From: Paul Moore <paul@paul-moore.com>
To: Davide Caratti <dcaratti@redhat.com>
Cc: netdev@vger.kernel.org, casey@schaufler-ca.com,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
linux-security-module@vger.kernel.org, pabeni@redhat.com,
xmu@redhat.com
Subject: Re: [PATCH net v4] netlabel: fix RCU annotation for IPv4 options on socket creation
Date: Thu, 9 May 2024 15:13:36 -0400 [thread overview]
Message-ID: <CAHC9VhQEa+6BQs-9jT4JR64nDGio8FbAG5smPaq8E3gi=H1SLg@mail.gmail.com> (raw)
In-Reply-To: <262f71a207e8cedd388bd89d17ef16155eb2acee.1715248275.git.dcaratti@redhat.com>
On Thu, May 9, 2024 at 6:36 AM Davide Caratti <dcaratti@redhat.com> wrote:
>
> Xiumei reports the following splat when netlabel and TCP socket are used:
>
> =============================
> WARNING: suspicious RCU usage
> 6.9.0-rc2+ #637 Not tainted
> -----------------------------
> net/ipv4/cipso_ipv4.c:1880 suspicious rcu_dereference_protected() usage!
>
> other info that might help us debug this:
>
> rcu_scheduler_active = 2, debug_locks = 1
> 1 lock held by ncat/23333:
> #0: ffffffff906030c0 (rcu_read_lock){....}-{1:2}, at: netlbl_sock_setattr+0x25/0x1b0
>
> stack backtrace:
> CPU: 11 PID: 23333 Comm: ncat Kdump: loaded Not tainted 6.9.0-rc2+ #637
> Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013
> Call Trace:
> <TASK>
> dump_stack_lvl+0xa9/0xc0
> lockdep_rcu_suspicious+0x117/0x190
> cipso_v4_sock_setattr+0x1ab/0x1b0
> netlbl_sock_setattr+0x13e/0x1b0
> selinux_netlbl_socket_post_create+0x3f/0x80
> selinux_socket_post_create+0x1a0/0x460
> security_socket_post_create+0x42/0x60
> __sock_create+0x342/0x3a0
> __sys_socket_create.part.22+0x42/0x70
> __sys_socket+0x37/0xb0
> __x64_sys_socket+0x16/0x20
> do_syscall_64+0x96/0x180
> ? do_user_addr_fault+0x68d/0xa30
> ? exc_page_fault+0x171/0x280
> ? asm_exc_page_fault+0x22/0x30
> entry_SYSCALL_64_after_hwframe+0x71/0x79
> RIP: 0033:0x7fbc0ca3fc1b
> Code: 73 01 c3 48 8b 0d 05 f2 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d5 f1 1b 00 f7 d8 64 89 01 48
> RSP: 002b:00007fff18635208 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
> RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbc0ca3fc1b
> RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
> RBP: 000055d24f80f8a0 R08: 0000000000000003 R09: 0000000000000001
>
> R10: 0000000000020000 R11: 0000000000000246 R12: 000055d24f80f8a0
> R13: 0000000000000000 R14: 000055d24f80fb88 R15: 0000000000000000
> </TASK>
>
> The current implementation of cipso_v4_sock_setattr() replaces IP options
> under the assumption that the caller holds the socket lock; however, such
> assumption is not true, nor needed, in selinux_socket_post_create() hook.
>
> Let all callers of cipso_v4_sock_setattr() specify the "socket lock held"
> condition, except selinux_socket_post_create() _ where such condition can
> safely be set as true even without holding the socket lock.
>
> v4:
> - fix build when CONFIG_LOCKDEP is unset (thanks kernel test robot)
>
> v3:
> - rename variable to 'sk_locked' (thanks Paul Moore)
> - keep rcu_replace_pointer() open-coded and re-add NULL check of 'old',
> these two changes will be posted in another patch (thanks Paul Moore)
>
> v2:
> - pass lockdep_sock_is_held() through a boolean variable in the stack
> (thanks Eric Dumazet, Paul Moore, Casey Schaufler)
> - use rcu_replace_pointer() instead of rcu_dereference_protected() +
> rcu_assign_pointer()
> - remove NULL check of 'old' before kfree_rcu()
>
> Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt")
> Reported-by: Xiumei Mu <xmu@redhat.com>
> Acked-by: Paul Moore <paul@paul-moore.com>
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> ---
> include/net/cipso_ipv4.h | 6 ++++--
> include/net/netlabel.h | 12 ++++++++++--
> net/ipv4/cipso_ipv4.c | 7 ++++---
> net/netlabel/netlabel_kapi.c | 26 +++++++++++++++++++++++---
> security/selinux/netlabel.c | 5 ++++-
> security/smack/smack_lsm.c | 3 ++-
> 6 files changed, 47 insertions(+), 12 deletions(-)
...
> +/**
> + * netlbl_sk_lock_check - Check if the socket lock has been acquired.
> + * @sk: the socket to check
> + *
> + * Description: check if @sk is locked. Returns true if socket @sk is locked
> + * or if lock debugging is disabled at runtime or compile-time
> + *
> + */
> +bool netlbl_sk_lock_check(struct sock *sk)
> +{
> +#ifdef CONFIG_LOCKDEP
> + if (debug_locks)
> + return lockdep_sock_is_held(sk);
> +#endif
> + return true;
> +}
It might be cleaner to do this:
#ifdef CONFIG_LOCKDEP
bool netlbl_sk_lock_check(sk)
{
if (debug_locks)
return lockdep_sock_is_held(sk);
return true;
}
#else
bool netlbl_sk_lock_check(sk)
{
return true;
}
#endif
--
paul-moore.com
prev parent reply other threads:[~2024-05-09 19:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-09 10:07 [PATCH net v4] netlabel: fix RCU annotation for IPv4 options on socket creation Davide Caratti
2024-05-09 19:13 ` Paul Moore [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhQEa+6BQs-9jT4JR64nDGio8FbAG5smPaq8E3gi=H1SLg@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=casey@schaufler-ca.com \
--cc=davem@davemloft.net \
--cc=dcaratti@redhat.com \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=xmu@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).