On 5/20/20 4:45 AM, Tetsuo Handa wrote:
> syzbot is reporting that tipc_udp_send_msg() is calling dst_cache_get()
> without preemption disabled [1]. Since b->media->send_msg() is called
> with RCU lock already held, we can also disable preemption at that point.
>
> [1]
> https://syzkaller.appspot.com/bug?id=dc6352b92862eb79373fe03fdf9af5928753e057
>
> Reported-by: syzbot+1a68504d96cd17b33...@syzkaller.appspotmail.com
> Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp>
> ---
> net/tipc/bearer.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
> index 34ca7b789eba..e5cf91665881 100644
> --- a/net/tipc/bearer.c
> +++ b/net/tipc/bearer.c
> @@ -516,6 +516,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
> struct tipc_msg *hdr = buf_msg(skb);
> struct tipc_bearer *b;
>
> + preempt_disable();
> rcu_read_lock();
> b = bearer_get(net, bearer_id);
> if (likely(b && (test_bit(0, &b->up) || msg_is_reset(hdr)))) {
> @@ -528,6 +529,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
> kfree_skb(skb);
> }
> rcu_read_unlock();
> + preempt_enable();
> }
>
> /* tipc_bearer_xmit() -send buffer to destination over bearer
> @@ -543,6 +545,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
> if (skb_queue_empty(xmitq))
> return;
>
> + preempt_disable();
> rcu_read_lock();
> b = bearer_get(net, bearer_id);
> if (unlikely(!b))
> @@ -560,6 +563,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
> }
> }
> rcu_read_unlock();
> + preempt_enable();
> }
>
> /* tipc_bearer_bc_xmit() - broadcast buffers to all destinations
> @@ -574,6 +578,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
> struct sk_buff *skb, *tmp;
> struct tipc_msg *hdr;
>
> + preempt_disable();
> rcu_read_lock();
> b = bearer_get(net, bearer_id);
> if (unlikely(!b || !test_bit(0, &b->up)))
> @@ -591,6 +596,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
> b->media->send_msg(net, skb, b, dst);
> }
> rcu_read_unlock();
> + preempt_enable();
> }
>
> /**
>
This is wrong, see my patch instead.
https://patchwork.ozlabs.org/project/netdev/patch/20200521182958.163436-1-eduma...@google.com/
Thanks.
