Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] net: convert fib_treeref from int to refcount_t
@ 2021-07-29  7:13 Yajun Deng
  2021-07-29 14:55 ` David Ahern
                   ` (3 more replies)
  0 siblings, 4 replies; 10+ messages in thread
From: Yajun Deng @ 2021-07-29  7:13 UTC (permalink / raw)
  To: davem, kuba, yoshfuji, dsahern
  Cc: netdev, linux-kernel, linux-decnet-user, Yajun Deng

refcount_t type should be used instead of int when fib_treeref is used as
a reference counter,and avoid use-after-free risks.

Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
---
 include/net/dn_fib.h     | 2 +-
 include/net/ip_fib.h     | 2 +-
 net/decnet/dn_fib.c      | 6 +++---
 net/ipv4/fib_semantics.c | 8 ++++----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index ccc6e9df178b..ddd6565957b3 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -29,7 +29,7 @@ struct dn_fib_nh {
 struct dn_fib_info {
 	struct dn_fib_info	*fib_next;
 	struct dn_fib_info	*fib_prev;
-	int 			fib_treeref;
+	refcount_t		fib_treeref;
 	refcount_t		fib_clntref;
 	int			fib_dead;
 	unsigned int		fib_flags;
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 3ab2563b1a23..21c5386d4a6d 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -133,7 +133,7 @@ struct fib_info {
 	struct hlist_node	fib_lhash;
 	struct list_head	nh_list;
 	struct net		*fib_net;
-	int			fib_treeref;
+	refcount_t		fib_treeref;
 	refcount_t		fib_clntref;
 	unsigned int		fib_flags;
 	unsigned char		fib_dead;
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 77fbf8e9df4b..387a7e81dd00 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -102,7 +102,7 @@ void dn_fib_free_info(struct dn_fib_info *fi)
 void dn_fib_release_info(struct dn_fib_info *fi)
 {
 	spin_lock(&dn_fib_info_lock);
-	if (fi && --fi->fib_treeref == 0) {
+	if (fi && refcount_dec_and_test(&fi->fib_treeref)) {
 		if (fi->fib_next)
 			fi->fib_next->fib_prev = fi->fib_prev;
 		if (fi->fib_prev)
@@ -385,11 +385,11 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct nlattr *att
 	if ((ofi = dn_fib_find_info(fi)) != NULL) {
 		fi->fib_dead = 1;
 		dn_fib_free_info(fi);
-		ofi->fib_treeref++;
+		refcount_inc(&ofi->fib_treeref);
 		return ofi;
 	}
 
-	fi->fib_treeref++;
+	refcount_inc(&fi->fib_treeref);
 	refcount_set(&fi->fib_clntref, 1);
 	spin_lock(&dn_fib_info_lock);
 	fi->fib_next = dn_fib_info_list;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 4c0c33e4710d..fa19f4cdf3a4 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -260,7 +260,7 @@ EXPORT_SYMBOL_GPL(free_fib_info);
 void fib_release_info(struct fib_info *fi)
 {
 	spin_lock_bh(&fib_info_lock);
-	if (fi && --fi->fib_treeref == 0) {
+	if (fi && refcount_dec_and_test(&fi->fib_treeref)) {
 		hlist_del(&fi->fib_hash);
 		if (fi->fib_prefsrc)
 			hlist_del(&fi->fib_lhash);
@@ -1373,7 +1373,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
 		if (!cfg->fc_mx) {
 			fi = fib_find_info_nh(net, cfg);
 			if (fi) {
-				fi->fib_treeref++;
+				refcount_inc(&fi->fib_treeref);
 				return fi;
 			}
 		}
@@ -1547,11 +1547,11 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
 	if (ofi) {
 		fi->fib_dead = 1;
 		free_fib_info(fi);
-		ofi->fib_treeref++;
+		refcount_inc(&ofi->fib_treeref);
 		return ofi;
 	}
 
-	fi->fib_treeref++;
+	refcount_inc(&fi->fib_treeref);
 	refcount_set(&fi->fib_clntref, 1);
 	spin_lock_bh(&fib_info_lock);
 	hlist_add_head(&fi->fib_hash,
-- 
2.32.0


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-07-29  7:13 [PATCH] net: convert fib_treeref from int to refcount_t Yajun Deng
@ 2021-07-29 14:55 ` David Ahern
  2021-07-30 15:30 ` patchwork-bot+netdevbpf
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 10+ messages in thread
From: David Ahern @ 2021-07-29 14:55 UTC (permalink / raw)
  To: Yajun Deng, davem, kuba, yoshfuji, dsahern
  Cc: netdev, linux-kernel, linux-decnet-user

On 7/29/21 1:13 AM, Yajun Deng wrote:
> refcount_t type should be used instead of int when fib_treeref is used as
> a reference counter,and avoid use-after-free risks.
> 
> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
> ---
>  include/net/dn_fib.h     | 2 +-
>  include/net/ip_fib.h     | 2 +-
>  net/decnet/dn_fib.c      | 6 +++---
>  net/ipv4/fib_semantics.c | 8 ++++----
>  4 files changed, 9 insertions(+), 9 deletions(-)
> 


for net-next so the subject line should be "[PATCH net-next] ...."

