From patchwork Thu Mar 14 22:49:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592787 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00366DDB7 for ; Thu, 14 Mar 2024 22:49:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456572; cv=none; b=Z3DtRiVEy24/WDIcTgS2iswaAYXKMD7dF9sDZLjsuckWJUvgEaC+sy3M3Cs55xzmfQga4u7D0pid+purbHLYBpYRjoh/wwrEV+mb97dQv/2FKFhwH58QiDdJ87bszGavYbCK9oBWrulL7KQVxa4wmKD/aoJpBzmyF/PF0Grj7+8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456572; c=relaxed/simple; bh=kDEsIrg6Nol8QzsT5eioSka1ZUvLJR8G3JUJXLZ4YSE=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GT4+zXplH3k8+Bg+pPncNnsEErsqaaGXYKn6STXChiNHckhEF5cBWNzDqzdYQZznpejfBHdEPRYbAX4bctpDpSf3HGPFnkdsaZwLQJu+MMmc/DqEayk2BUOqzAw87ye9RUcDAjDHSFJGFx+fXvgh+svVFAu3V2m/FT22kQcEd5w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=JRn3z+Ce; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="JRn3z+Ce" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B38CC43394; Thu, 14 Mar 2024 22:49:31 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="JRn3z+Ce" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456569; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=R9TXL22rgEgfNPNTOX7FofZ4jip3awg0IVdEpjuRqRM=; b=JRn3z+Ce5bxY2eZf3mbQ1XFjJ3RbnuHC0exfBSZEvRl+v9IBJpzMdVTzVkILsOTbTllghx oYxct13qriayhp6gwiFG4D1hqiQ0IwLecS1ziv0WplBADn1zvmT9nhagdrKSG5VOwHOndw tB+mlbt3xVqSB4jFvfeWu9lt1+zKmMc= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id bcf8cf5e (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:29 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 1/6] wireguard: receive: annotate data-race around receiving_counter.counter Date: Thu, 14 Mar 2024 16:49:06 -0600 Message-ID: <20240314224911.6653-2-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Nikita Zhandarovich Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ... Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") Reported-by: syzbot+d1de830e4ecdaac83d89@syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/receive.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index df275b4fccb6..eb8851113654 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -251,7 +251,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || - keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { + READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { WRITE_ONCE(keypair->receiving.is_valid, false); return false; } @@ -318,7 +318,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou for (i = 1; i <= top; ++i) counter->backtrack[(i + index_current) & ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; - counter->counter = their_counter; + WRITE_ONCE(counter->counter, their_counter); } index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; @@ -463,7 +463,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", peer->device->dev->name, PACKET_CB(skb)->nonce, - keypair->receiving_counter.counter); + READ_ONCE(keypair->receiving_counter.counter)); goto next; } From patchwork Thu Mar 14 22:49:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592788 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4E02FC09 for ; Thu, 14 Mar 2024 22:49:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456575; cv=none; b=JKDpu8mjT8ZcYE2lcX3bVlCh13rgi/+NFcLKIn9oC26846xOKw2eXPRZVZi2FO+7LG8FaR/XREpMVChsncSNzSb31wyXctZ9rI3PhxIwLqYDXS6UFe8uGuJ/QGHq21g4z2/9vYqoKhsQZz92/vSOSof4SJoNfN0r8Hu5V8KP/bM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456575; c=relaxed/simple; bh=+oTe+hBfa0aQpugI7WzWEpwgjpZu2EHvmoEqIHnyllA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pXV6eTKsCwjhwCA1/WIwfvJDD6occ4jYxc5BgTyPy/VWaYiz+fmdmoyrvBIhGGPh+/DfgKJRL3mD+vr7hJnSh9D+v1dXWLe4Npza+E/uvv2BDKvQcuNbpNPLUQEWSPGpd8QAjKfbjo5uzWsyid8DSRg5NE4zHP7K6/GcvIXpk5M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=KSXaWa3S; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="KSXaWa3S" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAFACC433C7; Thu, 