| From 811eee0b8ceba915f6a29e339da8e1d5ee9e714d Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Wed, 3 May 2017 06:39:31 -0700 |
| Subject: [PATCH] tcp: do not inherit fastopen_req from parent |
| |
| commit 8b485ce69876c65db12ed390e7f9c0d2a64eff2c upstream. |
| |
| Under fuzzer stress, it is possible that a child gets a non NULL |
| fastopen_req pointer from its parent at accept() time, when/if parent |
| morphs from listener to active session. |
| |
| We need to make sure this can not happen, by clearing the field after |
| socket cloning. |
| |
| BUG: Double free or freeing an invalid pointer |
| Unexpected shadow byte: 0xFB |
| CPU: 3 PID: 20933 Comm: syz-executor3 Not tainted 4.11.0+ #306 |
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs |
| 01/01/2011 |
| Call Trace: |
| <IRQ> |
| __dump_stack lib/dump_stack.c:16 [inline] |
| dump_stack+0x292/0x395 lib/dump_stack.c:52 |
| kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 |
| kasan_report_double_free+0x5c/0x70 mm/kasan/report.c:185 |
| kasan_slab_free+0x9d/0xc0 mm/kasan/kasan.c:580 |
| slab_free_hook mm/slub.c:1357 [inline] |
| slab_free_freelist_hook mm/slub.c:1379 [inline] |
| slab_free mm/slub.c:2961 [inline] |
| kfree+0xe8/0x2b0 mm/slub.c:3882 |
| tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline] |
| tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328 |
| inet_child_forget+0xb8/0x600 net/ipv4/inet_connection_sock.c:898 |
| inet_csk_reqsk_queue_add+0x1e7/0x250 |
| net/ipv4/inet_connection_sock.c:928 |
| tcp_get_cookie_sock+0x21a/0x510 net/ipv4/syncookies.c:217 |
| cookie_v4_check+0x1a19/0x28b0 net/ipv4/syncookies.c:384 |
| tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1384 [inline] |
| tcp_v4_do_rcv+0x731/0x940 net/ipv4/tcp_ipv4.c:1421 |
| tcp_v4_rcv+0x2dc0/0x31c0 net/ipv4/tcp_ipv4.c:1715 |
| ip_local_deliver_finish+0x4cc/0xc20 net/ipv4/ip_input.c:216 |
| NF_HOOK include/linux/netfilter.h:257 [inline] |
| ip_local_deliver+0x1ce/0x700 net/ipv4/ip_input.c:257 |
| dst_input include/net/dst.h:492 [inline] |
| ip_rcv_finish+0xb1d/0x20b0 net/ipv4/ip_input.c:396 |
| NF_HOOK include/linux/netfilter.h:257 [inline] |
| ip_rcv+0xd8c/0x19c0 net/ipv4/ip_input.c:487 |
| __netif_receive_skb_core+0x1ad1/0x3400 net/core/dev.c:4210 |
| __netif_receive_skb+0x2a/0x1a0 net/core/dev.c:4248 |
| process_backlog+0xe5/0x6c0 net/core/dev.c:4868 |
| napi_poll net/core/dev.c:5270 [inline] |
| net_rx_action+0xe70/0x18e0 net/core/dev.c:5335 |
| __do_softirq+0x2fb/0xb99 kernel/softirq.c:284 |
| do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:899 |
| </IRQ> |
| do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328 |
| do_softirq kernel/softirq.c:176 [inline] |
| __local_bh_enable_ip+0x1cf/0x1e0 kernel/softirq.c:181 |
| local_bh_enable include/linux/bottom_half.h:31 [inline] |
| rcu_read_unlock_bh include/linux/rcupdate.h:931 [inline] |
| ip_finish_output2+0x9ab/0x15e0 net/ipv4/ip_output.c:230 |
| ip_finish_output+0xa35/0xdf0 net/ipv4/ip_output.c:316 |
| NF_HOOK_COND include/linux/netfilter.h:246 [inline] |
| ip_output+0x1f6/0x7b0 net/ipv4/ip_output.c:404 |
| dst_output include/net/dst.h:486 [inline] |
| ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124 |
| ip_queue_xmit+0x9a8/0x1a10 net/ipv4/ip_output.c:503 |
| tcp_transmit_skb+0x1ade/0x3470 net/ipv4/tcp_output.c:1057 |
| tcp_write_xmit+0x79e/0x55b0 net/ipv4/tcp_output.c:2265 |
| __tcp_push_pending_frames+0xfa/0x3a0 net/ipv4/tcp_output.c:2450 |
