kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Eric Dumazet f9620e2a66 ppp: do not assume bh is held in ppp_channel_bridge_input() 
[ Upstream commit aec7291003 ]

Networking receive path is usually handled from BH handler.
However, some protocols need to acquire the socket lock, and
packets might be stored in the socket backlog is the socket was
owned by a user process.

In this case, release_sock(), __release_sock(), and sk_backlog_rcv()
might call the sk->sk_backlog_rcv() handler in process context.

sybot caught ppp was not considering this case in
ppp_channel_bridge_input() :

WARNING: inconsistent lock state
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes:
 ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
 ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304
{SOFTIRQ-ON-W} state was registered at:
   lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
   _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
   spin_lock include/linux/spinlock.h:351 [inline]
   ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
   ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304
   pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379
   sk_backlog_rcv include/net/sock.h:1111 [inline]
   __release_sock+0x1a8/0x3d8 net/core/sock.c:3004
   release_sock+0x68/0x1b8 net/core/sock.c:3558
   pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903
   sock_sendmsg_nosec net/socket.c:730 [inline]
   __sock_sendmsg net/socket.c:745 [inline]
   __sys_sendto+0x374/0x4f4 net/socket.c:2204
   __do_sys_sendto net/socket.c:2216 [inline]
   __se_sys_sendto net/socket.c:2212 [inline]
   __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212
   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
   invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
   el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
   do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
   el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
   el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
   el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
irq event stamp: 282914
 hardirqs last  enabled at (282914): [<ffff80008b42e30c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 hardirqs last  enabled at (282914): [<ffff80008b42e30c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
 hardirqs last disabled at (282913): [<ffff80008b42e13c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
 hardirqs last disabled at (282913): [<ffff80008b42e13c>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
 softirqs last  enabled at (282904): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline]
 softirqs last  enabled at (282904): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582
 softirqs last disabled at (282909): [<ffff8000801fbdf8>] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&pch->downl);
  <Interrupt>
    lock(&pch->downl);

 *** DEADLOCK ***

1 lock held by ksoftirqd/1/24:
  #0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325

stack backtrace:
CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
  dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
  show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
  __dump_stack lib/dump_stack.c:93 [inline]
  dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
  dump_stack+0x1c/0x28 lib/dump_stack.c:128
  print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000
 mark_lock_irq+0x980/0xd2c
  mark_lock+0x258/0x360 kernel/locking/lockdep.c:4677
  __lock_acquire+0xf48/0x779c kernel/locking/lockdep.c:5096
  lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
  ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304
  ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:495
  tasklet_action_common+0x318/0x3f4 kernel/softirq.c:785
  tasklet_action+0x68/0x8c kernel/softirq.c:811
  handle_softirqs+0x2e4/0xbfc kernel/softirq.c:554
  run_ksoftirqd+0x70/0x158 kernel/softirq.c:928
  smpboot_thread_fn+0x4b0/0x90c kernel/smpboot.c:164
  kthread+0x288/0x310 kernel/kthread.c:389
  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