Reviewed-by: David Ahern <dsahern@kernel.org>

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-07-29  7:13 [PATCH] net: convert fib_treeref from int to refcount_t Yajun Deng
  2021-07-29 14:55 ` David Ahern
@ 2021-07-30 15:30 ` patchwork-bot+netdevbpf
  2021-08-02 13:37 ` Ioana Ciornei
       [not found] ` <CGME20210803110803eucas1p276a0010caad8fc21a7ea5ca5543294f8@eucas1p2.samsung.com>
  3 siblings, 0 replies; 10+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-07-30 15:30 UTC (permalink / raw)
  To: Yajun Deng
  Cc: davem, kuba, yoshfuji, dsahern, netdev, linux-kernel, linux-decnet-user

Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Thu, 29 Jul 2021 15:13:50 +0800 you wrote:
> refcount_t type should be used instead of int when fib_treeref is used as
> a reference counter,and avoid use-after-free risks.
> 
> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
> ---
>  include/net/dn_fib.h     | 2 +-
>  include/net/ip_fib.h     | 2 +-
>  net/decnet/dn_fib.c      | 6 +++---
>  net/ipv4/fib_semantics.c | 8 ++++----
>  4 files changed, 9 insertions(+), 9 deletions(-)

Here is the summary with links:
  - net: convert fib_treeref from int to refcount_t
    https://git.kernel.org/netdev/net-next/c/79976892f7ea

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-07-29  7:13 [PATCH] net: convert fib_treeref from int to refcount_t Yajun Deng
  2021-07-29 14:55 ` David Ahern
  2021-07-30 15:30 ` patchwork-bot+netdevbpf
@ 2021-08-02 13:37 ` Ioana Ciornei
  2021-08-02 14:36   ` David Ahern
  2021-08-03 11:17   ` Fwd: " yajun.deng
       [not found] ` <CGME20210803110803eucas1p276a0010caad8fc21a7ea5ca5543294f8@eucas1p2.samsung.com>
  3 siblings, 2 replies; 10+ messages in thread
From: Ioana Ciornei @ 2021-08-02 13:37 UTC (permalink / raw)
  To: Yajun Deng
  Cc: davem, kuba, yoshfuji, dsahern, netdev, linux-kernel, linux-decnet-user

On Thu, Jul 29, 2021 at 03:13:50PM +0800, Yajun Deng wrote:
> refcount_t type should be used instead of int when fib_treeref is used as
> a reference counter,and avoid use-after-free risks.
> 
> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>

Hi,

Unfortunately, with this patch applied I get into the following WARNINGs
when booting over NFS:


