Eric Dumazet faac81f7cb ipv4: ensure rcu_read_lock() in ipv4_link_failure() ... [ Upstream commit c543cb4a5f07e09237ec0fc2c60c9f131b2c79ad ] fib_compute_spec_dst() needs to be called under rcu protection. syzbot reported : WARNING: suspicious RCU usage 5.1.0-rc4+ #165 Not tainted include/linux/inetdevice.h:220 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by swapper/0/0: #0: 0000000051b67925 ((&n->timer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:170 [inline] #0: 0000000051b67925 ((&n->timer)){+.-.}, at: call_timer_fn+0xda/0x720 kernel/time/timer.c:1315 stack backtrace: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.1.0-rc4+ #165 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5162 __in_dev_get_rcu include/linux/inetdevice.h:220 [inline] fib_compute_spec_dst+0xbbd/0x1030 net/ipv4/fib_frontend.c:294 spec_dst_fill net/ipv4/ip_options.c:245 [inline] __ip_options_compile+0x15a7/0x1a10 net/ipv4/ip_options.c:343 ipv4_link_failure+0x172/0x400 net/ipv4/route.c:1195 dst_link_failure include/net/dst.h:427 [inline] arp_error_report+0xd1/0x1c0 net/ipv4/arp.c:297 neigh_invalidate+0x24b/0x570 net/core/neighbour.c:995 neigh_timer_handler+0xc35/0xf30 net/core/neighbour.c:1081 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694 __do_softirq+0x266/0x95a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Stephen Suryaputra <ssuryaextr@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-04-27 09:34:00 +02:00
..
netfilter	netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES	2019-03-23 08:44:29 +01:00
af_inet.c	gso_segment: Reset skb->mac_len after modifying network header	2018-09-29 03:08:52 -07:00
ah4.c	ipsec: check return value of skb_to_sgvec always	2018-04-13 19:50:23 +02:00
arp.c	arp: fix arp_filter on l3slave devices	2018-04-13 19:50:24 +02:00
cipso_ipv4.c	netlabel: fix out-of-bounds memory accesses	2019-03-23 08:44:23 +01:00
datagram.c	net: Set sk_txhash from a random number	2015-07-29 22:44:04 -07:00
devinet.c	ipv4: igmp: guard against silly MTU values	2018-01-02 20:33:24 +01:00
esp4.c	ipsec: check return value of skb_to_sgvec always	2018-04-13 19:50:23 +02:00
fib_frontend.c	net: ipv4: Fix memory leak in network namespace dismantle	2019-02-06 19:43:03 +01:00
fib_lookup.h	ipv4: consider TOS in fib_select_default	2015-07-24 22:46:11 -07:00
fib_rules.c	net: ipv6: use common fib_default_rule_pref	2015-09-09 14:19:50 -07:00
fib_semantics.c	net: ipv4: update fnhe_pmtu when first hop's MTU changes	2018-10-20 09:52:36 +02:00
fib_trie.c	net: ipv4: Fix memory leak in network namespace dismantle	2019-02-06 19:43:03 +01:00
fou.c	net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv	2019-04-27 09:34:00 +02:00
gre_demux.c	gre: Remove support for sharing GRE protocol hook.	2015-08-10 14:03:54 -07:00
gre_offload.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
icmp.c	net: Add __icmp_send helper.	2019-03-23 08:44:23 +01:00
igmp.c	net: igmp: add a missing rcu locking section	2018-02-16 20:09:37 +01:00
inet_connection_sock.c	tcp/dccp: remove reqsk_put() from inet_child_forget()	2019-03-23 08:44:31 +01:00
inet_diag.c	net: diag: support v4mapped sockets in inet_diag_find_one_icsk()	2019-04-03 06:23:21 +02:00
inet_fragment.c	inet: frags: better deal with smp races	2019-02-08 11:25:33 +01:00
inet_hashtables.c	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
inet_lro.c
inet_timewait_sock.c	soreuseport: initialise timewait reuseport field	2018-05-16 10:06:50 +02:00
inetpeer.c	net: ipv4: use a dedicated counter for icmp_v4 redirect packets	2019-02-23 09:05:14 +01:00
ip_forward.c	net: Pass net into dst_output and remove dst_output_okfn	2015-10-08 04:26:54 -07:00
ip_fragment.c	net: ipv4: do not handle duplicate fragments as overlapping	2019-02-08 11:25:33 +01:00
ip_gre.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_input.c	net: Fix usage of pskb_trim_rcsum	2019-02-06 19:43:02 +01:00
ip_options.c	net: avoid use IPCB in cipso_v4_error	2019-03-23 08:44:23 +01:00
ip_output.c	ip: hash fragments consistently	2018-07-28 07:45:02 +02:00
ip_sockglue.c	ip: on queued skb use skb_header_pointer instead of pskb_may_pull	2019-01-26 09:42:49 +01:00
ip_tunnel.c	ip_tunnel: Fix name string concatenate in __ip_tunnel_create()	2018-12-13 09:21:29 +01:00
ip_tunnel_core.c	ip_tunnel: don't force DF when MTU is locked	2018-11-27 16:07:57 +01:00
ip_vti.c	vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel	2019-03-23 08:44:24 +01:00
ipcomp.c	ipv4: coding style: comparison for equality with NULL	2015-04-03 12:11:15 -04:00
ipconfig.c	ipconfig: Correctly initialise ic_nameservers	2018-08-06 16:24:38 +02:00
ipip.c	ipip: only increase err_count for some certain type icmp in ipip_err	2017-11-18 11:11:06 +01:00
ipmr.c	ipv4: Fix potential Spectre v1 vulnerability	2019-01-13 10:05:27 +01:00
Kconfig	ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV	2018-08-15 17:42:05 +02:00
Makefile	tcp: track the packet timings in RACK	2015-10-21 07:00:48 -07:00
netfilter.c	netfilter: use skb_to_full_sk in ip_route_me_harder	2018-03-18 11:17:51 +01:00
ping.c	ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg	2018-05-26 08:48:46 +02:00
proc.c	ip: discard IPv4 datagrams with overlapping segments.	2019-02-08 11:25:32 +01:00
protocol.c	net: Export inet_offloads and inet6_offloads	2014-09-19 17:15:31 -04:00
raw.c	net: ipv4: fix for a race condition in raw_sendmsg	2018-01-02 20:33:25 +01:00
route.c	ipv4: ensure rcu_read_lock() in ipv4_link_failure()	2019-04-27 09:34:00 +02:00
syncookies.c	tcp: handle inet_csk_reqsk_queue_add() failures	2019-03-23 08:44:30 +01:00
sysctl_net_ipv4.c	ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns	2018-07-25 10:18:16 +02:00
tcp.c	tcp: clear icsk_backoff in tcp_write_queue_purge()	2019-02-23 09:05:14 +01:00
tcp_bic.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_cdg.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_cong.c	tcp: disallow cwnd undo when switching congestion control	2017-06-14 13:16:19 +02:00
tcp_cubic.c	tcp_cubic: do not set epoch_start in the future	2015-09-17 22:35:07 -07:00
tcp_dctcp.c	tcp: Ensure DCTCP reacts to losses	2019-04-27 09:33:55 +02:00
tcp_diag.c	tcp: ensure proper barriers in lockless contexts	2015-11-15 18:36:38 -05:00
tcp_fastopen.c	tcp: initialize max window for a new fastopen socket	2017-02-04 09:45:09 +01:00
tcp_highspeed.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_htcp.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_hybla.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_illinois.c	net/tcp/illinois: replace broken algorithm reference link	2018-05-30 07:49:02 +02:00
tcp_input.c	tcp: tcp_grow_window() needs to respect tcp_space()	2019-04-27 09:34:00 +02:00
tcp_ipv4.c	tcp: tcp_v4_err() should be more careful	2019-02-23 09:05:13 +01:00
tcp_lp.c	tcp: fix wraparound issue in tcp_lp	2017-05-14 13:32:58 +02:00
tcp_memcontrol.c	memcg: cleanup static keys decrement	2015-02-12 18:54:10 -08:00
tcp_metrics.c	tcp: convert cached rtt from usec to jiffies when feeding initial rto	2016-04-20 15:41:56 +09:00
tcp_minisocks.c	tcp: use an RB tree for ooo receive queue	2018-10-13 09:11:34 +02:00
tcp_offload.c	tcp: reserve tcp_skb_mss() to tcp stack	2015-06-11 16:33:10 -07:00
tcp_output.c	tcp: fix NULL ref in tail loss probe	2018-12-17 21:55:09 +01:00
tcp_probe.c	tcp: whitespace fixes	2014-09-01 18:12:45 -07:00
tcp_recovery.c	tcp: use RACK to detect losses	2015-10-21 07:00:53 -07:00
tcp_scalable.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_timer.c	net: tcp: close sock if net namespace is exiting	2018-01-31 12:06:14 +01:00
tcp_vegas.c	tcp: fix under-evaluated ssthresh in TCP Vegas	2017-12-25 14:22:15 +01:00
tcp_vegas.h	tcp: prepare CC get_info() access from getsockopt()	2015-04-29 17:10:38 -04:00
tcp_veno.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_westwood.c	tcp_westwood: fix tcp_westwood_info()	2015-05-05 19:50:09 -04:00
tcp_yeah.c	tcp: cwnd does not increase in TCP YeAH	2016-09-30 10:18:34 +02:00
tunnel4.c
udp.c	udplite: call proper backlog handlers	2019-03-23 08:44:29 +01:00
udp_diag.c	sock_diag: specify info_size per inet protocol	2015-06-15 19:49:22 -07:00
udp_impl.h	udplite: call proper backlog handlers	2019-03-23 08:44:29 +01:00
udp_offload.c	net: avoid skb_warn_bad_offload false positives on UFO	2017-08-12 19:29:08 -07:00
udp_tunnel.c	tunnel: Clear IPCB(skb)->opt before dst_link_failure called	2016-04-20 15:41:56 +09:00
udplite.c	udplite: call proper backlog handlers	2019-03-23 08:44:29 +01:00
xfrm4_input.c	netfilter: Pass net into okfn	2015-09-17 17:18:37 -07:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c	ipv4: hash net ptr into fragmentation bucket selection	2015-03-25 14:07:04 -04:00
xfrm4_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-24 06:54:12 -07:00
xfrm4_policy.c	ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu	2018-05-30 07:49:04 +02:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c