| tcp_push+0x4ee/0x780 net/ipv4/tcp.c:683 |
| tcp_sendmsg+0x128d/0x39b0 net/ipv4/tcp.c:1342 |
| inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 |
| sock_sendmsg_nosec net/socket.c:633 [inline] |
| sock_sendmsg+0xca/0x110 net/socket.c:643 |
| SYSC_sendto+0x660/0x810 net/socket.c:1696 |
| SyS_sendto+0x40/0x50 net/socket.c:1664 |
| entry_SYSCALL_64_fastpath+0x1f/0xbe |
| RIP: 0033:0x446059 |
| RSP: 002b:00007faa6761fb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c |
| RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000000446059 |
| RDX: 0000000000000001 RSI: 0000000020ba3fcd RDI: 0000000000000017 |
| RBP: 00000000006e40a0 R08: 0000000020ba4ff0 R09: 0000000000000010 |
| R10: 0000000020000000 R11: 0000000000000282 R12: 0000000000708150 |
| R13: 0000000000000000 R14: 00007faa676209c0 R15: 00007faa67620700 |
| Object at ffff88003b5bbcb8, in cache kmalloc-64 size: 64 |
| Allocated: |
| PID = 20909 |
| save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 |
| save_stack+0x43/0xd0 mm/kasan/kasan.c:513 |
| set_track mm/kasan/kasan.c:525 [inline] |
| kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 |
| kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745 |
| kmalloc include/linux/slab.h:490 [inline] |
| kzalloc include/linux/slab.h:663 [inline] |
| tcp_sendmsg_fastopen net/ipv4/tcp.c:1094 [inline] |
| tcp_sendmsg+0x221a/0x39b0 net/ipv4/tcp.c:1139 |
| inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 |
| sock_sendmsg_nosec net/socket.c:633 [inline] |
| sock_sendmsg+0xca/0x110 net/socket.c:643 |
| SYSC_sendto+0x660/0x810 net/socket.c:1696 |
| SyS_sendto+0x40/0x50 net/socket.c:1664 |
| entry_SYSCALL_64_fastpath+0x1f/0xbe |
| Freed: |
| PID = 20909 |
| save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 |
| save_stack+0x43/0xd0 mm/kasan/kasan.c:513 |
| set_track mm/kasan/kasan.c:525 [inline] |
| kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589 |
| slab_free_hook mm/slub.c:1357 [inline] |
| slab_free_freelist_hook mm/slub.c:1379 [inline] |
| slab_free mm/slub.c:2961 [inline] |
| kfree+0xe8/0x2b0 mm/slub.c:3882 |
| tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline] |
| tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328 |
| __inet_stream_connect+0x20c/0xf90 net/ipv4/af_inet.c:593 |
| tcp_sendmsg_fastopen net/ipv4/tcp.c:1111 [inline] |
| tcp_sendmsg+0x23a8/0x39b0 net/ipv4/tcp.c:1139 |
| inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 |
| sock_sendmsg_nosec net/socket.c:633 [inline] |
| sock_sendmsg+0xca/0x110 net/socket.c:643 |
| SYSC_sendto+0x660/0x810 net/socket.c:1696 |
| SyS_sendto+0x40/0x50 net/socket.c:1664 |
| entry_SYSCALL_64_fastpath+0x1f/0xbe |
| |
| Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") |
| Fixes: 7db92362d2fe ("tcp: fix potential double free issue for fastopen_req") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: Andrey Konovalov <andreyknvl@google.com> |
| Acked-by: Wei Wang <weiwan@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c |
| index e183eeebe962..ecd8e8dc9004 100644 |
| --- a/net/ipv4/tcp_minisocks.c |
| +++ b/net/ipv4/tcp_minisocks.c |
| @@ -541,6 +541,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, |
| newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len; |
| newtp->rx_opt.mss_clamp = req->mss; |
| tcp_ecn_openreq_child(newtp, req); |
| + newtp->fastopen_req = NULL; |
| newtp->fastopen_rsk = NULL; |
| newtp->syn_data_acked = 0; |
| newtp->rack.mstamp.v64 = 0; |
| -- |
| 2.12.0 |
| |