[    5.042532] ------------[ cut here ]------------
[    5.047184] refcount_t: addition on 0; use-after-free.
[    5.052324] WARNING: CPU: 7 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xa4/0x150
[    5.060500] Modules linked in:
[    5.063544] CPU: 7 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc3-00864-g10b91fc2a425 #957
[    5.071709] Hardware name: NXP Layerscape LX2160ARDB (DT)
[    5.077095] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[    5.083090] pc : refcount_warn_saturate+0xa4/0x150
[    5.087869] lr : refcount_warn_saturate+0xa4/0x150
[    5.092649] sp : ffff80001009b880
[    5.095951] x29: ffff80001009b880 x28: 0000000000000000 x27: ffff56018121b800
[    5.103077] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[    5.110202] x23: 000000000100007f x22: ffffb6084ff072d8 x21: ffffb6084ff07000
[    5.117327] x20: 0000000000000001 x19: ffff56018121b880 x18: 0000000000000001
[    5.124451] x17: 0000000000000001 x16: 0000000000000019 x15: 0000000000000030
[    5.131577] x14: 0000000000000000 x13: ffffb6084fbb34c8 x12: 000000000000068a
[    5.138701] x11: 000000000000022e x10: ffffb6084fc0b4c8 x9 : 00000000fffff000
[    5.145827] x8 : ffffb6084fbb34c8 x7 : ffffb6084fc0b4c8 x6 : 0000000000000000
[    5.152951] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
[    5.160076] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff560180248000
[    5.167201] Call trace:
[    5.169635]  refcount_warn_saturate+0xa4/0x150
[    5.174067]  fib_create_info+0xc00/0xc90
[    5.177982]  fib_table_insert+0x8c/0x620
[    5.181893]  fib_magic.isra.0+0x110/0x11c
[    5.185891]  fib_add_ifaddr+0xb8/0x190
[    5.189629]  fib_inetaddr_event+0x8c/0x140
[    5.193714]  blocking_notifier_call_chain+0x70/0xac
[    5.198582]  __inet_insert_ifa+0x224/0x310
[    5.202667]  inetdev_event+0x54c/0x75c
[    5.206404]  raw_notifier_call_chain+0x58/0x80
[    5.210836]  call_netdevice_notifiers_info+0x58/0xac
[    5.215789]  __dev_notify_flags+0x50/0xcc
[    5.219788]  dev_change_flags+0x50/0x6c
[    5.223612]  ip_auto_config+0x1a8/0xe84
[    5.227437]  do_one_initcall+0x50/0x1b0
[    5.231262]  kernel_init_freeable+0x218/0x29c
[    5.235609]  kernel_init+0x28/0x130
[    5.239088]  ret_from_fork+0x10/0x18
[    5.242651] ---[ end trace b5c781c0b33f84b6 ]---
[    5.247276] ------------[ cut here ]------------
[    5.251890] refcount_t: saturated; leaking memory.
[    5.256679] WARNING: CPU: 7 PID: 1 at lib/refcount.c:22 refcount_warn_saturate+0x78/0x150
[    5.264846] Modules linked in:
[    5.267889] CPU: 7 PID: 1 Comm: swapper/0 Tainted: G        W         5.14.0-rc3-00864-g10b91fc2a425 #957
[    5.277441] Hardware name: NXP Layerscape LX2160ARDB (DT)
[    5.282826] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[    5.288820] pc : refcount_warn_saturate+0x78/0x150
[    5.293599] lr : refcount_warn_saturate+0x78/0x150
[    5.298378] sp : ffff80001009b880
[    5.301681] x29: ffff80001009b880 x28: 0000000000000000 x27: ffff56018121b900
[    5.308806] x26: 0000000000000000 x25: ffff56018121b800 x24: 0000000000000000
[    5.315930] x23: 000000000100007f x22: ffffb6084ff072d8 x21: ffffb6084ff07000
[    5.323055] x20: 0000000000000001 x19: ffffb6084fe657c0 x18: 0000000000000000
[    5.330180] x17: 0000000000000001 x16: 0000000000000019 x15: 0000000000000030
[    5.337304] x14: 0000000000000000 x13: ffffb6084fbb34c8 x12: 0000000000000702
[    5.344429] x11: 0000000000000256 x10: ffffb6084fc0b4c8 x9 : 00000000fffff000
[    5.351554] x8 : ffffb6084fbb34c8 x7 : ffffb6084fc0b4c8 x6 : 0000000000000000
[    5.358678] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
[    5.365802] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff560180248000
[    5.372927] Call trace:
[    5.375361]  refcount_warn_saturate+0x78/0x150
[    5.379793]  fib_create_info+0xb70/0xc90
[    5.383704]  fib_table_insert+0x8c/0x620
[    5.387616]  fib_magic.isra.0+0x110/0x11c
[    5.391614]  fib_add_ifaddr+0x114/0x190
[    5.395438]  fib_inetaddr_event+0x8c/0x140
[    5.399522]  blocking_notifier_call_chain+0x70/0xac
[    5.404389]  __inet_insert_ifa+0x224/0x310
[    5.408473]  inetdev_event+0x54c/0x75c
[    5.412210]  raw_notifier_call_chain+0x58/0x80
[    5.416642]  call_netdevice_notifiers_info+0x58/0xac
[    5.421594]  __dev_notify_flags+0x50/0xcc
[    5.425593]  dev_change_flags+0x50/0x6c
[    5.429417]  ip_auto_config+0x1a8/0xe84
[    5.433241]  do_one_initcall+0x50/0x1b0
[    5.437064]  kernel_init_freeable+0x218/0x29c
[    5.441410]  kernel_init+0x28/0x130
[    5.444887]  ret_from_fork+0x10/0x18
[    5.448450] ---[ end trace b5c781c0b33f84b7 ]---
[    5.453084] ------------[ cut here ]------------
[    5.457695] refcount_t: underflow; use-after-free.
[    5.462481] WARNING: CPU: 7 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0xf8/0x150
[    5.470648] Modules linked in:
[    5.473690] CPU: 7 PID: 1 Comm: swapper/0 Tainted: G        W         5.14.0-rc3-00864-g10b91fc2a425 #957
[    5.483243] Hardware name: NXP Layerscape LX2160ARDB (DT)
[    5.488628] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[    5.494622] pc : refcount_warn_saturate+0xf8/0x150
[    5.499401] lr : refcount_warn_saturate+0xf8/0x150
[    5.504180] sp : ffff80001009b9e0
[    5.507481] x29: ffff80001009b9e0 x28: 00000000ffffffef x27: 000000007f000001
[    5.514607] x26: ffff560182d06020 x25: ffff80001009baf8 x24: ffff56018146f0b0
[    5.521731] x23: ffff56018121b800 x22: 0000000000000020 x21: ffffb6084ff07000
[    5.528856] x20: ffffb6084ff072d8 x19: ffff56018121b800 x18: 0000000000000000
[    5.535980] x17: 0000000000000001 x16: 0000000000000019 x15: 0000000000000030
[    5.543105] x14: 0000000000000000 x13: ffffb6084fbb34c8 x12: 000000000000077a
[    5.550230] x11: 000000000000027e x10: ffffb6084fc0b4c8 x9 : 00000000fffff000
[    5.557354] x8 : ffffb6084fbb34c8 x7 : ffffb6084fc0b4c8 x6 : 0000000000000000
[    5.564479] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
[    5.571604] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff560180248000
[    5.578728] Call trace:
[    5.581162]  refcount_warn_saturate+0xf8/0x150
[    5.585594]  fib_release_info+0x190/0x1d0
[    5.589592]  fib_table_insert+0x108/0x620
[    5.593590]  fib_magic.isra.0+0x110/0x11c
[    5.597588]  fib_add_ifaddr+0xb8/0x190
[    5.601325]  fib_netdev_event+0xd4/0x1cc
[    5.605236]  raw_notifier_call_chain+0x58/0x80
[    5.609669]  call_netdevice_notifiers_info+0x58/0xac
[    5.614621]  __dev_notify_flags+0x50/0xcc
[    5.618619]  dev_change_flags+0x50/0x6c
[    5.622443]  ip_auto_config+0x1a8/0xe84
[    5.626267]  do_one_initcall+0x50/0x1b0
[    5.630091]  kernel_init_freeable+0x218/0x29c
[    5.634437]  kernel_init+0x28/0x130
[    5.637914]  ret_from_fork+0x10/0x18
[    5.641477] ---[ end trace b5c781c0b33f84b8 ]---


