From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail115-24.sinamail.sina.com.cn (mail115-24.sinamail.sina.com.cn [218.30.115.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1666C13E41F for ; Thu, 27 Jun 2024 11:32:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=218.30.115.24 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719487940; cv=none; b=aZMHCYfNnrfY0UZTigHpWHP6S5ZqGKMFOfix5g9W6JWk1GgZdWJi+oBeayhSwh1DKwfUmvATmRC5B1vayzGsaU9CpxJK2bl0XgEiTni6Uap45PScDDXLgrDSkXbVB5+oqLlqZp9FaQyuB2ypebeUv+VrXPzB7usYX2lCajOLXy0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719487940; c=relaxed/simple; bh=ApRCmEbA6vezFhZufRdGg6MKNdccaPXCIGAXsyAMZ44=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=XM+k4iNsNzFu8EHlNxIh1sGxS2BdR219dMawPd7pQksMJKcJfZwkJ0KCoFEMA2hVEvh3E5kq9T1NNsz31fRmsRXJpBwJSphp+h2mfPlabbYc4uXBZANbD+aVGfUMV7qOb3uMvqVs0t6kFWHot4UFs2OMcyHSLGZX9wMjdee9rpE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; arc=none smtp.client-ip=218.30.115.24 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([116.24.11.136]) by sina.com (10.185.250.22) with ESMTP id 667D4D9000004B85; Thu, 27 Jun 2024 19:31:30 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 3074477602774 X-SMAIL-UIID: A2CB9165EB994617B9A7128ABC32BB9C-20240627-193130-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Write in l2tp_session_delete Date: Thu, 27 Jun 2024 19:31:20 +0800 Message-Id: <20240627113120.2142-1-hdanton@sina.com> In-Reply-To: <0000000000008405e0061bb6d4d5@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On 25/06/2024 14:25, syzbot wrote: > syzbot found the following issue on: > > HEAD commit: 185d72112b95 net: xilinx: axienet: Enable multicast by def.. > git tree: net-next > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1062bd46980000 #syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 185d72112b95 --- x/net/l2tp/l2tp_core.c +++ y/net/l2tp/l2tp_core.c @@ -1298,8 +1298,10 @@ static void l2tp_tunnel_closeall(struct list_for_each_safe(pos, tmp, &tunnel->session_list) { session = list_entry(pos, struct l2tp_session, list); list_del_init(&session->list); + l2tp_session_inc_refcount(session); spin_unlock_bh(&tunnel->list_lock); l2tp_session_delete(session); + l2tp_session_dec_refcount(session); spin_lock_bh(&tunnel->list_lock); } spin_unlock_bh(&tunnel->list_lock); --- x/net/l2tp/l2tp_ppp.c +++ y/net/l2tp/l2tp_ppp.c @@ -393,14 +393,6 @@ abort: * Session (and tunnel control) socket create/destroy. *****************************************************************************/ -static void pppol2tp_put_sk(struct rcu_head *head) -{ - struct pppol2tp_session *ps; - - ps = container_of(head, typeof(*ps), rcu); - sock_put(ps->__sk); -} - /* Really kill the session socket. (Called from sock_put() if * refcnt == 0.) */ @@ -444,22 +436,8 @@ static int pppol2tp_release(struct socke session = pppol2tp_sock_to_session(sk); if (session) { - struct pppol2tp_session *ps; - l2tp_session_delete(session); - - ps = l2tp_session_priv(session); - mutex_lock(&ps->sk_lock); - ps->__sk = rcu_dereference_protected(ps->sk, - lockdep_is_held(&ps->sk_lock)); - RCU_INIT_POINTER(ps->sk, NULL); - mutex_unlock(&ps->sk_lock); - call_rcu(&ps->rcu, pppol2tp_put_sk); - - /* Rely on the sock_put() call at the end of the function for - * dropping the reference held by pppol2tp_sock_to_session(). - * The last reference will be dropped by pppol2tp_put_sk(). - */ + l2tp_session_dec_refcount(session); } release_sock(sk); @@ -469,6 +447,7 @@ static int pppol2tp_release(struct socke * zero. */ sock_put(sk); + sock_put(sk); return 0; @@ -831,6 +810,7 @@ static int pppol2tp_connect(struct socke out_no_ppp: /* This is how we get the session context from the socket. */ sk->sk_user_data = session; + l2tp_session_inc_refcount(session); rcu_assign_pointer(ps->sk, sk); mutex_unlock(&ps->sk_lock); --