From: Yajun Deng <hidden> Date: 2021-07-29 07:14:10
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
---
include/net/dn_fib.h | 2 +-
include/net/ip_fib.h | 2 +-
net/decnet/dn_fib.c | 6 +++---
net/ipv4/fib_semantics.c | 8 ++++----
4 files changed, 9 insertions(+), 9 deletions(-)
From: David Ahern <hidden> Date: 2021-07-29 14:55:05
On 7/29/21 1:13 AM, Yajun Deng wrote:
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
---
include/net/dn_fib.h | 2 +-
include/net/ip_fib.h | 2 +-
net/decnet/dn_fib.c | 6 +++---
net/ipv4/fib_semantics.c | 8 ++++----
4 files changed, 9 insertions(+), 9 deletions(-)
for net-next so the subject line should be "[PATCH net-next] ...."
Reviewed-by: David Ahern <dsahern@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Thu, 29 Jul 2021 15:13:50 +0800 you wrote:
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
---
include/net/dn_fib.h | 2 +-
include/net/ip_fib.h | 2 +-
net/decnet/dn_fib.c | 6 +++---
net/ipv4/fib_semantics.c | 8 ++++----
4 files changed, 9 insertions(+), 9 deletions(-)
On Thu, Jul 29, 2021 at 03:13:50PM +0800, Yajun Deng wrote:
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
From: Marek Szyprowski <m.szyprowski@samsung.com> Date: 2021-08-03 11:08:08
Hi
On 29.07.2021 09:13, Yajun Deng wrote:
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
This patch landed in linux-next 20210802 as commit 79976892f7ea ("net:
convert fib_treeref from int to refcount_t"). It triggers the following
warning on all my test systems (ARM32bit and ARM64bit based):
------------[ cut here ]------------
WARNING: CPU: 3 PID: 858 at lib/refcount.c:25 fib_create_info+0xbd8/0xc18
refcount_t: addition on 0; use-after-free.
Modules linked in: s5p_csis s5p_mfc s5p_fimc exynos4_is_common s5p_jpeg
v4l2_fwnode v4l2_async v4l2_mem2mem videobuf2_dma_contig
videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc s5p_cec
CPU: 3 PID: 858 Comm: ip Not tainted 5.14.0-rc2-00636-g79976892f7ea #10620
Hardware name: Samsung Exynos (Flattened Device Tree)
[<c0111900>] (unwind_backtrace) from [<c010d0b8>] (show_stack+0x10/0x14)
[<c010d0b8>] (show_stack) from [<c0b827b0>] (dump_stack_lvl+0x58/0x70)
[<c0b827b0>] (dump_stack_lvl) from [<c0127938>] (__warn+0x118/0x11c)
[<c0127938>] (__warn) from [<c01279b4>] (warn_slowpath_fmt+0x78/0xbc)
[<c01279b4>] (warn_slowpath_fmt) from [<c0a5b600>]
(fib_create_info+0xbd8/0xc18)
[<c0a5b600>] (fib_create_info) from [<c0a5fe20>]
(fib_table_insert+0x90/0x650)
[<c0a5fe20>] (fib_table_insert) from [<c0a54ea0>] (fib_magic+0x164/0x16c)
[<c0a54ea0>] (fib_magic) from [<c0a580d0>] (fib_add_ifaddr+0x60/0x158)
[<c0a580d0>] (fib_add_ifaddr) from [<c0a58e6c>]
(fib_inetaddr_event+0x7c/0xc0)
[<c0a58e6c>] (fib_inetaddr_event) from [<c0154ef0>]
(blocking_notifier_call_chain+0x6c/0x94)
[<c0154ef0>] (blocking_notifier_call_chain) from [<c0a448ec>]
(__inet_insert_ifa+0x29c/0x3b8)
[<c0a448ec>] (__inet_insert_ifa) from [<c0a4882c>]
(inetdev_event+0x204/0x79c)
[<c0a4882c>] (inetdev_event) from [<c0154c0c>]
(raw_notifier_call_chain+0x34/0x6c)
[<c0154c0c>] (raw_notifier_call_chain) from [<c0988900>]
(__dev_notify_flags+0x5c/0xcc)
[<c0988900>] (__dev_notify_flags) from [<c09890b0>]
(dev_change_flags+0x3c/0x44)
[<c09890b0>] (dev_change_flags) from [<c09993f8>] (do_setlink+0x338/0x9f0)
