Eric Dumazet
95fc45d1de
ax25: rcu protect dev->ax25_ptr
syzbot found a lockdep issue [1].
We should remove ax25 RTNL dependency in ax25_setsockopt()
This should also fix a variety of possible UAF in ax25.
[1]
WARNING: possible circular locking dependency detected
6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted
------------------------------------------------------
syz.5.1818/12806 is trying to acquire lock:
ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
but task is already holding lock:
ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (sk_lock-AF_AX25){+.+.}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
lock_sock_nested+0x48/0x100 net/core/sock.c:3642
lock_sock include/net/sock.h:1618 [inline]
ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]
ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
__dev_notify_flags+0x207/0x400
dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026
dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820
sock_do_ioctl+0x240/0x460 net/socket.c:1234
sock_ioctl+0x626/0x8e0 net/socket.c:1339
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (rtnl_mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
do_sock_setsockopt+0x3af/0x720 net/socket.c:2324
__sys_setsockopt net/socket.c:2349 [inline]
__do_sys_setsockopt net/socket.c:2355 [inline]
__se_sys_setsockopt net/socket.c:2352 [inline]
__x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sk_lock-AF_AX25);
lock(rtnl_mutex);
lock(sk_lock-AF_AX25);
lock(rtnl_mutex);
*** DEADLOCK ***
1 lock held by syz.5.1818/12806:
#0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
#0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574
stack backtrace:
CPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
do_sock_setsockopt+0x3af/0x720 net/socket.c:2324
__sys_setsockopt net/socket.c:2349 [inline]
__do_sys_setsockopt net/socket.c:2355 [inline]
__se_sys_setsockopt net/socket.c:2352 [inline]
__x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b62385d29
Fixes: c433570458 ("ax25: fix a use-after-free in ax25_fillin_cb()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250103210514.87290-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-06 15:57:01 -08:00
..
2024-05-01 18:07:37 +01:00
2024-12-12 09:24:35 -05:00
2024-10-08 15:33:49 -07:00
2024-12-09 14:44:59 -08:00
2024-09-09 13:15:37 -07:00
2024-10-09 13:42:04 +01:00
2025-01-03 16:29:29 -08:00
2024-12-11 20:17:33 -08:00
2024-11-07 10:21:58 +01:00
2024-12-19 19:51:13 -08:00
2024-10-24 16:03:40 +02:00
2024-08-26 09:37:23 -07:00
2024-01-02 12:41:16 +00:00
2020-02-28 14:51:30 +01:00
2024-10-23 11:43:47 +02:00
2024-12-15 12:31:35 +00:00
2023-12-24 15:22:50 +00:00
2024-06-25 11:10:18 +02:00
2024-08-15 17:18:52 -07:00
2022-07-22 12:53:22 +01:00
2023-03-21 21:32:18 -07:00
2025-01-06 15:57:01 -08:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2024-08-26 09:37:22 -07:00
2024-08-26 09:37:22 -07:00
2024-11-14 11:16:28 +01:00
2024-08-27 13:11:37 -07:00
2021-03-26 17:43:55 +01:00
2024-11-11 18:45:06 -08:00
2024-10-02 17:23:23 -04:00
2022-11-16 11:31:47 +02:00
2024-12-19 18:54:07 -08:00
2024-03-06 21:01:26 +01:00
2024-10-30 15:29:59 +01:00
2024-10-02 17:23:23 -04:00
2020-03-27 19:40:38 -07:00
2021-12-22 15:03:47 -08:00
2022-07-22 12:53:22 +01:00
2023-07-14 20:39:29 -07:00
2022-07-24 18:39:17 -06:00
2023-07-27 17:17:32 -07:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2025-01-02 17:10:57 -08:00
2024-12-23 10:11:04 -08:00
2023-08-14 08:01:06 +01:00
2023-10-24 13:08:14 -07:00
2024-12-11 20:29:38 -08:00
2024-05-08 10:35:09 +01:00
2019-12-16 16:09:44 -08:00
2024-08-26 09:37:23 -07:00
2024-08-20 15:22:17 -07:00
2024-05-29 17:34:49 -07:00
2024-12-09 14:44:59 -08:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-04-01 21:27:08 -07:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2024-10-11 15:35:05 -07:00
2024-10-11 15:35:05 -07:00
2022-07-28 22:21:54 -07:00
2024-07-15 09:14:39 -07:00
2024-10-30 17:33:53 -07:00
2023-11-02 09:31:02 +01:00
2023-04-12 16:40:39 -07:00