14 Mar 2024 22:49:34 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="KSXaWa3S" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456572; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=c/aFDQVnZYf/0SMALBb3qNKTfWdlxu70J44C4NGowpg=; b=KSXaWa3S+M6EJnIEroTw5vfujpp8bh6QmuWcOME/LF3qFrm6QaE24fHhm2MFGafzxUtod9 ttPPDJgaiDmdC6jNZXck3JSSZT5+y9bOngYEkXiAJNzPUMQMRh3yHVbfN35PXGkUqVRPae B6zmTKKlD+71G4NwcS7aDLq4Wu+z5Ds= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 0b56b9f8 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:32 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 2/6] wireguard: device: leverage core stats allocator Date: Thu, 14 Mar 2024 16:49:07 -0600 Message-ID: <20240314224911.6653-3-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Breno Leitao With commit 34d21de99cea9 ("net: Move {l,t,d}stats allocation to core and convert veth & vrf"), stats allocation could be done on net core instead of in this driver. With this new approach, the driver doesn't have to bother with error handling (allocation failure checking, making sure free happens in the right spot, etc). This is core responsibility now. Remove the allocation in this driver and leverage the network core allocation instead. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/device.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c index deb9636b0ecf..6aa071469e1c 100644 --- a/drivers/net/wireguard/device.c +++ b/drivers/net/wireguard/device.c @@ -262,7 +262,6 @@ static void wg_destruct(struct net_device *dev) rcu_barrier(); /* Wait for all the peers to be actually freed. */ wg_ratelimiter_uninit(); memzero_explicit(&wg->static_identity, sizeof(wg->static_identity)); - free_percpu(dev->tstats); kvfree(wg->index_hashtable); kvfree(wg->peer_hashtable); mutex_unlock(&wg->device_update_lock); @@ -297,6 +296,7 @@ static void wg_setup(struct net_device *dev) dev->hw_enc_features |= WG_NETDEV_FEATURES; dev->mtu = ETH_DATA_LEN - overhead; dev->max_mtu = round_down(INT_MAX, MESSAGE_PADDING_MULTIPLE) - overhead; + dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; SET_NETDEV_DEVTYPE(dev, &device_type); @@ -331,14 +331,10 @@ static int wg_newlink(struct net *src_net, struct net_device *dev, if (!wg->index_hashtable) goto err_free_peer_hashtable; - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); - if (!dev->tstats) - goto err_free_index_hashtable; - wg->handshake_receive_wq = alloc_workqueue("wg-kex-%s", WQ_CPU_INTENSIVE | WQ_FREEZABLE, 0, dev->name); if (!wg->handshake_receive_wq) - goto err_free_tstats; + goto err_free_index_hashtable; wg->handshake_send_wq = alloc_workqueue("wg-kex-%s", WQ_UNBOUND | WQ_FREEZABLE, 0, dev->name); @@ -397,8 +393,6 @@ static int wg_newlink(struct net *src_net, struct net_device *dev, destroy_workqueue(wg->handshake_send_wq); err_destroy_handshake_receive: destroy_workqueue(wg->handshake_receive_wq); -err_free_tstats: - free_percpu(dev->tstats); err_free_index_hashtable: kvfree(wg->index_hashtable); err_free_peer_hashtable: From patchwork Thu Mar 14 22:49:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592789 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 173B51A38F6 for ; Thu, 14 Mar 2024 22:49:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456578; cv=none; b=HwGj+d862ZRDg0WQ6E/8CYT/DmeGie5Jo5D2Hk85SkQahAqDUsxPPopoeiQ6aFylFc/ARWZD5Xwn/jTiioMCn+tMbbHvLMB2Ewu2liIYu5dtL1dWazFgYjl8U9NaO8n6PHxyfljDc07TJBhGnAETlW2b/3nST9Nc1JicY46dqi4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456578; c=relaxed/simple; bh=Rb6VGQ6fQuJ1kItmWGWZ/UZCph3rADuYS2nrOD5wlqY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Jhpx44Tk3IjP8NmoudOTUj1qbAAni93/0y+dhXah5jj/FviFv63t1/Wp0hQ4Tntm90u2/by8k+NYRNixqhGvYGsPS5+anj0G9hWENaNze+WHv2VrYsmEWkAd3EoZMHmJjn+Tdkb4znPS/92SofOlIjqUg+JT+AFIk1E4cInf5KU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=Dho5XwqT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="Dho5XwqT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 