From nobody Fri Dec 19 12:50:27 2025 Received: from mx0b-0064b401.pphosted.com (mx0b-0064b401.pphosted.com [205.220.178.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 023A325EFBC; Tue, 20 May 2025 08:16:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.178.238 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747728962; cv=none; b=joW0NCSwa5pW6k3q/TmoOuSZSxlMlpX918oswdsqLYRU1FsdUDlvhVDNw0sgujrDdavWSuuXW6IRhvdUPjX5YpS3B0iUdwUTnQNnnH7VoEevnldditKra9mBSYCAGMJYZGc6Jq8JrnQKjTbu6+Qk0J4MdGGFr0w7r5cYZMgqq7E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747728962; c=relaxed/simple; bh=eRsh0sf/CoJclcRpAgRyFSFVd6eQ6h9RgcAOCC82rC0=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=tqfzWpZzEGhM8xTWrRvcvmtlVJMosnSbkl4PH8F5aWXQm9Uj3B22BgR9M6sLA2+kAAIN/vZhPtz03EGRGJJMe3gFYHDqKWVVq3Rw9z7dCvaBbX4eafa1WdeUOIcVY6AgCXEDCRMAH/h9HyI1ErDC3NbXjjjcMgzFD4LTRrbCCj8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=windriver.com; spf=pass smtp.mailfrom=windriver.com; arc=none smtp.client-ip=205.220.178.238 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=windriver.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=windriver.com Received: from pps.filterd (m0250811.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54K4qS6p014612; Tue, 20 May 2025 08:15:45 GMT Received: from ala-exchng01.corp.ad.wrs.com (ala-exchng01.wrs.com [147.11.82.252]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 46pfp0u0mk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Tue, 20 May 2025 08:15:45 +0000 (GMT) Received: from ala-exchng01.corp.ad.wrs.com (147.11.82.252) by ala-exchng01.corp.ad.wrs.com (147.11.82.252) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.43; Tue, 20 May 2025 01:15:28 -0700 Received: from pek-lpg-core1.wrs.com (147.11.136.210) by ala-exchng01.corp.ad.wrs.com (147.11.82.252) with Microsoft SMTP Server id 15.1.2507.43 via Frontend Transport; Tue, 20 May 2025 01:15:18 -0700 From: To: , CC: , , , , , , , , , , Subject: [PATCH 5.15.y] sctp: add mutual exclusion in proc_sctp_do_udp_port() Date: Tue, 20 May 2025 16:15:32 +0800 Message-ID: <20250520081532.1955511-1-jianqi.ren.cn@windriver.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=F8pXdrhN c=1 sm=1 tr=0 ts=682c3a31 cx=c_pps a=/ZJR302f846pc/tyiSlYyQ==:117 a=/ZJR302f846pc/tyiSlYyQ==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=1XWaLZrsAAAA:8 a=bC-a23v3AAAA:8 a=hSkVLCK3AAAA:8 a=pGLkceISAAAA:8 a=t7CeM3EgAAAA:8 a=ZVfp-KmhnKN58tcK2D4A:9 a=-FEs8UIgK8oA:10 a=FO4_E8m0qiDe52t0p3_H:22 a=cQPPKAXgyycSBL8etih5:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-GUID: XoJNS2vjhIl5_V4ICFwSncqb1Ujh0dll X-Proofpoint-ORIG-GUID: XoJNS2vjhIl5_V4ICFwSncqb1Ujh0dll X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTIwMDA2NyBTYWx0ZWRfX3+h5PGtuHbwF 3Hu+97fggtMZiroUq4sma/eWD25xKvnh3eetieZN0mI40rmiCqP8bGZwf73vpsi1ruZNvdAfBdC xgjSgLbS6E3Gq8XlxR+2qp4Crno8fkozMWPLtasT+QUgcCdxRS0SWZMcojSQZKpX2s0NdR/5j2u FPx0Fk1BCBC0DNHfaUJOD79vSVKQ5XBzasQlohqJxWeBm/3rr3Ia4rQrr3JEhVOGM1Iv7KipZXw IR0ZjszXGf34ZMlReI0qYgWLyqFNQYtYqCZdHJ9OtaewF691luxQ/1nUiurnAVQ0ILamkAifn+r 8E7xDCTX31ZDF6x8a4J58IHtiflblbW35zGdUIMromTeJ3+FxQqE7+ll61CUFCLK1dQi4bZ5drx pFu+ez+q3UNd5WIg9yWMadsc3X7e7gk9S61cxQmaVrH9fq3qgxlL4pkTEY1Ln8ScQbpIC6Lp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-20_03,2025-05-16_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 spamscore=0 adultscore=0 mlxlogscore=999 priorityscore=1501 malwarescore=0 bulkscore=0 mlxscore=0 suspectscore=0 impostorscore=0 lowpriorityscore=0 clxscore=1011 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.21.0-2505070000 definitions=main-2505200067 Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 10206302af856791fbcc27a33ed3c3eb09b2793d ] We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fault, probably for non-canonical address 0xdffffc= 000000000d: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7= b62617 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653 Call Trace: udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181 sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930 proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553 proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601 iter_file_splice_write+0x91c/0x1150 fs/splice.c:738 do_splice_from fs/splice.c:935 [inline] direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158 splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102 do_splice_direct_actor fs/splice.c:1201 [inline] do_splice_direct+0x174/0x240 fs/splice.c:1227 do_sendfile+0xafd/0xe50 fs/read_write.c:1368 __do_sys_sendfile64 fs/read_write.c:1429 [inline] __se_sys_sendfile64 fs/read_write.c:1415 [inline] __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] Fixes: 046c052b475e ("sctp: enable udp tunneling socks") Reported-by: syzbot+fae49d997eb56fa7c74d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/67ea5c01.050a0220.1547ec.012b.GAE@go= ogle.com/T/#u Signed-off-by: Eric Dumazet Cc: Marcelo Ricardo Leitner Acked-by: Xin Long Link: https://patch.msgid.link/20250331091532.224982-1-edumazet@google.com Signed-off-by: Jakub Kicinski [Minor conflict resolved due to code context change.] Signed-off-by: Jianqi Ren Signed-off-by: He Zhe --- Verified the build test --- net/sctp/sysctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c index 916dc2e81e42..f3d09998c24d 100644 --- a/net/sctp/sysctl.c +++ b/net/sctp/sysctl.c @@ -518,6 +518,8 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int= write, return ret; } =20 +static DEFINE_MUTEX(sctp_sysctl_mutex); + static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *ppos) { @@ -542,6 +544,7 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl,= int write, if (new_value > max || new_value < min) return -EINVAL; =20 + mutex_lock(&sctp_sysctl_mutex); net->sctp.udp_port =3D new_value; sctp_udp_sock_stop(net); if (new_value) { @@ -554,6 +557,7 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl,= int write, lock_sock(sk); sctp_sk(sk)->udp_port =3D htons(net->sctp.udp_port); release_sock(sk); + mutex_unlock(&sctp_sysctl_mutex); } =20 return ret; --=20 2.34.1