[<c09993f8>] (do_setlink) from [<c099fc70>] (__rtnl_newlink+0x51c/0x804)
[<c099fc70>] (__rtnl_newlink) from [<c099ff9c>] (rtnl_newlink+0x44/0x60)
[<c099ff9c>] (rtnl_newlink) from [<c099ba74>]
(rtnetlink_rcv_msg+0x154/0x4f4)
[<c099ba74>] (rtnetlink_rcv_msg) from [<c09d44a4>]
(netlink_rcv_skb+0xe4/0x118)
[<c09d44a4>] (netlink_rcv_skb) from [<c09d3c0c>]
(netlink_unicast+0x1ac/0x240)
[<c09d3c0c>] (netlink_unicast) from [<c09d3f70>]
(netlink_sendmsg+0x2d0/0x418)
[<c09d3f70>] (netlink_sendmsg) from [<c0955a30>]
(____sys_sendmsg+0x1d4/0x230)
[<c0955a30>] (____sys_sendmsg) from [<c095755c>] (___sys_sendmsg+0x70/0x9c)
[<c095755c>] (___sys_sendmsg) from [<c0957964>] (__sys_sendmsg+0x54/0x90)
[<c0957964>] (__sys_sendmsg) from [<c0100060>] (ret_fast_syscall+0x0/0x2c)
Exception stack(0xc346dfa8 to 0xc346dff0)
dfa0: becb275c becaa6a4 00000003 becaa6b0 00000000
00000000
dfc0: becb275c becaa6a4 00000000 00000128 0050e304 61091e59 0050e000
becaa6b0
dfe0: 0000006c becaa660 004d7f80 b6e7fab8
irq event stamp: 5457
hardirqs last enabled at (5465): [<c01a53d0>] console_unlock+0x50c/0x650
hardirqs last disabled at (5484): [<c01a53b4>] console_unlock+0x4f0/0x650
softirqs last enabled at (5544): [<c0101768>] __do_softirq+0x500/0x63c
softirqs last disabled at (5493): [<c0131578>] irq_exit+0x214/0x220
---[ end trace dc2378f379f97dd0 ]---
This issue should be possible to trigger also with qemu. If you need any
help in reproducing it, let me know.
This patch from David Ahern was applied in the newest net-next.
-------- Forwarded message -------
From: "David Ahern" <redacted>
To: "Ioana Ciornei" <redacted>, "Yajun Deng" <redacted>
CC: davem@davemloft.net, kuba@kernel.org, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net
Sent: August 2, 2021 10:36 PM
Subject: Re: [PATCH] net: convert fib_treeref from int to refcount_t
On 8/2/21 7:37 AM, Ioana Ciornei wrote:
Unfortunately, with this patch applied I get into the following WARNINGs
when booting over NFS:
From: Marek Szyprowski <m.szyprowski@samsung.com> Date: 2021-08-03 11:25:06
On 03.08.2021 13:17, yajun.deng@linux.dev wrote:
This patch from David Ahern was applied in the newest net-next.
-------- Forwarded message -------
From: "David Ahern" <redacted>
To: "Ioana Ciornei" <redacted>, "Yajun Deng" <redacted>
CC: davem@davemloft.net, kuba@kernel.org, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net
Sent: August 2, 2021 10:36 PM
Subject: Re: [PATCH] net: convert fib_treeref from int to refcount_t
On 8/2/21 7:37 AM, Ioana Ciornei wrote:
quoted
Unfortunately, with this patch applied I get into the following WARNINGs
when booting over NFS:
Can you test the attached?
Yes, it fixes the issue on my test systems. Feel free to add:
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland
From: David Ahern <hidden> Date: 2021-08-03 14:44:09
On 8/3/21 5:08 AM, Marek Szyprowski wrote:
Hi
On 29.07.2021 09:13, Yajun Deng wrote:
quoted
refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.
Signed-off-by: Yajun Deng <redacted>
This patch landed in linux-next 20210802 as commit 79976892f7ea ("net:
convert fib_treeref from int to refcount_t"). It triggers the following
warning on all my test systems (ARM32bit and ARM64bit based):