-Ioana

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-08-02 13:37 ` Ioana Ciornei
@ 2021-08-02 14:36   ` David Ahern
  2021-08-02 14:59     ` Ioana Ciornei
  2021-08-03 11:17   ` Fwd: " yajun.deng
  1 sibling, 1 reply; 10+ messages in thread
From: David Ahern @ 2021-08-02 14:36 UTC (permalink / raw)
  To: Ioana Ciornei, Yajun Deng
  Cc: davem, kuba, yoshfuji, dsahern, netdev, linux-kernel, linux-decnet-user

[-- Attachment #1: Type: text/plain, Size: 177 bytes --]

On 8/2/21 7:37 AM, Ioana Ciornei wrote:
> Unfortunately, with this patch applied I get into the following WARNINGs
> when booting over NFS:

Can you test the attached?

Thanks,

[-- Attachment #2: 0001-ipv4-Fix-refcount-warning-for-new-fib_info.patch --]
[-- Type: text/plain, Size: 1680 bytes --]

From ec9d169eb33e6a65db641792821cc6a259ed9362 Mon Sep 17 00:00:00 2001
From: David Ahern <dsahern@kernel.org>
Date: Mon, 2 Aug 2021 08:29:26 -0600
Subject: [PATCH net-next] ipv4: Fix refcount warning for new fib_info

Ioana reported a refcount warning when booting over NFS:

[    5.042532] ------------[ cut here ]------------
[    5.047184] refcount_t: addition on 0; use-after-free.
[    5.052324] WARNING: CPU: 7 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xa4/0x150
...
[    5.167201] Call trace:
[    5.169635]  refcount_warn_saturate+0xa4/0x150
[    5.174067]  fib_create_info+0xc00/0xc90
[    5.177982]  fib_table_insert+0x8c/0x620
[    5.181893]  fib_magic.isra.0+0x110/0x11c
[    5.185891]  fib_add_ifaddr+0xb8/0x190
[    5.189629]  fib_inetaddr_event+0x8c/0x140

fib_treeref needs to be set after kzalloc. The old code had a ++ which
led to the confusion when the int was replaced by a refcount_t.

