ACK: [PATCH][bionic/linux] tcp: make sure treq->af_specific is initialized
Luke Nowakowski-Krijger
luke.nowakowskikrijger at canonical.com
Tue Aug 2 15:21:01 UTC 2022
Acked-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger at canonical.com>
On Tue, Aug 2, 2022 at 6:27 AM Tim Gardner <tim.gardner at canonical.com>
wrote:
> From: Eric Dumazet <edumazet at google.com>
>
> BugLink: https://bugs.launchpad.net/bugs/1981658
>
> commit ba5a4fdd63ae0c575707030db0b634b160baddd7 upstream.
>
> syzbot complained about a recent change in TCP stack,
> hitting a NULL pointer [1]
>
> tcp request sockets have an af_specific pointer, which
> was used before the blamed change only for SYNACK generation
> in non SYNCOOKIE mode.
>
> tcp requests sockets momentarily created when third packet
> coming from client in SYNCOOKIE mode were not using
> treq->af_specific.
>
> Make sure this field is populated, in the same way normal
> TCP requests sockets do in tcp_conn_request().
>
> [1]
> TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
> cookies. Check SNMP counters.
> general protection fault, probably for non-canonical address
> 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted
> 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0
> net/ipv4/tcp_minisocks.c:534
> Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8
> 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48
> RSP: 0018:ffffc90000de0588 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100
> RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008
> RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0
> R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000
> FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267
> tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207
> cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258
> tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline]
> tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486
> tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725
> ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422
> ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464
> NF_HOOK include/linux/netfilter.h:307 [inline]
> NF_HOOK include/linux/netfilter.h:301 [inline]
> ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473
> dst_input include/net/dst.h:461 [inline]
> ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
> NF_HOOK include/linux/netfilter.h:307 [inline]
> NF_HOOK include/linux/netfilter.h:301 [inline]
> ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297
> __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405
> __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519
> process_backlog+0x3a0/0x7c0 net/core/dev.c:5847
> __napi_poll+0xb3/0x6e0 net/core/dev.c:6413
> napi_poll net/core/dev.c:6480 [inline]
> net_rx_action+0x8ec/0xc60 net/core/dev.c:6567
> __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
> invoke_softirq kernel/softirq.c:432 [inline]
> __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
> irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
> sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
>
> Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming
> connections")
> Signed-off-by: Eric Dumazet <edumazet at google.com>
> Cc: Francesco Ruggeri <fruggeri at arista.com>
> Signed-off-by: David S. Miller <davem at davemloft.net>
> [fruggeri: Account for backport conflicts from 35b2c3211609 and
> 6fc8c827dd4f]
> Signed-off-by: Francesco Ruggeri <fruggeri at arista.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
> (cherry picked from commit 6c2176f5ad48095aa1e2608b51bada5bebc568c1
> linux-4.19.y)
> Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
> ---
>
> This patch necessitates a respin for all 4.15 based kernels.
>
> ---
> include/net/tcp.h | 5 +++++
> net/ipv4/syncookies.c | 1 +
> net/ipv4/tcp_ipv4.c | 2 +-
> net/ipv6/syncookies.c | 1 +
> net/ipv6/tcp_ipv6.c | 2 +-
> 5 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 6f8c1aab59d1..8750147b15ca 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1870,6 +1870,11 @@ struct tcp_request_sock_ops {
> enum tcp_synack_type synack_type);
> };
>
> +extern const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops;
> +#if IS_ENABLED(CONFIG_IPV6)
> +extern const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops;
> +#endif
> +
> #ifdef CONFIG_SYN_COOKIES
> static inline __u32 cookie_init_sequence(const struct
> tcp_request_sock_ops *ops,
> const struct sock *sk, struct
> sk_buff *skb,
> diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
> index 7e43d867fe21..7c1f1131b965 100644
> --- a/net/ipv4/syncookies.c
> +++ b/net/ipv4/syncookies.c
> @@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct
> sk_buff *skb)
>
> ireq = inet_rsk(req);
> treq = tcp_rsk(req);
> + treq->af_specific = &tcp_request_sock_ipv4_ops;
> treq->rcv_isn = ntohl(th->seq) - 1;
> treq->snt_isn = cookie;
> treq->ts_off = 0;
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 8dd878f18aa7..e14183cf8b2a 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1306,7 +1306,7 @@ struct request_sock_ops tcp_request_sock_ops
> __read_mostly = {
> .syn_ack_timeout = tcp_syn_ack_timeout,
> };
>
> -static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
> +const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
> .mss_clamp = TCP_MSS_DEFAULT,
> #ifdef CONFIG_TCP_MD5SIG
> .req_md5_lookup = tcp_v4_md5_lookup,
> diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
> index 4e6c886f1b73..84b2858f82c0 100644
> --- a/net/ipv6/syncookies.c
> +++ b/net/ipv6/syncookies.c
> @@ -181,6 +181,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct
> sk_buff *skb)
>
> ireq = inet_rsk(req);
> treq = tcp_rsk(req);
> + treq->af_specific = &tcp_request_sock_ipv6_ops;
> treq->tfo_listener = false;
>
> if (security_inet_conn_request(sk, skb, req))
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index faad76566be3..3a0d50ac30e1 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -774,7 +774,7 @@ struct request_sock_ops tcp6_request_sock_ops
> __read_mostly = {
> .syn_ack_timeout = tcp_syn_ack_timeout,
> };
>
> -static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
> +const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
> .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
> sizeof(struct ipv6hdr),
> #ifdef CONFIG_TCP_MD5SIG
> --
> 2.37.1
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20220802/1bf4e382/attachment.html>
More information about the kernel-team
mailing list