Re: [tipc-discussion] [PATCH net] tipc: call rcu_read_lock() in tipc_aead_encrypt_done()

[David M. <da...@da...>]

From: Xin Long <luc...@gm...>
Date: Thu, 20 Aug 2020 15:34:47 +0800

> b->media->send_msg() requires rcu_read_lock(), as we can see
> elsewhere in tipc,  tipc_bearer_xmit, tipc_bearer_xmit_skb
> and tipc_bearer_bc_xmit().
> 
> Syzbot has reported this issue as:
> 
>   net/tipc/bearer.c:466 suspicious rcu_dereference_check() usage!
>   Workqueue: cryptd cryptd_queue_worker
>   Call Trace:
>    tipc_l2_send_msg+0x354/0x420 net/tipc/bearer.c:466
>    tipc_aead_encrypt_done+0x204/0x3a0 net/tipc/crypto.c:761
>    cryptd_aead_crypt+0xe8/0x1d0 crypto/cryptd.c:739
>    cryptd_queue_worker+0x118/0x1b0 crypto/cryptd.c:181
>    process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
>    worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
>    kthread+0x3b5/0x4a0 kernel/kthread.c:291
>    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
> 
> So fix it by calling rcu_read_lock() in tipc_aead_encrypt_done()
> for b->media->send_msg().
> 
> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
> Reported-by: syz...@sy...
> Signed-off-by: Xin Long <luc...@gm...>

Applied and queued up for -stable, thank you.