Fixes: 79976892f7ea ("net: convert fib_treeref from int to refcount_t")
Signed-off-by: David Ahern <dsahern@kernel.org>
Reported-by: Ioana Ciornei <ciorneiioana@gmail.com>
Cc: Yajun Deng <yajun.deng@linux.dev>
---
 net/ipv4/fib_semantics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index fa19f4cdf3a4..f29feb7772da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1551,7 +1551,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
 		return ofi;
 	}
 
-	refcount_inc(&fi->fib_treeref);
+	refcount_set(&fi->fib_treeref, 1);
 	refcount_set(&fi->fib_clntref, 1);
 	spin_lock_bh(&fib_info_lock);
 	hlist_add_head(&fi->fib_hash,
-- 
2.24.3 (Apple Git-128)


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-08-02 14:36   ` David Ahern
@ 2021-08-02 14:59     ` Ioana Ciornei
  0 siblings, 0 replies; 10+ messages in thread
From: Ioana Ciornei @ 2021-08-02 14:59 UTC (permalink / raw)
  To: David Ahern
  Cc: Ioana Ciornei, Yajun Deng, davem, kuba, yoshfuji, dsahern,
	netdev, linux-kernel, linux-decnet-user

On Mon, Aug 02, 2021 at 08:36:59AM -0600, David Ahern wrote:
> On 8/2/21 7:37 AM, Ioana Ciornei wrote:
> > Unfortunately, with this patch applied I get into the following WARNINGs
> > when booting over NFS:
> 
> Can you test the attached?
> 

Yep, it fixes the problem.

Thanks!

-Ioana

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
       [not found] ` <CGME20210803110803eucas1p276a0010caad8fc21a7ea5ca5543294f8@eucas1p2.samsung.com>
@ 2021-08-03 11:08   ` Marek Szyprowski
  2021-08-03 14:43     ` David Ahern
  0 siblings, 1 reply; 10+ messages in thread
From: Marek Szyprowski @ 2021-08-03 11:08 UTC (permalink / raw)
  To: Yajun Deng, davem, kuba, yoshfuji, dsahern, Bartlomiej Zolnierkiewicz
  Cc: netdev, linux-kernel, linux-decnet-user

Hi

On 29.07.2021 09:13, Yajun Deng wrote:
> refcount_t type should be used instead of int when fib_treeref is used as
> a reference counter,and avoid use-after-free risks.
>
> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>

This patch landed in linux-next 20210802 as commit 79976892f7ea ("net: 
convert fib_treeref from int to refcount_t"). It triggers the following 
warning on all my test systems (ARM32bit and ARM64bit based):

