• Eric Dumazet's avatar
    netlink: netlink_diag_dump() runs without locks · 93636d1f
    Eric Dumazet authored
    A recent commit removed locking from netlink_diag_dump() but forgot
    one error case.
    
    =====================================
    [ BUG: bad unlock balance detected! ]
    4.9.0-rc3+ #336 Not tainted
    -------------------------------------
    syz-executor/4018 is trying to release lock ([   36.220068] nl_table_lock
    ) at:
    [<ffffffff82dc8683>] netlink_diag_dump+0x1a3/0x250 net/netlink/diag.c:182
    but there are no more locks to release!
    
    other info that might help us debug this:
    3 locks held by syz-executor/4018:
     #0: [   36.220068]  (
    sock_diag_mutex[   36.220068] ){+.+.+.}
    , at: [   36.220068] [<ffffffff82c3873b>] sock_diag_rcv+0x1b/0x40
     #1: [   36.220068]  (
    sock_diag_table_mutex[   36.220068] ){+.+.+.}
    , at: [   36.220068] [<ffffffff82c38e00>] sock_diag_rcv_msg+0x140/0x3a0
     #2: [   36.220068]  (
    nlk->cb_mutex[   36.220068] ){+.+.+.}
    , at: [   36.220068] [<ffffffff82db6600>] netlink_dump+0x50/0xac0
    
    stack backtrace:
    CPU: 1 PID: 4018 Comm: syz-executor Not tainted 4.9.0-rc3+ #336
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
     ffff8800645df688 ffffffff81b46934 ffffffff84eb3e78 ffff88006ad85800
     ffffffff82dc8683 ffffffff84eb3e78 ffff8800645df6b8 ffffffff812043ca
     dffffc0000000000 ffff88006ad85ff8 ffff88006ad85fd0 00000000ffffffff
    Call Trace:
     [<     inline     >] __dump_stack lib/dump_stack.c:15
     [<ffffffff81b46934>] dump_stack+0xb3/0x10f lib/dump_stack.c:51
     [<ffffffff812043ca>] print_unlock_imbalance_bug+0x17a/0x1a0
    kernel/locking/lockdep.c:3388
     [<     inline     >] __lock_release kernel/locking/lockdep.c:3512
     [<ffffffff8120cfd8>] lock_release+0x8e8/0xc60 kernel/locking/lockdep.c:3765
     [<     inline     >] __raw_read_unlock ./include/linux/rwlock_api_smp.h:225
     [<ffffffff83fc001a>] _raw_read_unlock+0x1a/0x30 kernel/locking/spinlock.c:255
     [<ffffffff82dc8683>] netlink_diag_dump+0x1a3/0x250 net/netlink/diag.c:182
     [<ffffffff82db6947>] netlink_dump+0x397/0xac0 net/netlink/af_netlink.c:2110
    
    Fixes: ad202074 ("netlink: Use rhashtable walk interface in diag dump")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    93636d1f
diag.c 4.72 KB