Commit 26672a99 authored by Chengfeng Ye's avatar Chengfeng Ye Committed by Zhengchao Shao
Browse files

tipc: fix a potential deadlock on &tx->lock 

stable inclusion
from stable-v5.10.198
commit 6a24d0661fa389c241d935da38e0f6a5ee8eb1ae
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WZL1
CVE: CVE-2024-0641

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6a24d0661fa389c241d935da38e0f6a5ee8eb1ae



--------------------------------

[ Upstream commit 08e50cf0 ]

It seems that tipc_crypto_key_revoke() could be be invoked by
wokequeue tipc_crypto_work_rx() under process context and
timer/rx callback under softirq context, thus the lock acquisition
on &tx->lock seems better use spin_lock_bh() to prevent possible
deadlock.

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

tipc_crypto_work_rx() <workqueue>
--> tipc_crypto_key_distr()
--> tipc_bcast_xmit()
--> tipc_bcbase_xmit()
--> tipc_bearer_bc_xmit()
--> tipc_crypto_xmit()
--> tipc_ehdr_build()
--> tipc_crypto_key_revoke()
--> spin_lock(&tx->lock)
<timer interrupt>
   --> tipc_disc_timeout()
   --> tipc_bearer_xmit_skb()
   --> tipc_crypto_xmit()
   --> tipc_ehdr_build()
   --> tipc_crypto_key_revoke()
   --> spin_lock(&tx->lock) <deadlock here>

Signed-off-by: default avatarChengfeng Ye <dg573847474@gmail.com>
Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
Fixes: fc1b6d6d ("tipc: introduce TIPC encryption & authentication")
Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 7be0499d

net/tipc/crypto.c

+2 −2
Original line number Diff line number Diff line
@@ -1445,14 +1445,14 @@ static int tipc_crypto_key_revoke(struct net *net, u8 tx_key) 
	struct tipc_crypto *tx = tipc_net(net)->crypto_tx;

	struct tipc_key key;



	spin_lock(&tx->lock);

	spin_lock_bh(&tx->lock);

	key = tx->key;

	WARN_ON(!key.active || tx_key != key.active);



	/* Free the active key */

	tipc_crypto_key_set_state(tx, key.passive, 0, key.pending);

	tipc_crypto_key_detach(tx->aead[key.active], &tx->lock);

	spin_unlock(&tx->lock);

	spin_unlock_bh(&tx->lock);



	pr_warn("%s: key is revoked\n", tx->name);

	return -EKEYREVOKED;