------------[ cut here ]------------
WARNING: CPU: 3 PID: 858 at lib/refcount.c:25 fib_create_info+0xbd8/0xc18
refcount_t: addition on 0; use-after-free.
Modules linked in: s5p_csis s5p_mfc s5p_fimc exynos4_is_common s5p_jpeg 
v4l2_fwnode v4l2_async v4l2_mem2mem videobuf2_dma_contig 
videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc s5p_cec
CPU: 3 PID: 858 Comm: ip Not tainted 5.14.0-rc2-00636-g79976892f7ea #10620
Hardware name: Samsung Exynos (Flattened Device Tree)
[<c0111900>] (unwind_backtrace) from [<c010d0b8>] (show_stack+0x10/0x14)
[<c010d0b8>] (show_stack) from [<c0b827b0>] (dump_stack_lvl+0x58/0x70)
[<c0b827b0>] (dump_stack_lvl) from [<c0127938>] (__warn+0x118/0x11c)
[<c0127938>] (__warn) from [<c01279b4>] (warn_slowpath_fmt+0x78/0xbc)
[<c01279b4>] (warn_slowpath_fmt) from [<c0a5b600>] 
(fib_create_info+0xbd8/0xc18)
[<c0a5b600>] (fib_create_info) from [<c0a5fe20>] 
(fib_table_insert+0x90/0x650)
[<c0a5fe20>] (fib_table_insert) from [<c0a54ea0>] (fib_magic+0x164/0x16c)
[<c0a54ea0>] (fib_magic) from [<c0a580d0>] (fib_add_ifaddr+0x60/0x158)
[<c0a580d0>] (fib_add_ifaddr) from [<c0a58e6c>] 
(fib_inetaddr_event+0x7c/0xc0)
[<c0a58e6c>] (fib_inetaddr_event) from [<c0154ef0>] 
(blocking_notifier_call_chain+0x6c/0x94)
[<c0154ef0>] (blocking_notifier_call_chain) from [<c0a448ec>] 
(__inet_insert_ifa+0x29c/0x3b8)
[<c0a448ec>] (__inet_insert_ifa) from [<c0a4882c>] 
(inetdev_event+0x204/0x79c)
[<c0a4882c>] (inetdev_event) from [<c0154c0c>] 
(raw_notifier_call_chain+0x34/0x6c)
[<c0154c0c>] (raw_notifier_call_chain) from [<c0988900>] 
(__dev_notify_flags+0x5c/0xcc)
[<c0988900>] (__dev_notify_flags) from [<c09890b0>] 
(dev_change_flags+0x3c/0x44)
[<c09890b0>] (dev_change_flags) from [<c09993f8>] (do_setlink+0x338/0x9f0)
[<c09993f8>] (do_setlink) from [<c099fc70>] (__rtnl_newlink+0x51c/0x804)
[<c099fc70>] (__rtnl_newlink) from [<c099ff9c>] (rtnl_newlink+0x44/0x60)
[<c099ff9c>] (rtnl_newlink) from [<c099ba74>] 
(rtnetlink_rcv_msg+0x154/0x4f4)
[<c099ba74>] (rtnetlink_rcv_msg) from [<c09d44a4>] 
(netlink_rcv_skb+0xe4/0x118)
[<c09d44a4>] (netlink_rcv_skb) from [<c09d3c0c>] 
(netlink_unicast+0x1ac/0x240)
[<c09d3c0c>] (netlink_unicast) from [<c09d3f70>] 
(netlink_sendmsg+0x2d0/0x418)
[<c09d3f70>] (netlink_sendmsg) from [<c0955a30>] 
(____sys_sendmsg+0x1d4/0x230)
[<c0955a30>] (____sys_sendmsg) from [<c095755c>] (___sys_sendmsg+0x70/0x9c)
[<c095755c>] (___sys_sendmsg) from [<c0957964>] (__sys_sendmsg+0x54/0x90)
[<c0957964>] (__sys_sendmsg) from [<c0100060>] (ret_fast_syscall+0x0/0x2c)
Exception stack(0xc346dfa8 to 0xc346dff0)
dfa0:                   becb275c becaa6a4 00000003 becaa6b0 00000000 
00000000
dfc0: becb275c becaa6a4 00000000 00000128 0050e304 61091e59 0050e000 
becaa6b0
dfe0: 0000006c becaa660 004d7f80 b6e7fab8
irq event stamp: 5457
hardirqs last  enabled at (5465): [<c01a53d0>] console_unlock+0x50c/0x650
hardirqs last disabled at (5484): [<c01a53b4>] console_unlock+0x4f0/0x650
softirqs last  enabled at (5544): [<c0101768>] __do_softirq+0x500/0x63c
softirqs last disabled at (5493): [<c0131578>] irq_exit+0x214/0x220
---[ end trace dc2378f379f97dd0 ]---

This issue should be possible to trigger also with qemu. If you need any 
help in reproducing it, let me know.