Fixes: 4cf476ced4 ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
Reported-by: syzbot+bd8d55ee2acd0a71d8ce@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/66f661e2.050a0220.38ace9.000f.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Parkin <tparkin@katalix.com>
Cc: James Chapman <jchapman@katalix.com>
Link: https://patch.msgid.link/20240927074553.341910-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-10-10 11:57:18 +02:00
..
accel accel: Use XArray instead of IDR for minors 2024-09-30 16:25:13 +02:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: resource: Add another DMI match for the TongFang GMxXGxx 2024-10-04 16:29:52 +02:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:11:41 +02:00
ata ata: libata-scsi: Fix ata_msense_control() CDL page reporting 2024-10-04 16:29:48 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:33:18 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base firmware_loader: Block path traversal 2024-10-04 16:29:51 +02:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block drbd: Add NULL check for net_conf to prevent dereference in state validation 2024-10-04 16:29:52 +02:00
bluetooth Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() 2024-10-10 11:57:16 +02:00
bus bus: mhi: host: pci_generic: Fix the name for the Telit FE990A 2024-10-04 16:29:51 +02:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:49:10 +02:00
cdx cdx: Explicitly include correct DT includes 2023-08-04 16:21:20 +02:00
char hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume 2024-10-04 16:29:55 +02:00
clk clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p 2024-10-04 16:29:32 +02:00
clocksource clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() 2024-10-04 16:29:04 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:11:39 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter counter: ti-eqep: enable clock at probe 2024-07-05 09:33:56 +02:00
cpufreq cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately 2024-10-04 16:28:54 +02:00
cpuidle cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put 2024-10-04 16:29:56 +02:00
crypto crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure 2024-10-04 16:29:51 +02:00
cxl cxl/pci: Fix to record only non-zero ranges 2024-10-04 16:29:40 +02:00
dax mm: remove enum page_entry_size 2023-08-24 16:20:30 -07:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor 2024-09-08 07:54:46 +02:00
dma-buf dma-buf: heaps: Fix off-by-one in CMA heap fault handler 2024-09-18 19:24:09 +02:00
edac EDAC/igen6: Fix conversion of system address to physical memory address 2024-10-04 16:29:56 +02:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: core: correct range of block for case of switch statement 2024-10-04 16:29:28 +02:00
firmware efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption 2024-10-04 16:29:52 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpiolib: cdev: Ignore reconfiguration without direction 2024-09-30 16:25:14 +02:00
gpu drm/amdgpu: Fix get each xcp macro 2024-10-10 11:57:13 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: wacom: Do not warn about dropped packets for first packet 2024-10-04 16:29:12 +02:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:11:41 +02:00
hwmon hwmon: (ntc_thermistor) fix module autoloading 2024-10-04 16:29:06 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:54:43 +02:00
hwtracing coresight: tmc: sg: Do not leak sg_table 2024-10-04 16:29:40 +02:00
i2c i2c: isch: Add missed 'else' 2024-10-04 16:30:03 +02:00
i3c i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup 2024-09-12 11:11:38 +02:00
idle x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram 2024-01-25 15:35:12 -08:00
iio iio: magnetometer: ak8975: Fix 'Unexpected device' error 2024-10-04 16:30:04 +02:00
infiniband RDMA/irdma: fix error message in irdma_modify_qp_roce() 2024-10-04 16:29:34 +02:00
input Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line 2024-10-04 16:29:46 +02:00
interconnect interconnect: icc-clk: Add missed num_nodes initialization 2024-10-04 16:29:40 +02:00
iommu iommufd: Protect against overflow of ALIGN() during iova allocation 2024-10-04 16:29:46 +02:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 2024-09-12 11:11:29 +02:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-08-19 06:04:28 +02:00
leds leds: pca995x: Fix device child node usage in pca995x_probe() 2024-10-04 16:29:29 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox mailbox: bcm2835: Fix timeout during suspend mode 2024-10-10 11:57:14 +02:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md Revert: "dm-verity: restart or panic on an I/O error" 2024-10-04 16:30:05 +02:00
media Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" 2024-10-04 16:29:46 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-08-29 17:33:36 +02:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-06-12 15:16:19 +02:00
message scsi: message: fusion: Add HAS_IOPORT dependencies 2023-05-31 19:59:26 -04:00
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-03 08:53:54 +02:00
misc eeprom: digsy_mtc: Fix 93xx46 driver probe failure 2024-09-18 19:24:07 +02:00
mmc mmc: cqhci: Fix checking of CQHCI_HALT state 2024-09-12 11:11:26 +02:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd mtd: rawnand: mtk: Fix init error path 2024-10-04 16:29:07 +02:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net ppp: do not assume bh is held in ppp_channel_bridge_input() 2024-10-10 11:57:18 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:28:28 +02:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-10-04 16:29:35 +02:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nvdimm: Fix devs leaks in scan_labels() 2024-10-04 16:29:30 +02:00
nvme nvme-multipath: system fails to create generic nvme device 2024-10-04 16:29:38 +02:00
nvmem nvmem: u-boot-env: error if NVMEM device is too small 2024-09-18 19:24:04 +02:00
of of/irq: Prevent device address out-of-bounds read in interrupt map walk 2024-09-12 11:11:39 +02:00
opp OPP: ti: Fix ti_opp_supply_probe wrong return values 2024-08-03 08:53:27 +02:00
parisc Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
parport dev/parport: fix the array out-of-bounds risk 2024-08-03 08:54:22 +02:00
pci PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler 2024-10-04 16:29:45 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:11:31 +02:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf perf/arm-cmn: Fail DTC counter allocation correctly 2024-10-04 16:30:04 +02:00
phy phy: zynqmp: Take the phy mutex in xlate 2024-09-12 11:11:35 +02:00
pinctrl pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function 2024-10-04 16:29:32 +02:00
platform platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match less strict 2024-09-30 16:25:09 +02:00
pmdomain pmdomain: imx: wait SSAR when i.MX93 power domain on 2024-08-29 17:33:54 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense 2024-10-04 16:29:06 +02:00
powercap powercap: intel_rapl: Fix off by one in get_rpi() 2024-10-04 16:28:51 +02:00
pps pps: add an error check in parport_attach 2024-10-04 16:29:58 +02:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: fix integer overflow in max_vclocks_store 2024-06-27 13:49:07 +02:00
pwm pwm: atmel-tcb: Fix race condition and convert to guards 2024-08-03 08:53:23 +02:00
rapidio Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: Return actual error in of_regulator_bulk_get_all() 2024-10-04 16:29:02 +02:00
remoteproc remoteproc: imx_rproc: Initialize workqueue earlier 2024-10-04 16:29:26 +02:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-04 16:29:04 +02:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-01-31 16:18:50 -08:00
rtc rtc: nct3018y: fix possible NULL dereference 2024-08-29 17:33:39 +02:00
s390 Revert "s390/dasd: Establish DMA alignment" 2024-08-29 17:33:59 +02:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: pm8001: Do not overwrite PCI queue mapping 2024-10-10 11:57:13 +02:00
sh sh: intc: move to use bus_get_dev_root() 2023-03-17 15:29:55 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 12:02:33 +02:00
soc soc: versatile: realview: fix soc_dev leak during device remove 2024-10-04 16:29:57 +02:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-09-18 19:24:09 +02:00
spi spi: atmel-quadspi: Fix wrong register value written to MR 2024-10-04 16:30:05 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:33:22 +02:00
staging minmax: reduce min/max macro expansion in atomisp driver 2024-09-18 19:24:07 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 12:02:15 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:50:53 +02:00
thermal thermal: of: Fix OF node leak in of_thermal_zone_find() error paths 2024-09-04 13:28:22 +02:00
thunderbolt thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() 2024-10-04 16:30:04 +02:00
tty serial: don't use uninitialized value in uart_poll_init() 2024-10-04 16:29:58 +02:00
ufs scsi: ufs: qcom: Update MODE_MAX cfg_bw value 2024-10-04 16:29:49 +02:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:11:41 +02:00
usb usb: yurex: Fix inconsistent locking bug in yurex_read() 2024-10-04 16:30:04 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:33:50 +02:00
vfio vfio/spapr: Always clear TCEs before unsetting the window 2024-09-12 11:11:31 +02:00
vhost vhost_vdpa: assign irq bypass producer token correctly 2024-10-04 16:29:40 +02:00
video fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() 2024-10-04 16:29:06 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:12:09 +02:00
virtio virtio_ring: fix KMSAN error for premapped mode 2024-09-12 11:11:36 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: imx_sc_wdt: Don't disable WDT in suspend 2024-10-04 16:29:33 +02:00
xen xen/swiotlb: fix allocated size 2024-10-04 16:29:14 +02:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00