Eric Dumazet b372db2b8d xfrm: fix a data-race in xfrm_gen_index() ... commit 3e4bc23926b83c3c67e5f61ae8571602754131a6 upstream. xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock. This means we must use a per-netns idx_generator variable, instead of a static one. Alternative would be to use an atomic variable. syzbot reported: BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0: xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline] xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263 __do_sys_setsockopt net/socket.c:2274 [inline] __se_sys_setsockopt net/socket.c:2271 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1: xfrm_sk_policy_insert+0x13e/0x640 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263 __do_sys_setsockopt net/socket.c:2274 [inline] __se_sys_setsockopt net/socket.c:2271 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00006ad8 -> 0x00006b18 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Fixes: 1121994c80 ("netns xfrm: policy insertion in netns") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-10-25 12:03:06 +02:00
..
acpi	ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()	2023-06-28 11:12:22 +02:00
asm-generic	word-at-a-time: use the same return type for has_zero regardless of endianness	2023-08-11 12:08:11 +02:00
clocksource
crypto	crypto: api - Use work queue in crypto_destroy_instance	2023-09-13 09:42:32 +02:00
drm	drm/display/dp: Fix the DP DSC Receiver cap size	2023-08-30 16:11:09 +02:00
dt-bindings	dt-bindings: clock: qcom,gcc-sc8280xp: Add missing GDSCs	2023-09-13 09:42:45 +02:00
keys
kunit	kunit: fix kunit_test_init_section_suites(...)	2023-02-09 11:28:08 +01:00
kvm	KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption	2023-08-23 17:52:28 +02:00
linux	audit,io_uring: io_uring openat triggers audit reference count underflow	2023-10-25 12:03:04 +02:00
math-emu
media	media: cec: core: add adap_unconfigured() callback	2023-09-13 09:42:54 +02:00
memory	memory: renesas-rpc-if: Split-off private data from struct rpcif	2023-03-11 13:55:17 +01:00
misc
net	xfrm: fix a data-race in xfrm_gen_index()	2023-10-25 12:03:06 +02:00
pcmcia
ras
rdma	RDMA/cma: Always set static rate to 0 for RoCE	2023-06-21 16:00:59 +02:00
rv
scsi	scsi: Do not attempt to rescan suspended devices	2023-10-10 22:00:35 +02:00
soc	net: mscc: ocelot: don't keep PTP configuration of all ports in single structure	2023-07-19 16:22:01 +02:00
sound	ASoC: Intel: avs: Account for UID of ACPI device	2023-06-21 16:00:53 +02:00
target	scsi: target: Fix multiple LUN_RESET handling	2023-05-11 23:03:19 +09:00
trace	ipv6: Remove in6addr_any alternatives.	2023-09-19 12:28:10 +02:00
uapi	netlink: remove the flex array from struct nlmsghdr	2023-10-10 22:00:46 +02:00
ufs	scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096	2023-03-10 09:33:15 +01:00
vdso
video
xen	ACPI: processor: Fix evaluating _PDC method when running as Xen dom0	2023-05-11 23:03:11 +09:00