> ---
>   include/net/dn_fib.h     | 2 +-
>   include/net/ip_fib.h     | 2 +-
>   net/decnet/dn_fib.c      | 6 +++---
>   net/ipv4/fib_semantics.c | 8 ++++----
>   4 files changed, 9 insertions(+), 9 deletions(-)
>
> diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
> index ccc6e9df178b..ddd6565957b3 100644
> --- a/include/net/dn_fib.h
> +++ b/include/net/dn_fib.h
> @@ -29,7 +29,7 @@ struct dn_fib_nh {
>   struct dn_fib_info {
>   	struct dn_fib_info	*fib_next;
>   	struct dn_fib_info	*fib_prev;
> -	int 			fib_treeref;
> +	refcount_t		fib_treeref;
>   	refcount_t		fib_clntref;
>   	int			fib_dead;
>   	unsigned int		fib_flags;
> diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
> index 3ab2563b1a23..21c5386d4a6d 100644
> --- a/include/net/ip_fib.h
> +++ b/include/net/ip_fib.h
> @@ -133,7 +133,7 @@ struct fib_info {
>   	struct hlist_node	fib_lhash;
>   	struct list_head	nh_list;
>   	struct net		*fib_net;
> -	int			fib_treeref;
> +	refcount_t		fib_treeref;
>   	refcount_t		fib_clntref;
>   	unsigned int		fib_flags;
>   	unsigned char		fib_dead;
> diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
> index 77fbf8e9df4b..387a7e81dd00 100644
> --- a/net/decnet/dn_fib.c
> +++ b/net/decnet/dn_fib.c
> @@ -102,7 +102,7 @@ void dn_fib_free_info(struct dn_fib_info *fi)
>   void dn_fib_release_info(struct dn_fib_info *fi)
>   {
>   	spin_lock(&dn_fib_info_lock);
> -	if (fi && --fi->fib_treeref == 0) {
> +	if (fi && refcount_dec_and_test(&fi->fib_treeref)) {
>   		if (fi->fib_next)
>   			fi->fib_next->fib_prev = fi->fib_prev;
>   		if (fi->fib_prev)
> @@ -385,11 +385,11 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct nlattr *att
>   	if ((ofi = dn_fib_find_info(fi)) != NULL) {
>   		fi->fib_dead = 1;
>   		dn_fib_free_info(fi);
> -		ofi->fib_treeref++;
> +		refcount_inc(&ofi->fib_treeref);
>   		return ofi;
>   	}
>   
> -	fi->fib_treeref++;
> +	refcount_inc(&fi->fib_treeref);
>   	refcount_set(&fi->fib_clntref, 1);
>   	spin_lock(&dn_fib_info_lock);
>   	fi->fib_next = dn_fib_info_list;
> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> index 4c0c33e4710d..fa19f4cdf3a4 100644
> --- a/net/ipv4/fib_semantics.c
> +++ b/net/ipv4/fib_semantics.c
> @@ -260,7 +260,7 @@ EXPORT_SYMBOL_GPL(free_fib_info);
>   void fib_release_info(struct fib_info *fi)
>   {
>   	spin_lock_bh(&fib_info_lock);
> -	if (fi && --fi->fib_treeref == 0) {
> +	if (fi && refcount_dec_and_test(&fi->fib_treeref)) {
>   		hlist_del(&fi->fib_hash);
>   		if (fi->fib_prefsrc)
>   			hlist_del(&fi->fib_lhash);
> @@ -1373,7 +1373,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
>   		if (!cfg->fc_mx) {
>   			fi = fib_find_info_nh(net, cfg);
>   			if (fi) {
> -				fi->fib_treeref++;
> +				refcount_inc(&fi->fib_treeref);
>   				return fi;
>   			}
>   		}
> @@ -1547,11 +1547,11 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
>   	if (ofi) {
>   		fi->fib_dead = 1;
>   		free_fib_info(fi);
> -		ofi->fib_treeref++;
> +		refcount_inc(&ofi->fib_treeref);
>   		return ofi;
>   	}
>   
> -	fi->fib_treeref++;
> +	refcount_inc(&fi->fib_treeref);
>   	refcount_set(&fi->fib_clntref, 1);
>   	spin_lock_bh(&fib_info_lock);
>   	hlist_add_head(&fi->fib_hash,

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Fwd: Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-08-02 13:37 ` Ioana Ciornei
  2021-08-02 14:36   ` David Ahern
@ 2021-08-03 11:17   ` yajun.deng
  2021-08-03 11:24     ` Marek Szyprowski
  1 sibling, 1 reply; 10+ messages in thread
From: yajun.deng @ 2021-08-03 11:17 UTC (permalink / raw)
  To: m.szyprowski; +Cc: davem, kuba, netdev, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 697 bytes --]

This patch from David Ahern was applied in the newest net-next.

-------- Forwarded message -------
From: "David Ahern" <dsahern@gmail.com>
To: "Ioana Ciornei" <ciorneiioana@gmail.com>, "Yajun Deng" <yajun.deng@linux.dev>
CC: davem@davemloft.net, kuba@kernel.org, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net
Sent: August 2, 2021 10:36 PM
Subject: Re: [PATCH] net: convert fib_treeref from int to refcount_t
On 8/2/21 7:37 AM, Ioana Ciornei wrote:

> Unfortunately, with this patch applied I get into the following WARNINGs
> when booting over NFS:

Can you test the attached?

