[Devel] [PATCH RHEL9 COMMIT] ms/xfrm: fix a data-race in xfrm_gen_index()

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-427.44.1.vz9.80.x-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh9-5.14.0-427.44.1.vz9.80.19
------>
commit fc4a07295cdf335abfdd1a13646b6862c9ebc2d8
Author: Sabrina Dubroca <sdubroca at redhat.com>
Date:   Thu Apr 11 10:04:27 2024 +0200

    ms/xfrm: fix a data-race in xfrm_gen_index()
    
    JIRA: https://issues.redhat.com/browse/RHEL-31751
    
    commit 3e4bc23926b83c3c67e5f61ae8571602754131a6
    Author: Eric Dumazet <edumazet at google.com>
    Date:   Fri Sep 8 18:13:59 2023 +0000
    
        xfrm: fix a data-race in xfrm_gen_index()
    
        xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock.
    
        This means we must use a per-netns idx_generator variable,
        instead of a static one.
        Alternative would be to use an atomic variable.
    
        syzbot reported:
    
        BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert
    
        write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0:
        xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline]
        xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347
        xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
        do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
        ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
        rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
        sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
        __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
        __do_sys_setsockopt net/socket.c:2274 [inline]
        __se_sys_setsockopt net/socket.c:2271 [inline]
        __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
        do_syscall_x64 arch/x86/entry/common.c:50 [inline]
        do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
        entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
        read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1:
        xfrm_sk_policy_insert+0x13e/0x640
        xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
        do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
        ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
        rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
        sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
        __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
        __do_sys_setsockopt net/socket.c:2274 [inline]
        __se_sys_setsockopt net/socket.c:2271 [inline]
        __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
        do_syscall_x64 arch/x86/entry/common.c:50 [inline]
        do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
        entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
        value changed: 0x00006ad8 -> 0x00006b18
    
        Reported by Kernel Concurrency Sanitizer on:
        CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
    
        Fixes: 1121994c803f ("netns xfrm: policy insertion in netns")
        Reported-by: syzbot <syzkaller at googlegroups.com>
        Signed-off-by: Eric Dumazet <edumazet at google.com>
        Cc: Steffen Klassert <steffen.klassert at secunet.com>
        Cc: Herbert Xu <herbert at gondor.apana.org.au>
        Acked-by: Herbert Xu <herbert at gondor.apana.org.au>
        Signed-off-by: Steffen Klassert <steffen.klassert at secunet.com>
    
    Signed-off-by: Sabrina Dubroca <sdubroca at redhat.com>
    
    https://virtuozzo.atlassian.net/browse/VSTOR-101702
    (cherry picked from CentOS Stream commit 1a178039befae55a1518ce39da04e221b60b8544)
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
    
    Feature: fix ms/xfrm
---
 include/net/netns/xfrm.h | 1 +
 net/xfrm/xfrm_policy.c   | 6 ++----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index bd7c3be4af5d..423b52eca908 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -50,6 +50,7 @@ struct netns_xfrm {
 	struct list_head	policy_all;
 	struct hlist_head	*policy_byidx;
 	unsigned int		policy_idx_hmask;
+	unsigned int		idx_generator;
 	struct hlist_head	policy_inexact[XFRM_POLICY_MAX];
 	struct xfrm_policy_hash	policy_bydst[XFRM_POLICY_MAX];
 	unsigned int		policy_count[XFRM_POLICY_MAX * 2];
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index aa7f6615ecc5..2f615a3cc70b 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1375,8 +1375,6 @@ EXPORT_SYMBOL(xfrm_policy_hash_rebuild);
  * of an absolute inpredictability of ordering of rules. This will not pass. */
 static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 {
-	static u32 idx_generator;
-
 	for (;;) {
 		struct hlist_head *list;
 		struct xfrm_policy *p;
@@ -1384,8 +1382,8 @@ static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 		int found;
 
 		if (!index) {
-			idx = (idx_generator | dir);
-			idx_generator += 8;
+			idx = (net->xfrm.idx_generator | dir);
+			net->xfrm.idx_generator += 8;
 		} else {
 			idx = index;
 			index = 0;