• Eric Dumazet's avatar
    af_key: do not use GFP_KERNEL in atomic contexts · 36f41f8f
    Eric Dumazet authored
    pfkey_broadcast() might be called from non process contexts,
    we can not use GFP_KERNEL in these cases [1].
    
    This patch partially reverts commit ba51b6be ("net: Fix RCU splat in
    af_key"), only keeping the GFP_ATOMIC forcing under rcu_read_lock()
    section.
    
    [1] : syzkaller reported :
    
    in_atomic(): 1, irqs_disabled(): 0, pid: 2932, name: syzkaller183439
    3 locks held by syzkaller183439/2932:
     #0:  (&net->xfrm.xfrm_cfg_mutex){+.+.+.}, at: [<ffffffff83b43888>] pfkey_sendmsg+0x4c8/0x9f0 net/key/af_key.c:3649
     #1:  (&pfk->dump_lock){+.+.+.}, at: [<ffffffff83b467f6>] pfkey_do_dump+0x76/0x3f0 net/key/af_key.c:293
     #2:  (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] spin_lock_bh include/linux/spinlock.h:304 [inline]
     #2:  (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] xfrm_policy_walk+0x192/0xa30 net/xfrm/xfrm_policy.c:1028
    CPU: 0 PID: 2932 Comm: syzkaller183439 Not tainted 4.13.0-rc4+ #24
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:16 [inline]
     dump_stack+0x194/0x257 lib/dump_stack.c:52
     ___might_sleep+0x2b2/0x470 kernel/sched/core.c:5994
     __might_sleep+0x95/0x190 kernel/sched/core.c:5947
     slab_pre_alloc_hook mm/slab.h:416 [inline]
     slab_alloc mm/slab.c:3383 [inline]
     kmem_cache_alloc+0x24b/0x6e0 mm/slab.c:3559
     skb_clone+0x1a0/0x400 net/core/skbuff.c:1037
     pfkey_broadcast_one+0x4b2/0x6f0 net/key/af_key.c:207
     pfkey_broadcast+0x4ba/0x770 net/key/af_key.c:281
     dump_sp+0x3d6/0x500 net/key/af_key.c:2685
     xfrm_policy_walk+0x2f1/0xa30 net/xfrm/xfrm_policy.c:1042
     pfkey_dump_sp+0x42/0x50 net/key/af_key.c:2695
     pfkey_do_dump+0xaa/0x3f0 net/key/af_key.c:299
     pfkey_spddump+0x1a0/0x210 net/key/af_key.c:2722
     pfkey_process+0x606/0x710 net/key/af_key.c:2814
     pfkey_sendmsg+0x4d6/0x9f0 net/key/af_key.c:3650
    sock_sendmsg_nosec net/socket.c:633 [inline]
     sock_sendmsg+0xca/0x110 net/socket.c:643
     ___sys_sendmsg+0x755/0x890 net/socket.c:2035
     __sys_sendmsg+0xe5/0x210 net/socket.c:2069
     SYSC_sendmsg net/socket.c:2080 [inline]
     SyS_sendmsg+0x2d/0x50 net/socket.c:2076
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x445d79
    RSP: 002b:00007f32447c1dc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445d79
    RDX: 0000000000000000 RSI: 000000002023dfc8 RDI: 0000000000000008
    RBP: 0000000000000086 R08: 00007f32447c2700 R09: 00007f32447c2700
    R10: 00007f32447c2700 R11: 0000000000000202 R12: 0000000000000000
    R13: 00007ffe33edec4f R14: 00007f32447c29c0 R15: 0000000000000000
    
    Fixes: ba51b6be ("net: Fix RCU splat in af_key")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: David Ahern <dsa@cumulusnetworks.com>
    Acked-by: default avatarDavid Ahern <dsahern@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    36f41f8f
af_key.c 101 KB