Patch "tipc: force a dst refcount before doing decryption" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tipc: force a dst refcount before doing decryption

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tipc-force-a-dst-refcount-before-doing-decryption.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 27c73e8edb883076e3b6af147daeb13f929ae851
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Sat Jun 15 14:27:20 2024 -0400

    tipc: force a dst refcount before doing decryption
    
    [ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ]
    
    As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before
    entering the xfrm type handlers"):
    
    "Crypto requests might return asynchronous. In this case we leave the
     rcu protected region, so force a refcount on the skb's destination
     entry before we enter the xfrm type input/output handlers."
    
    On TIPC decryption path it has the same problem, and skb_dst_force()
    should be called before doing decryption to avoid a possible crash.
    
    Shuang reported this issue when this warning is triggered:
    
      [] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc]
      [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug
      [] Workqueue: crypto cryptd_queue_worker
      [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc]
      [] Call Trace:
      [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc]
      [] tipc_rcv+0xcf5/0x1060 [tipc]
      [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc]
      [] cryptd_aead_crypt+0xdb/0x190
      [] cryptd_queue_worker+0xed/0x190
      [] process_one_work+0x93d/0x17e0
    
    Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
    Reported-by: Shuang Li <shuali@xxxxxxxxxx>
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Link: https://lore.kernel.org/r/fbe3195fad6997a4eec62d9bf076b2ad03ac336b.1718476040.git.lucien.xin@xxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/tipc/node.c b/net/tipc/node.c
index a9c5b6594889b..cf9d9f9b97844 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2107,6 +2107,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
 	} else {
 		n = tipc_node_find_by_id(net, ehdr->id);
 	}
+	skb_dst_force(skb);
 	tipc_crypto_rcv(net, (n) ? n->crypto_rx : NULL, &skb, b);
 	if (!skb)
 		return;