840F3C433C7; Thu, 14 Mar 2024 22:49:37 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="Dho5XwqT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456576; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ONzSgUSSJR4+w+0GGNLm2Fs6cV/TL8+9tLp9WRSxE20=; b=Dho5XwqTE6iyiihy8gTq4qapsUh84iQNva8QXRpkAOBZIo/+WTnjT/Nn7Ol8KteimSLgsG uIlx5pLYX6tBp+Qg22gS7yJwKfaPME3wn8J8w1pU+Zxi9+F2bk/kF5QgshLBODZnKOrqRp t48f7HdtuKEhTC0K1galZctGOL1BSDU= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id a2ab8b36 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:35 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 3/6] wireguard: device: remove generic .ndo_get_stats64 Date: Thu, 14 Mar 2024 16:49:08 -0600 Message-ID: <20240314224911.6653-4-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Breno Leitao Commit 3e2f544dd8a33 ("net: get stats64 if device if driver is configured") moved the callback to dev_get_tstats64() to net core, so, unless the driver is doing some custom stats collection, it does not need to set .ndo_get_stats64. Since this driver is now relying in NETDEV_PCPU_STAT_TSTATS, then, it doesn't need to set the dev_get_tstats64() generic .ndo_get_stats64 function pointer. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/device.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c index 6aa071469e1c..3feb36ee5bfb 100644 --- a/drivers/net/wireguard/device.c +++ b/drivers/net/wireguard/device.c @@ -237,7 +237,6 @@ static const struct net_device_ops netdev_ops = { .ndo_open = wg_open, .ndo_stop = wg_stop, .ndo_start_xmit = wg_xmit, - .ndo_get_stats64 = dev_get_tstats64 }; static void wg_destruct(struct net_device *dev) From patchwork Thu Mar 14 22:49:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592790 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 399A81094E for ; Thu, 14 Mar 2024 22:49:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456581; cv=none; b=pKUHF+rUzAUYdGDSLdyzKHdsDFR5pR7SGqYOZJq6Hv8rDvvm3hHjbfCaYWpcv33RiMDxEZ+CtuZ1VXPx4VfSqRj8vjErRGGDLpl0GPyuuCAp9rKaz9mZvNiOiasxN03H2GdQxF7balmj+ng4BUxF16ltxPwZvHErM7+rKwPkgvw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456581; c=relaxed/simple; bh=4cPSvM5uhrh9A6FezSV8Th9Mkp3LWijY0FMJCDh9o7U=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XIezy4/g0AkqCHoIkG/srjk3+Ldx0BzLHrMYCJ9EhvOMokw74DHrxtSTsVRcUe09OX8Sm3BbldVyYXrQNti/TgbH+jc/NMqIffCWoeiAcSPsf9Dh/W2lc5Dg+StdNejSGZxJtXNHEQotHcTLdYENnVzQ3xVKo1kazFHUGNy5XVA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=go62pmEw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="go62pmEw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32A9DC433F1; Thu, 14 Mar 2024 22:49:40 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="go62pmEw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456579; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nvW9jCszkqb/TYUY2+QAYTE3N92e1fnoYLVzNL5XRoY=; b=go62pmEwqg3KWfJ9l75acEaDfx+P3ofYB5QZAVN7ArQsb+misE8NwGuJ86Hq6QhmMZ0I0t E3bKE6WiWvqJ6oy0OpsvfXwZqyoUwB51nOFsUCyaxCP3oQ4xxkoo5xkyL4NeyuYaqP0rGX ZKkvwVfWAwjCGu/lClyBIhEZCGofBRE= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 36c4cb08 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:39 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 4/6] wireguard: netlink: check for dangling peer via is_dead instead of empty list Date: Thu, 14 Mar 2024 16:49:09 -0600 Message-ID: <20240314224911.6653-5-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers. Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that. It can be reproduced by a small script like: echo "Setting config..." ip link add dev wg0 type wireguard wg setconf wg0 /big-config ( while true; do echo "Showing config..." wg showconf wg0 > /dev/null done ) & sleep 4 wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n") Resulting in: BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20 Read of size 8 at addr ffff88811956ec70 by task wg/59 CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5 Call Trace: dump_stack_lvl+0x47/0x70 print_address_description.constprop.0+0x2c/0x380 print_report+0xab/0x250 kasan_report+0xba/0xf0 __lock_acquire+0x182a/0x1b20 lock_acquire+0x191/0x4b0 down_read+0x80/0x440 get_peer+0x140/0xcb0 wg_get_device_dump+0x471/0x1130 Cc: stable@vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Reported-by: Lillian Berry Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/netlink.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c index e220d761b1f2..c17aee454fa3 100644 --- a/drivers/net/wireguard/netlink.c +++ b/drivers/net/wireguard/netlink.c @@ -255,17 +255,17 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb) if (!peers_nest) goto out; ret = 0; - /* If the last cursor was removed via list_del_init in peer_remove, then + lockdep_assert_held(&wg->device_update_lock); + /* If the last cursor was removed in peer_remove or peer_remove_all, then * we just treat this the same as there being no more peers left. The * reason is that seq_nr should indicate to userspace that this isn't a * coherent dump anyway, so they'll try again. */ if (list_empty(&wg->peer_list) || - (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) { + (ctx->next_peer && ctx->next_peer->is_dead)) { nla_nest_cancel(skb, peers_nest); goto out; } - lockdep_assert_held(&wg->device_update_lock); peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list); list_for_each_entry_continue(peer, &wg->peer_list, peer_list) { if (get_peer(peer, skb, ctx)) { From patchwork Thu Mar 14 22:49:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592791 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C21B8F9FE for ; Thu, 14 Mar 2024 22:49:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456583; cv=none; b=U/+B/Jy7LlXRf2ZvcoLmXY1SPifbrjrNDLg5+5QCkrMk96EUa3InAazJqnnCV+vVnfSSQzP930B7OP5zYMwlCFSAb1uaVuaJp1kaE7mIzLuPGfeYXp4+u+OgyfRHqjBtX7p2nX1XHmUMD/9/DXKuQHdn81vCUkyoHPpLyNRR1RA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456583; c=relaxed/simple; bh=bU6hlmxcqfU1Mxcll51ElUgz3IWARHp5+sq9lgA6Jz8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=B1Mr6hQOb+TfFd6fKvKXZwqMZrkawIC9U6mYL8M15eZJiYAEGHT95Wj8PIMe8fBMVKj9e3VQTZDIfDXgIYWolWjltM+d6U9XyrnG3suEDAL6z8OV/FQXp0TLlIJGfWj5PCsli42/e6I2iZ6+pS/hl/YvPe6I+JfipcEandpoQOM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=jZlTpBvj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="jZlTpBvj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E117FC433C7; Thu, 14 Mar 2024 22:49:42 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="jZlTpBvj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6UyQhYgFCQahP0/R8bE2J4qjkZMtAjwtv3j+YGBRP2M=; b=jZlTpBvjEbaHGOxAV1n/oyQCucdXp9H5VmRJ/dlKC75UEyp1f4qmATqVHAYhTf1lBi6Eig xrxfB+GoV4ujCYcjpvyjvwyL3BJ1NXj4XUnZyN5s1oF/UjHJvylSMIHEO9h7A307hfwMNv 10vbPT3mrRSFgP9YsQaadWzAAG2NF0A= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id ec59dc69 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:42 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 5/6] wireguard: netlink: access device through ctx instead of peer Date: Thu, 14 Mar 2024 16:49:10 -0600 Message-ID: <20240314224911.6653-6-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allowedips.seq is compared with ctx->allowedips_seq, basing them both in ctx. This also acts as a defence in depth provision against freed peers. Cc: stable@vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c index c17aee454fa3..f7055180ba4a 100644 --- a/drivers/net/wireguard/netlink.c +++ b/drivers/net/wireguard/netlink.c @@ -164,8 +164,8 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx) if (!allowedips_node) goto no_allowedips; if (!ctx->allowedips_seq) - ctx->allowedips_seq = peer->device->peer_allowedips.seq; - else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq) + ctx->allowedips_seq = ctx->wg->peer_allowedips.seq; + else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq) goto no_allowedips; allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS); From patchwork Thu Mar 14 22:49:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 13592792 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 703325677 for ; Thu, 14 Mar 2024 22:49:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456586; cv=none; b=S/1Eij6WzHT64vZUFaZw1EC8k37vCqoIazRE4doSIFeULoWWJsOMXUoM7ZxaowLnioaESai0cUhB2VB0c3uXs6u354kgCzS1KvQXsQ5xOwS2SweRJJP2V76kcoeH6HfbZnGquDD47AqE0ePYUDHBoVyr3cxUsrJCtK4yeAKafNs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710456586; c=relaxed/simple; bh=kryvWXXk6gtBHk3ppwvZs6VtsiGn34y4r/0gQUPuMWY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rZh+MhtgMgNsKM1j3bd2DzvnkmtnM00/tr7V2yxDs81VXOCVNLkg8DdwRReK1JkQb/FYk0FMiS4cPdwZs9GN1di258ZURnfgG+DZGpTGBFX/prUvUhH61dNIlPsX+ws8rxU7ik9ata2zJnidY1oPxNLvJu+FOLHkm+TZcMV30G8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b=oNkwWBOJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="oNkwWBOJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FDDDC433F1; Thu, 14 Mar 2024 22:49:45 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="oNkwWBOJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1710456584; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8mXcy0K8vNbbCy0oNKBFTfUb34A5OtcOhxe/RkzDJoo=; b=oNkwWBOJBHTIhYfPenVMEYmsakEOtD8PqqDCEd27a1aqIfaZyt7tcxSaTG9/t74muDT7EI uEK9DLHfvKvBaagH0v1PQFGjSL3Y5txoC9t1quNn7RASfVUh5RQh2pyro0oo33KjJPqorF Oo3K7kkVr+UWziWH1qhHPqSHvCWJisM= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 21fecee2 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Thu, 14 Mar 2024 22:49:44 +0000 (UTC) From: "Jason A. Donenfeld" To: netdev@vger.kernel.org, davem@davemloft.net, kuba@kernel.org Subject: [PATCH net 6/6] wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64} Date: Thu, 14 Mar 2024 16:49:11 -0600 Message-ID: <20240314224911.6653-7-Jason@zx2c4.com> In-Reply-To: <20240314224911.6653-1-Jason@zx2c4.com> References: <20240314224911.6653-1-Jason@zx2c4.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org This option is needed to continue booting with QEMU. Recent changes that made this optional meant that it gets unset in the test harness, and so WireGuard CI has been broken. Fix this by simply setting this option. Cc: stable@vger.kernel.org Fixes: 496ea826d1e1 ("RISC-V: provide Kconfig & commandline options to control parsing "riscv,isa"") Signed-off-by: Jason A. Donenfeld --- tools/testing/selftests/wireguard/qemu/arch/riscv32.config | 1 + tools/testing/selftests/wireguard/qemu/arch/riscv64.config | 1 + 2 files changed, 2 insertions(+) diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config index 2fc36efb166d..a7f8e8a95625 100644 --- a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config +++ b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config @@ -3,6 +3,7 @@ CONFIG_ARCH_RV32I=y CONFIG_MMU=y CONFIG_FPU=y CONFIG_SOC_VIRT=y +CONFIG_RISCV_ISA_FALLBACK=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_OF_PLATFORM=y diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config index dc266f3b1915..daeb3e5e0965 100644 --- a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config +++ b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config @@ -2,6 +2,7 @@ CONFIG_ARCH_RV64I=y CONFIG_MMU=y CONFIG_FPU=y CONFIG_SOC_VIRT=y +CONFIG_RISCV_ISA_FALLBACK=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_OF_PLATFORM=y