From: Xin Long <lucien....@gmail.com>
Date: Thu, 20 Aug 2020 15:34:47 +0800
> b->media->send_msg() requires rcu_read_lock(), as we can see
> elsewhere in tipc, tipc_bearer_xmit, tipc_bearer_xmit_skb
> and tipc_bearer_bc_xmit().
>
> Syzbot has reported this issue as:
>
> net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage!
> Workqueue: cryptd cryptd_queue_worker
> Call Trace:
> tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466
> tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761
> cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739
> cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181
> process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
> worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
> kthread+0x3b5/0x4a0 kernel/kthread.c:291
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
>
> So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done()
> for b->media->send_msg().
>
> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
> Reported-by: syzbot+47bbc6b678d317ccc...@syzkaller.appspotmail.com
> Signed-off-by: Xin Long <lucien....@gmail.com>
Applied and queued up for -stable, thank you.