Thanks,

[-- Attachment #2: 0001-ipv4-Fix-refcount-warning-for-new-fib_info.patch --]
[-- Type: application/octet-stream, Size: 1680 bytes --]

From ec9d169eb33e6a65db641792821cc6a259ed9362 Mon Sep 17 00:00:00 2001
From: David Ahern <dsahern@kernel.org>
Date: Mon, 2 Aug 2021 08:29:26 -0600
Subject: [PATCH net-next] ipv4: Fix refcount warning for new fib_info

Ioana reported a refcount warning when booting over NFS:

[    5.042532] ------------[ cut here ]------------
[    5.047184] refcount_t: addition on 0; use-after-free.
[    5.052324] WARNING: CPU: 7 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xa4/0x150
...
[    5.167201] Call trace:
[    5.169635]  refcount_warn_saturate+0xa4/0x150
[    5.174067]  fib_create_info+0xc00/0xc90
[    5.177982]  fib_table_insert+0x8c/0x620
[    5.181893]  fib_magic.isra.0+0x110/0x11c
[    5.185891]  fib_add_ifaddr+0xb8/0x190
[    5.189629]  fib_inetaddr_event+0x8c/0x140

fib_treeref needs to be set after kzalloc. The old code had a ++ which
led to the confusion when the int was replaced by a refcount_t.

Fixes: 79976892f7ea ("net: convert fib_treeref from int to refcount_t")
Signed-off-by: David Ahern <dsahern@kernel.org>
Reported-by: Ioana Ciornei <ciorneiioana@gmail.com>
Cc: Yajun Deng <yajun.deng@linux.dev>
---
 net/ipv4/fib_semantics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index fa19f4cdf3a4..f29feb7772da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1551,7 +1551,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
 		return ofi;
 	}
 
-	refcount_inc(&fi->fib_treeref);
+	refcount_set(&fi->fib_treeref, 1);
 	refcount_set(&fi->fib_clntref, 1);
 	spin_lock_bh(&fib_info_lock);
 	hlist_add_head(&fi->fib_hash,
-- 
2.24.3 (Apple Git-128)


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Fwd: Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-08-03 11:17   ` Fwd: " yajun.deng
@ 2021-08-03 11:24     ` Marek Szyprowski
  0 siblings, 0 replies; 10+ messages in thread
From: Marek Szyprowski @ 2021-08-03 11:24 UTC (permalink / raw)
  To: yajun.deng; +Cc: davem, kuba, netdev, linux-kernel

On 03.08.2021 13:17, yajun.deng@linux.dev wrote:

> This patch from David Ahern was applied in the newest net-next.
>
> -------- Forwarded message -------
> From: "David Ahern" <dsahern@gmail.com>
> To: "Ioana Ciornei" <ciorneiioana@gmail.com>, "Yajun Deng" <yajun.deng@linux.dev>
> CC: davem@davemloft.net, kuba@kernel.org, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
> netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net
> Sent: August 2, 2021 10:36 PM
> Subject: Re: [PATCH] net: convert fib_treeref from int to refcount_t
> On 8/2/21 7:37 AM, Ioana Ciornei wrote:
>
>> Unfortunately, with this patch applied I get into the following WARNINGs
>> when booting over NFS:
> Can you test the attached?

Yes, it fixes the issue on my test systems. Feel free to add:

Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] net: convert fib_treeref from int to refcount_t
  2021-08-03 11:08   ` Marek Szyprowski
@ 2021-08-03 14:43     ` David Ahern
  0 siblings, 0 replies; 10+ messages in thread
From: David Ahern @ 2021-08-03 14:43 UTC (permalink / raw)
  To: Marek Szyprowski, Yajun Deng, davem, kuba, yoshfuji, dsahern,
	Bartlomiej Zolnierkiewicz
  Cc: netdev, linux-kernel, linux-decnet-user

On 8/3/21 5:08 AM, Marek Szyprowski wrote:
> Hi
> 
> On 29.07.2021 09:13, Yajun Deng wrote:
>> refcount_t type should be used instead of int when fib_treeref is used as
>> a reference counter,and avoid use-after-free risks.
>>
>> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
> 
> This patch landed in linux-next 20210802 as commit 79976892f7ea ("net: 
> convert fib_treeref from int to refcount_t"). It triggers the following 
> warning on all my test systems (ARM32bit and ARM64bit based):
> 

fixed in net-next.


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2021-08-03 14:44 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-29  7:13 [PATCH] net: convert fib_treeref from int to refcount_t Yajun Deng
2021-07-29 14:55 ` David Ahern
2021-07-30 15:30 ` patchwork-bot+netdevbpf
2021-08-02 13:37 ` Ioana Ciornei
2021-08-02 14:36   ` David Ahern
2021-08-02 14:59     ` Ioana Ciornei
2021-08-03 11:17   ` Fwd: " yajun.deng
2021-08-03 11:24     ` Marek Szyprowski
     [not found] ` <CGME20210803110803eucas1p276a0010caad8fc21a7ea5ca5543294f8@eucas1p2.samsung.com>
2021-08-03 11:08   ` Marek Szyprowski
2021-08-03 14:43     ` David Ahern

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox