In the Linux kernel, the following vulnerability has been resolved:
net: annotate races around sk->skbounddev_if
UDP sendmsg() is lockless, and reads sk->skbounddev_if while this field can be changed by another thread.
Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers.
BUG: KCSAN: data-race in _ip6datagramconnect / udpv6sendmsg
write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: _ip6datagramconnect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6datagramconnect+0x2a/0x40 net/ipv6/datagram.c:272 inetdgramconnect+0x107/0x190 net/ipv4/afinet.c:576 _sysconnectfile net/socket.c:1900 [inline] _sysconnect+0x197/0x1b0 net/socket.c:1917 _dosysconnect net/socket.c:1927 [inline] _sesysconnect net/socket.c:1924 [inline] _x64sysconnect+0x3d/0x50 net/socket.c:1924 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x50 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6sendmsg+0x5f/0x80 net/ipv6/afinet6.c:652 socksendmsgnosec net/socket.c:705 [inline] socksendmsg net/socket.c:725 [inline] _syssendmsg+0x39a/0x510 net/socket.c:2413 syssendmsg net/socket.c:2467 [inline] _syssendmmsg+0x267/0x4c0 net/socket.c:2553 _dosyssendmmsg net/socket.c:2582 [inline] _sesyssendmmsg net/socket.c:2579 [inline] _x64syssendmmsg+0x53/0x60 net/socket.c:2579 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x50 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x44/0xae
value changed: 0x00000000 -> 0xffffff9b
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough.
{ "vanir_signatures": [ { "signature_version": "v1", "target": { "function": "compute_score", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 886.0, "function_hash": "200313247127621520581188719638596411400" }, "id": "CVE-2022-49420-0336a830" }, { "signature_version": "v1", "target": { "file": "net/ipv6/udp.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "line_hashes": [ "299711429879782230056096513185501102675", "51829043465610244595732272488610850761", "315452408461793187725851093368130561632", "258348234953488192474189611457877728003", "4524577362662627105354115455573948802", "252438698601327134745024419467714591344", "137506737215049369561536583231633379843", "332113706308949864669878254626405539224", "336918038704976441590293373309128421281", "177187405997331454408468333667273651318", "20429496889834619356941604671041997009", "264761393034595614831940998445532310625", "234460323253466090687269450490303197422", "235601806895740851712665380301512934531", "145776846197230717094815790644059544793", "223705204587639568755060293786417566464", "39904360836368821916112790963944090178", "20176723081987412974672370525111624026", "258855914586077380916018439232466696792" ], "threshold": 0.9 }, "id": "CVE-2022-49420-25bc29bc" }, { "signature_version": "v1", "target": { "function": "__ip6_datagram_connect", "file": "net/ipv6/datagram.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 2430.0, "function_hash": "170395924975440654993465042597239174013" }, "id": "CVE-2022-49420-2dbb0c0c" }, { "signature_version": "v1", "target": { "function": "__ip6_datagram_connect", "file": "net/ipv6/datagram.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 2430.0, "function_hash": "170395924975440654993465042597239174013" }, "id": "CVE-2022-49420-328a587c" }, { "signature_version": "v1", "target": { "file": "net/ipv6/datagram.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "line_hashes": [ "264048306322476994293373172098087951814", "50867945918849331688270221583359360470", "265735899621507219283692121751575416812", "177920021355772008376644523981319581215", "83216774026390126906028766847937562346", "10012746100388752605421960466171454538", "66154345619748383767030843137139655705", "180298637429901490664816785691449092065", "220021594310571106692199939271365414798", "63174790539151515816507353220145406334", "125114316973508389920558113176282031270" ], "threshold": 0.9 }, "id": "CVE-2022-49420-3bcc7cad" }, { "signature_version": "v1", "target": { "function": "udpv6_sendmsg", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 6790.0, "function_hash": "115711720697686369837666202553221434247" }, "id": "CVE-2022-49420-487e3132" }, { "signature_version": "v1", "target": { "file": "include/net/sock.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "line_hashes": [ "182341888770492833979708719996848356424", "229804088061113493615438529708922380898", "99993169983191474699188777474787065092", "126957953084343977114929439414738719493", "37796208760883884419377112217861234155", "332233165155814979479081136042517979763", "93317179559999145437430097172907698072", "149728019539719393674888117172914337016", "189623663670671922501276793041430752513" ], "threshold": 0.9 }, "id": "CVE-2022-49420-5096fd82" }, { "signature_version": "v1", "target": { "function": "ip6_datagram_send_ctl", "file": "net/ipv6/datagram.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 5217.0, "function_hash": "128992734219264835309257712155545235227" }, "id": "CVE-2022-49420-529791d6" }, { "signature_version": "v1", "target": { "function": "__udp_v6_is_mcast_sock", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 773.0, "function_hash": "44854395681877227662469478022504807470" }, "id": "CVE-2022-49420-7509e72e" }, { "signature_version": "v1", "target": { "function": "ipcm_init_sk", "file": "include/net/ip.h" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 280.0, "function_hash": "135397730418996906667613477707063228809" }, "id": "CVE-2022-49420-7858985c" }, { "signature_version": "v1", "target": { "file": "include/net/ip.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "line_hashes": [ "236334214850440250617030625078940358433", "158155796594956480565204490350232195487", "555522041842233508451788638790879781", "125883497239052745890557008440505354860" ], "threshold": 0.9 }, "id": "CVE-2022-49420-7cc8cce6" }, { "signature_version": "v1", "target": { "file": "net/ipv6/datagram.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "line_hashes": [ "264048306322476994293373172098087951814", "50867945918849331688270221583359360470", "265735899621507219283692121751575416812", "177920021355772008376644523981319581215", "83216774026390126906028766847937562346", "10012746100388752605421960466171454538", "66154345619748383767030843137139655705", "180298637429901490664816785691449092065", "220021594310571106692199939271365414798", "63174790539151515816507353220145406334", "125114316973508389920558113176282031270" ], "threshold": 0.9 }, "id": "CVE-2022-49420-854230a3" }, { "signature_version": "v1", "target": { "function": "ip6_datagram_send_ctl", "file": "net/ipv6/datagram.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 5217.0, "function_hash": "128992734219264835309257712155545235227" }, "id": "CVE-2022-49420-8f49ea53" }, { "signature_version": "v1", "target": { "function": "sk_dev_equal_l3scope", "file": "include/net/sock.h" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 284.0, "function_hash": "117132252540372951611011061385155393306" }, "id": "CVE-2022-49420-a3983667" }, { "signature_version": "v1", "target": { "function": "udpv6_sendmsg", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 6790.0, "function_hash": "115711720697686369837666202553221434247" }, "id": "CVE-2022-49420-a39df648" }, { "signature_version": "v1", "target": { "function": "sk_dev_equal_l3scope", "file": "include/net/sock.h" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 284.0, "function_hash": "117132252540372951611011061385155393306" }, "id": "CVE-2022-49420-a6904f20" }, { "signature_version": "v1", "target": { "function": "ipcm_init_sk", "file": "include/net/ip.h" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "length": 280.0, "function_hash": "135397730418996906667613477707063228809" }, "id": "CVE-2022-49420-ad6e5242" }, { "signature_version": "v1", "target": { "file": "include/net/ip.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "line_hashes": [ "236334214850440250617030625078940358433", "158155796594956480565204490350232195487", "555522041842233508451788638790879781", "125883497239052745890557008440505354860" ], "threshold": 0.9 }, "id": "CVE-2022-49420-c56a2778" }, { "signature_version": "v1", "target": { "file": "include/net/sock.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "line_hashes": [ "182341888770492833979708719996848356424", "229804088061113493615438529708922380898", "99993169983191474699188777474787065092", "126957953084343977114929439414738719493", "37796208760883884419377112217861234155", "332233165155814979479081136042517979763", "93317179559999145437430097172907698072", "149728019539719393674888117172914337016", "189623663670671922501276793041430752513" ], "threshold": 0.9 }, "id": "CVE-2022-49420-c5b3d891" }, { "signature_version": "v1", "target": { "function": "__udp_v6_is_mcast_sock", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 773.0, "function_hash": "44854395681877227662469478022504807470" }, "id": "CVE-2022-49420-ef8d0658" }, { "signature_version": "v1", "target": { "function": "compute_score", "file": "net/ipv6/udp.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb", "deprecated": false, "digest": { "length": 886.0, "function_hash": "200313247127621520581188719638596411400" }, "id": "CVE-2022-49420-efc21a5a" }, { "signature_version": "v1", "target": { "file": "net/ipv6/udp.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5", "deprecated": false, "digest": { "line_hashes": [ "299711429879782230056096513185501102675", "51829043465610244595732272488610850761", "315452408461793187725851093368130561632", "258348234953488192474189611457877728003", "4524577362662627105354115455573948802", "252438698601327134745024419467714591344", "137506737215049369561536583231633379843", "332113706308949864669878254626405539224", "336918038704976441590293373309128421281", "177187405997331454408468333667273651318", "20429496889834619356941604671041997009", "264761393034595614831940998445532310625", "234460323253466090687269450490303197422", "235601806895740851712665380301512934531", "145776846197230717094815790644059544793", "223705204587639568755060293786417566464", "39904360836368821916112790963944090178", "20176723081987412974672370525111624026", "258855914586077380916018439232466696792" ], "threshold": 0.9 }, "id": "CVE-2022-49420-f03a4b47" } ] }