2022-12-01 15:09:10 +01:00
2023-08-08 15:58:23 -07:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2024-12-09 14:44:59 -08:00
2022-10-31 10:43:04 +00:00
2024-04-01 10:49:28 +01:00
2024-05-14 10:49:50 -07:00
2023-06-10 00:11:41 -07:00
2024-05-07 01:35:55 +02:00
2022-07-22 12:53:22 +01:00
2023-07-28 14:07:59 -07:00
2024-04-30 18:46:52 -07:00
2024-08-26 09:37:23 -07:00
2021-06-28 14:29:45 -07:00
2024-05-08 10:35:09 +01:00
2024-10-25 10:44:41 +01:00
2023-11-20 11:43:03 +01:00
2024-02-26 18:40:34 -08:00
2022-07-22 12:53:22 +01:00
2024-08-05 16:27:26 -07:00
2024-05-13 18:19:09 -06:00
2024-10-04 15:34:40 -07:00
2022-02-07 20:12:45 -08:00
2021-10-15 11:33:08 +01:00
2024-05-23 14:14:23 -07:00
2024-08-05 16:22:45 -07:00
2025-01-06 13:49:38 -08:00
2024-12-11 20:17:33 -08:00
2024-12-17 19:37:00 -08:00
2024-02-28 11:19:41 +00:00
2021-11-16 13:16:54 +00:00
2024-10-11 15:35:05 -07:00
2024-07-14 07:34:16 -07:00
2024-04-01 10:49:28 +01:00
2024-11-12 11:24:50 +01:00
2024-10-31 18:10:07 -07:00
2023-04-22 01:39:41 +02:00
2024-12-16 18:13:44 -08:00
2022-09-29 07:18:00 +02:00
2022-07-22 12:53:22 +01:00
2022-10-31 20:14:27 -07:00
2024-08-05 16:27:26 -07:00
2024-12-09 14:44:59 -08:00
2024-10-09 08:53:01 +02:00
2024-08-19 18:36:12 -07:00
2024-10-10 11:57:34 +02:00
2024-12-06 17:43:08 -08:00
2023-08-04 15:33:17 -07:00
2023-08-04 15:33:17 -07:00
2024-07-15 08:51:01 -07:00
2023-07-20 10:46:28 +02:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2024-07-15 08:51:19 -07:00
2021-11-07 19:25:29 +00:00
2023-08-18 16:05:26 +02:00
2024-12-19 18:54:07 -08:00
2024-10-02 17:23:23 -04:00
2024-04-25 08:20:54 -07:00
2024-11-09 09:04:54 -08:00
2024-11-09 09:04:54 -08:00
2020-03-02 11:16:27 -08:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2020-05-29 21:20:20 -07:00
2024-09-11 15:57:50 -07:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2024-08-12 17:23:57 -07:00
2024-11-09 13:22:57 -08:00
2024-11-09 13:22:57 -08:00
2024-11-30 13:41:50 -08:00
2024-12-06 17:45:08 -08:00
2024-10-10 08:30:22 -07:00
2021-12-10 06:38:26 -08:00
2024-06-01 15:11:52 -07:00
2024-09-12 21:00:26 -07:00
2022-07-22 12:53:22 +01:00
2023-11-20 10:15:16 -08:00
2024-11-21 08:28:08 -08:00
2024-12-09 14:44:59 -08:00
2024-12-05 18:41:07 -08:00
2019-11-12 08:18:03 -08:00
2022-07-22 12:53:22 +01:00
2024-08-12 17:50:34 -07:00
2024-08-30 22:30:55 +02:00
2023-07-14 20:39:29 -07:00
2023-08-04 15:33:50 -07:00
2024-04-01 10:49:28 +01:00
2023-07-14 20:39:30 -07:00
2023-06-02 09:55:22 +01:00
2024-12-09 14:44:59 -08:00
2024-02-02 10:57:55 -08:00
2022-07-22 12:53:22 +01:00
2024-04-30 18:46:52 -07:00
2024-03-07 21:12:43 -08:00
2024-07-11 18:11:31 -07:00
2022-07-22 12:53:22 +01:00
2023-04-06 12:01:20 -07:00
2023-03-17 08:56:37 +00:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2024-06-06 15:18:04 +02:00
2022-08-01 11:59:23 -07:00
2024-12-20 13:50:09 -08:00
2023-06-19 11:32:58 -07:00
2024-04-01 11:28:32 +01:00
2023-07-14 20:39:30 -07:00
2024-08-07 10:24:46 +01:00
2024-11-11 17:26:52 -08:00
2024-12-05 17:39:04 -08:00
2024-05-10 18:52:45 -07:00
2022-07-22 12:53:22 +01:00
2024-05-30 18:29:38 -07:00
2024-06-24 16:41:23 -07:00
2024-05-30 18:29:38 -07:00
2021-04-28 14:06:45 -07:00
2024-04-30 13:24:48 +02:00
2019-10-05 16:29:00 -07:00
2024-08-02 17:16:59 -07:00
2025-01-03 16:29:29 -08:00
2023-10-04 11:49:20 -07:00
2022-07-22 12:53:22 +01:00
2022-07-18 11:24:10 +01:00
2024-02-16 09:36:37 +00:00
2024-02-14 10:49:37 +01:00
2024-11-03 12:10:11 -08:00
2023-12-04 14:45:26 -08:00
2024-12-09 14:44:59 -08:00
2024-07-08 14:07:31 -07:00
2024-05-09 20:25:55 -07:00
2023-07-28 14:07:59 -07:00
2019-10-04 14:07:07 -07:00
2024-12-16 12:47:29 +00:00
2023-08-01 15:06:27 -07:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2024-04-01 10:49:28 +01:00
2024-11-18 11:56:21 +00:00
2023-09-14 16:16:36 +02:00
2019-11-14 18:12:17 -08:00
2024-12-09 14:47:04 -08:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-12-19 19:51:14 -08:00
2024-07-02 15:26:57 +02:00
2024-12-19 19:51:14 -08:00
2024-11-06 12:42:51 +01:00
2024-12-05 18:41:06 -08:00