Commit 55150eac authored by Ziqi Zhao's avatar Ziqi Zhao Committed by Dong Chenchen
Browse files

can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock 

mainline inclusion
from mainline-v6.8-rc5
commit 6cdedc18ba7b9dacc36466e27e3267d201948c8d
category: bugfix
bugzilla: 189774, https://gitee.com/src-openeuler/kernel/issues/I9E2GX
CVE: CVE-2023-52638

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cdedc18ba7b9dacc36466e27e3267d201948c8d



--------------------------------

The following 3 locks would race against each other, causing the
deadlock situation in the Syzbot bug report:

- j1939_socks_lock
- active_session_list_lock
- sk_session_queue_lock

A reasonable fix is to change j1939_socks_lock to an rwlock, since in
the rare situations where a write lock is required for the linked list
that j1939_socks_lock is protecting, the code does not attempt to
acquire any more locks. This would break the circular lock dependency,
where, for example, the current thread already locks j1939_socks_lock
and attempts to acquire sk_session_queue_lock, and at the same time,
another thread attempts to acquire j1939_socks_lock while holding
sk_session_queue_lock.

NOTE: This patch along does not fix the unregister_netdevice bug
reported by Syzbot; instead, it solves a deadlock situation to prepare
for one or more further patches to actually fix the Syzbot bug, which
appears to be a reference counting problem within the j1939 codebase.

Reported-by: default avatar <syzbot+1591462f226d9cbf0564@syzkaller.appspotmail.com>
Signed-off-by: default avatarZiqi Zhao <astrajoan@yahoo.com>
Reviewed-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Acked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/all/20230721162226.8639-1-astrajoan@yahoo.com


[mkl: remove unrelated newline change]
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>

Conflicts:
	net/can/j1939/socket.c

Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent e9eac2f8

net/can/j1939/j1939-priv.h

+1 −1
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ struct j1939_priv { 
	unsigned int tp_max_packet_size;



	/* lock for j1939_socks list */

	spinlock_t j1939_socks_lock;

	rwlock_t j1939_socks_lock;

	struct list_head j1939_socks;



	struct kref rx_kref;

net/can/j1939/main.c

+1 −1
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) 
		return ERR_PTR(-ENOMEM);



	j1939_tp_init(priv);

	spin_lock_init(&priv->j1939_socks_lock);

	rwlock_init(&priv->j1939_socks_lock);

	INIT_LIST_HEAD(&priv->j1939_socks);



	spin_lock(&j1939_netdev_lock);

net/can/j1939/socket.c

+10 −10
Original line number Diff line number Diff line
@@ -79,16 +79,16 @@ static void j1939_jsk_add(struct j1939_priv *priv, struct j1939_sock *jsk) 
	jsk->state |= J1939_SOCK_BOUND;

	j1939_priv_get(priv);



	spin_lock_bh(&priv->j1939_socks_lock);

	write_lock_bh(&priv->j1939_socks_lock);

	list_add_tail(&jsk->list, &priv->j1939_socks);

	spin_unlock_bh(&priv->j1939_socks_lock);

	write_unlock_bh(&priv->j1939_socks_lock);

}



static void j1939_jsk_del(struct j1939_priv *priv, struct j1939_sock *jsk)

{

	spin_lock_bh(&priv->j1939_socks_lock);

	write_lock_bh(&priv->j1939_socks_lock);

	list_del_init(&jsk->list);

	spin_unlock_bh(&priv->j1939_socks_lock);

	write_unlock_bh(&priv->j1939_socks_lock);



	j1939_priv_put(priv);

	jsk->state &= ~J1939_SOCK_BOUND;
@@ -336,13 +336,13 @@ bool j1939_sk_recv_match(struct j1939_priv *priv, struct j1939_sk_buff_cb *skcb) 
	struct j1939_sock *jsk;

	bool match = false;



	spin_lock_bh(&priv->j1939_socks_lock);

	read_lock_bh(&priv->j1939_socks_lock);

	list_for_each_entry(jsk, &priv->j1939_socks, list) {

		match = j1939_sk_recv_match_one(jsk, skcb);

		if (match)

			break;

	}

	spin_unlock_bh(&priv->j1939_socks_lock);

	read_unlock_bh(&priv->j1939_socks_lock);



	return match;

}
@@ -351,11 +351,11 @@ void j1939_sk_recv(struct j1939_priv *priv, struct sk_buff *skb) 
{

	struct j1939_sock *jsk;



	spin_lock_bh(&priv->j1939_socks_lock);

	read_lock_bh(&priv->j1939_socks_lock);

	list_for_each_entry(jsk, &priv->j1939_socks, list) {

		j1939_sk_recv_one(jsk, skb);

	}

	spin_unlock_bh(&priv->j1939_socks_lock);

	read_unlock_bh(&priv->j1939_socks_lock);

}



static void j1939_sk_sock_destruct(struct sock *sk)
@@ -1185,7 +1185,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) 
	struct j1939_sock *jsk;

	int error_code = ENETDOWN;



	spin_lock_bh(&priv->j1939_socks_lock);

	read_lock_bh(&priv->j1939_socks_lock);

	list_for_each_entry(jsk, &priv->j1939_socks, list) {

		jsk->sk.sk_err = error_code;

		if (!sock_flag(&jsk->sk, SOCK_DEAD))
@@ -1193,7 +1193,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) 


		j1939_sk_queue_drop_all(priv, jsk, error_code);

	}

	spin_unlock_bh(&priv->j1939_socks_lock);

	read_unlock_bh(&priv->j1939_socks_lock);

}



static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd,