]> git.baikalelectronics.ru Git - kernel.git/commit
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()
authorXin Long <lucien.xin@gmail.com>
Thu, 20 Aug 2020 07:34:47 +0000 (15:34 +0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 20 Aug 2020 23:42:08 +0000 (16:42 -0700)
commit910b823d543f907fb4e8d8dfa86b91427f9ea979
tree670e0cde0c69e17ab13a45ffe03a84786e1c5d89
parent5b211351bdcd32652dd405a5045d66a2a1357bbe
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()

b->media->send_msg() requires rcu_read_lock(), as we can see
elsewhere in tipc,  tipc_bearer_xmit, tipc_bearer_xmit_skb
and tipc_bearer_bc_xmit().

Syzbot has reported this issue as:

  net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage!
  Workqueue: cryptd cryptd_queue_worker
  Call Trace:
   tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466
   tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761
   cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739
   cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181
   process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
   worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
   kthread+0x3b5/0x4a0 kernel/kthread.c:291
   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done()
for b->media->send_msg().

Fixes: 4411f05d4f8c ("tipc: introduce TIPC encryption & authentication")
Reported-by: syzbot+47bbc6b678d317cccbe0@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/crypto.c