Jun 20 11:42:27 2017 -0700
>
>     ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
> commit 12d94a804946af291e24b80fc53ec86264765781
> Author: Eric Dumazet <[hidden email]>
> Date:   Tue Aug 15 04:09:51 2017 -0700
>
>     ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> == Regression Potential ==
> Both commits are specific to ipv6 and fix a regression introduced into Xenial and Zesty.
>
> == Test Case ==
> A test kernel was built with these patches and tested by the original bug reporter.
> The bug reporter states the test kernel resolved the bug.
>  
>
>
> Eric Dumazet (1):
>   ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> WANG Cong (1):
>   ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
>  include/net/addrconf.h | 10 ++++++++++
>  net/ipv6/route.c       | 12 ++++++++----
>  2 files changed, 18 insertions(+), 4 deletions(-)
>
Acked-by: Stefan Bader <[hidden email]>



--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

ACK: [SRU][Xenial][Zesty][PATCH 0/2] Fixes for LP:1729637

Kleber Souza
In reply to this post by Joseph Salisbury-3
On 11/08/17 21:44, Joseph Salisbury wrote:

> BugLink: http://bugs.launchpad.net/bugs/1729637
>
> == SRU Justification ==
> This bug causes Samba mount and umounts in docker container to trigger
> a kernel Oops.  When running 2 docker containers, one as samba server and
> another one as samba client that mounts and umounts a smb share a kernel
> OOps can be triggered.  
>
> This bug happens in Xenial and Zesty, and is fixed by the following two commits:
> 76da0704507b ("ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER")
> 12d94a804946 ("ipv6: fix NULL dereference in ip6_route_dev_notify()")
>
> Both commits are clean cherry picks.  76da0704507b is in mainline as of v4.12.
> Commit 12d94a804946 is in mainline as of v4.13-rc6.
>    
> == Fixes ==
> commit 76da0704507bbc51875013f6557877ab308cfd0a
> Author: WANG Cong <[hidden email]>
> Date:   Tue Jun 20 11:42:27 2017 -0700
>
>     ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
> commit 12d94a804946af291e24b80fc53ec86264765781
> Author: Eric Dumazet <[hidden email]>
> Date:   Tue Aug 15 04:09:51 2017 -0700
>
>     ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> == Regression Potential ==
> Both commits are specific to ipv6 and fix a regression introduced into Xenial and Zesty.
>
> == Test Case ==
> A test kernel was built with these patches and tested by the original bug reporter.
> The bug reporter states the test kernel resolved the bug.
>  
>
>
> Eric Dumazet (1):
>   ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> WANG Cong (1):
>   ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
>  include/net/addrconf.h | 10 ++++++++++
>  net/ipv6/route.c       | 12 ++++++++----
>  2 files changed, 18 insertions(+), 4 deletions(-)
>

Acked-by: Kleber Sacilotto de Souza <[hidden email]>

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

APPLIED: [SRU][Xenial][Zesty][PATCH 0/2] Fixes for LP:1729637

Stefan Bader-2
In reply to this post by Joseph Salisbury-3
On 08.11.2017 21:44, Joseph Salisbury wrote:

> BugLink: http://bugs.launchpad.net/bugs/1729637
>
> == SRU Justification ==
> This bug causes Samba mount and umounts in docker container to trigger
> a kernel Oops.  When running 2 docker containers, one as samba server and
> another one as samba client that mounts and umounts a smb share a kernel
> OOps can be triggered.  
>
> This bug happens in Xenial and Zesty, and is fixed by the following two commits:
> 76da0704507b ("ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER")
> 12d94a804946 ("ipv6: fix NULL dereference in ip6_route_dev_notify()")
>
> Both commits are clean cherry picks.  76da0704507b is in mainline as of v4.12.
> Commit 12d94a804946 is in mainline as of v4.13-rc6.
>    
> == Fixes ==
> commit 76da0704507bbc51875013f6557877ab308cfd0a
> Author: WANG Cong <[hidden email]>
> Date:   Tue Jun 20 11:42:27 2017 -0700
>
>     ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
> commit 12d94a804946af291e24b80fc53ec86264765781
> Author: Eric Dumazet <[hidden email]>
> Date:   Tue Aug 15 04:09:51 2017 -0700
>
>     ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> == Regression Potential ==
> Both commits are specific to ipv6 and fix a regression introduced into Xenial and Zesty.
>
> == Test Case ==
> A test kernel was built with these patches and tested by the original bug reporter.
> The bug reporter states the test kernel resolved the bug.
>  
>
>
> Eric Dumazet (1):
>   ipv6: fix NULL dereference in ip6_route_dev_notify()
>
> WANG Cong (1):
>   ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
>  include/net/addrconf.h | 10 ++++++++++
>  net/ipv6/route.c       | 12 ++++++++----
>  2 files changed, 18 insertions(+), 4 deletions(-)
>
Applied to Zesty/Xenial master-next. Thanks.


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (836 bytes) Download Attachment