Daniel Borkmann 5a5abb1fa3 tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter ... Sasha Levin reported a suspicious rcu_dereference_protected() warning found while fuzzing with trinity that is similar to this one: [ 52.765684] net/core/filter.c:2262 suspicious rcu_dereference_protected() usage! [ 52.765688] other info that might help us debug this: [ 52.765695] rcu_scheduler_active = 1, debug_locks = 1 [ 52.765701] 1 lock held by a.out/1525: [ 52.765704] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff816a64b7>] rtnl_lock+0x17/0x20 [ 52.765721] stack backtrace: [ 52.765728] CPU: 1 PID: 1525 Comm: a.out Not tainted 4.5.0+ #264 [...] [ 52.765768] Call Trace: [ 52.765775] [<ffffffff813e488d>] dump_stack+0x85/0xc8 [ 52.765784] [<ffffffff810f2fa5>] lockdep_rcu_suspicious+0xd5/0x110 [ 52.765792] [<ffffffff816afdc2>] sk_detach_filter+0x82/0x90 [ 52.765801] [<ffffffffa0883425>] tun_detach_filter+0x35/0x90 [tun] [ 52.765810] [<ffffffffa0884ed4>] __tun_chr_ioctl+0x354/0x1130 [tun] [ 52.765818] [<ffffffff8136fed0>] ? selinux_file_ioctl+0x130/0x210 [ 52.765827] [<ffffffffa0885ce3>] tun_chr_ioctl+0x13/0x20 [tun] [ 52.765834] [<ffffffff81260ea6>] do_vfs_ioctl+0x96/0x690 [ 52.765843] [<ffffffff81364af3>] ? security_file_ioctl+0x43/0x60 [ 52.765850] [<ffffffff81261519>] SyS_ioctl+0x79/0x90 [ 52.765858] [<ffffffff81003ba2>] do_syscall_64+0x62/0x140 [ 52.765866] [<ffffffff817d563f>] entry_SYSCALL64_slow_path+0x25/0x25 Same can be triggered with PROVE_RCU (+ PROVE_RCU_REPEATEDLY) enabled from tun_attach_filter() when user space calls ioctl(tun_fd, TUN{ATTACH, DETACH}FILTER, ...) for adding/removing a BPF filter on tap devices. Since the fix in f91ff5b9ff ("net: sk_{detach|attach}_filter() rcu fixes") sk_attach_filter()/sk_detach_filter() now dereferences the filter with rcu_dereference_protected(), checking whether socket lock is held in control path. Since its introduction in 9940516259 ("tun: socket filter support"), tap filters are managed under RTNL lock from __tun_chr_ioctl(). Thus the sock_owned_by_user(sk) doesn't apply in this specific case and therefore triggers the false positive. Extend the BPF API with __sk_attach_filter()/__sk_detach_filter() pair that is used by tap filters and pass in lockdep_rtnl_is_held() for the rcu_dereference_protected() checks instead. Reported-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-04-01 14:33:46 -04:00
..
datagram.c	net: Fix inverted test in __skb_recv_datagram	2015-12-08 11:30:17 -05:00
dev_addr_lists.c
dev_ioctl.c
dev.c	net: add description for len argument of dev_get_phys_port_name	2016-03-21 13:28:31 -04:00
devlink.c	Introduce devlink infrastructure	2016-03-01 16:07:29 -05:00
drop_monitor.c
dst_cache.c	net: dst_cache_per_cpu_dst_set() can be static	2016-03-18 17:45:08 -04:00
dst.c	net: add dst_cache to ovs vxlan lwtunnel	2016-02-16 20:21:48 -05:00
ethtool.c	ethtool: Set cmd field in ETHTOOL_GLINKSETTINGS response to wrong nwords	2016-03-16 19:26:04 -04:00
fib_rules.c
filter.c	tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter	2016-04-01 14:33:46 -04:00
flow_dissector.c	net/flow_dissector: Make dissector_uses_key() and skb_flow_dissector_target() public	2016-03-10 16:24:02 -05:00
flow.c
gen_estimator.c	net: sched: Add description for cpu_bstats argument	2016-03-20 16:48:07 -04:00
gen_stats.c	gen_stats.c: Add description for cpu argument	2016-03-20 16:48:06 -04:00
hwbm.c	net: add a hardware buffer management helper API	2016-03-14 12:19:46 -04:00
link_watch.c
lwtunnel.c	lwtunnel: autoload of lwt modules	2016-02-21 22:00:28 -05:00
Makefile	net: add a hardware buffer management helper API	2016-03-14 12:19:46 -04:00
neighbour.c	net/neighbour: fix crash at dumping device-agnostic proxy entries	2015-12-03 00:07:51 -05:00
net_namespace.c
net-procfs.c
net-sysfs.c	net: core: use __ethtool_get_ksettings	2016-02-25 22:06:47 -05:00
net-sysfs.h
net-traces.c	net: IPv6 fib lookup tracepoint	2015-11-22 11:54:10 -05:00
netclassid_cgroup.c	core: remove unneded headers for net cgroup controllers.	2016-02-17 15:31:27 -05:00
netevent.c
netpoll.c	netpoll: Fix extra refcount release in netpoll_cleanup()	2016-03-25 11:23:14 -04:00
netprio_cgroup.c	core: remove unneded headers for net cgroup controllers.	2016-02-17 15:31:27 -05:00
pktgen.c	net: pktgen: use reset to set mac header	2016-03-01 17:46:54 -05:00
ptp_classifier.c	ptp: Change ptp_class to a proper bitmask	2015-11-03 11:08:22 -05:00
request_sock.c	tcp: restore fastopen operations	2015-10-05 03:19:06 -07:00
rtnetlink.c	rtnl: fix msg size calculation in if_nlmsg_size()	2016-03-31 16:49:54 -04:00
scm.c	unix: correctly track in-flight fds in sending process user_struct	2016-02-08 10:30:42 -05:00
secure_seq.c
skbuff.c	net: remove a dubious unlikely() clause	2016-03-20 16:24:07 -04:00
sock_diag.c	net: diag: Add the ability to destroy a socket.	2015-12-15 23:26:51 -05:00
sock_reuseport.c	soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind	2016-01-19 14:44:23 -05:00
sock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
stream.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-03 21:09:12 -05:00
sysctl_net_core.c	net:Add sysctl_max_skb_frags	2016-02-09 04:28:06 -05:00
timestamping.c
tso.c	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
utils.c	net: move net_get_random_once to lib	2015-10-08 05:26:35 -07:00