Skip to content

Commit 13eddc6

Browse files
edumazetgregkh
edumazet
authored and
gregkh
committed
tcp/dccp: fix ireq->opt races
[ Upstream commit c92e8c02fe664155ac4234516e32544bec0f113d ] syzkaller found another bug in DCCP/TCP stacks [1] For the reasons explained in commit ce10500 ("tcp/dccp: fix ireq->pktopts race"), we need to make sure we do not access ireq->opt unless we own the request sock. Note the opt field is renamed to ireq_opt to ease grep games. [1] BUG: KASAN: use-after-free in ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474 Read of size 1 at addr ffff8801c951039c by task syz-executor5/3295 CPU: 1 PID: 3295 Comm: syz-executor5 Not tainted 4.14.0-rc4+ #80 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427 ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474 tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1135 tcp_send_ack.part.37+0x3bb/0x650 net/ipv4/tcp_output.c:3587 tcp_send_ack+0x49/0x60 net/ipv4/tcp_output.c:3557 __tcp_ack_snd_check+0x2c6/0x4b0 net/ipv4/tcp_input.c:5072 tcp_ack_snd_check net/ipv4/tcp_input.c:5085 [inline] tcp_rcv_state_process+0x2eff/0x4850 net/ipv4/tcp_input.c:6071 tcp_child_process+0x342/0x990 net/ipv4/tcp_minisocks.c:816 tcp_v4_rcv+0x1827/0x2f80 net/ipv4/tcp_ipv4.c:1682 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:249 [inline] ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:464 [inline] ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397 NF_HOOK include/linux/netfilter.h:249 [inline] ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587 netif_receive_skb+0xae/0x390 net/core/dev.c:4611 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792 call_write_iter include/linux/fs.h:1770 [inline] new_sync_write fs/read_write.c:468 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:481 vfs_write+0x18f/0x510 fs/read_write.c:543 SYSC_write fs/read_write.c:588 [inline] SyS_write+0xef/0x220 fs/read_write.c:580 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c341 RSP: 002b:00007f469523ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c341 RDX: 0000000000000037 RSI: 0000000020004000 RDI: 0000000000000015 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b7fd1 R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000025000 Allocated by task 3295: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x162/0x760 mm/slab.c:3734 kmalloc include/linux/slab.h:498 [inline] tcp_v4_save_options include/net/tcp.h:1962 [inline] tcp_v4_init_req+0x2d3/0x3e0 net/ipv4/tcp_ipv4.c:1271 tcp_conn_request+0xf6d/0x3410 net/ipv4/tcp_input.c:6283 tcp_v4_conn_request+0x157/0x210 net/ipv4/tcp_ipv4.c:1313 tcp_rcv_state_process+0x8ea/0x4850 net/ipv4/tcp_input.c:5857 tcp_v4_do_rcv+0x55c/0x7d0 net/ipv4/tcp_ipv4.c:1482 tcp_v4_rcv+0x2d10/0x2f80 net/ipv4/tcp_ipv4.c:1711 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:249 [inline] ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:464 [inline] ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397 NF_HOOK include/linux/netfilter.h:249 [inline] ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587 netif_receive_skb+0xae/0x390 net/core/dev.c:4611 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792 call_write_iter include/linux/fs.h:1770 [inline] new_sync_write fs/read_write.c:468 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:481 vfs_write+0x18f/0x510 fs/read_write.c:543 SYSC_write fs/read_write.c:588 [inline] SyS_write+0xef/0x220 fs/read_write.c:580 entry_SYSCALL_64_fastpath+0x1f/0xbe Freed by task 3306: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3503 [inline] kfree+0xca/0x250 mm/slab.c:3820 inet_sock_destruct+0x59d/0x950 net/ipv4/af_inet.c:157 __sk_destruct+0xfd/0x910 net/core/sock.c:1560 sk_destruct+0x47/0x80 net/core/sock.c:1595 __sk_free+0x57/0x230 net/core/sock.c:1603 sk_free+0x2a/0x40 net/core/sock.c:1614 sock_put include/net/sock.h:1652 [inline] inet_csk_complete_hashdance+0xd5/0xf0 net/ipv4/inet_connection_sock.c:959 tcp_check_req+0xf4d/0x1620 net/ipv4/tcp_minisocks.c:765 tcp_v4_rcv+0x17f6/0x2f80 net/ipv4/tcp_ipv4.c:1675 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:249 [inline] ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:464 [inline] ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397 NF_HOOK include/linux/netfilter.h:249 [inline] ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587 netif_receive_skb+0xae/0x390 net/core/dev.c:4611 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792 call_write_iter include/linux/fs.h:1770 [inline] new_sync_write fs/read_write.c:468 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:481 vfs_write+0x18f/0x510 fs/read_write.c:543 SYSC_write fs/read_write.c:588 [inline] SyS_write+0xef/0x220 fs/read_write.c:580 entry_SYSCALL_64_fastpath+0x1f/0xbe Fixes: e994b2f ("tcp: do not lock listener to process SYN packets") Fixes: 079096f ("tcp/dccp: install syn_recv requests into ehash table") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent b9b0c99 commit 13eddc6

7 files changed

Lines changed: 33 additions & 39 deletions

File tree

‎include/net/inet_sock.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ struct inet_request_sock {
9595
kmemcheck_bitfield_end(flags);
9696
u32 ir_mark;
9797
union {
98-
struct ip_options_rcu *opt;
98+
struct ip_options_rcu __rcu *ireq_opt;
9999
struct sk_buff *pktopts;
100100
};
101101
};

‎net/dccp/ipv4.c‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -414,8 +414,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
414414
sk_daddr_set(newsk, ireq->ir_rmt_addr);
415415
sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
416416
newinet->inet_saddr = ireq->ir_loc_addr;
417-
newinet->inet_opt = ireq->opt;
418-
ireq->opt = NULL;
417+
RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt));
419418
newinet->mc_index = inet_iif(skb);
420419
newinet->mc_ttl = ip_hdr(skb)->ttl;
421420
newinet->inet_id = jiffies;
@@ -430,7 +429,10 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
430429
if (__inet_inherit_port(sk, newsk) < 0)
431430
goto put_and_exit;
432431
*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
433-
432+
if (*own_req)
433+
ireq->ireq_opt = NULL;
434+
else
435+
newinet->inet_opt = NULL;
434436
return newsk;
435437

436438
exit_overflow:
@@ -441,6 +443,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
441443
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
442444
return NULL;
443445
put_and_exit:
446+
newinet->inet_opt = NULL;
444447
inet_csk_prepare_forced_close(newsk);
445448
dccp_done(newsk);
446449
goto exit;
@@ -492,7 +495,7 @@ static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req
492495
ireq->ir_rmt_addr);
493496
err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
494497
ireq->ir_rmt_addr,
495-
ireq->opt);
498+
rcu_dereference(ireq->ireq_opt));
496499
err = net_xmit_eval(err);
497500
}
498501

@@ -546,7 +549,7 @@ static void dccp_v4_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
546549
static void dccp_v4_reqsk_destructor(struct request_sock *req)
547550
{
548551
dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
549-
kfree(inet_rsk(req)->opt);
552+
kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1));
550553
}
551554

552555
void dccp_syn_ack_timeout(const struct request_sock *req)

‎net/ipv4/cipso_ipv4.c‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2012,7 +2012,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
20122012
buf = NULL;
20132013

20142014
req_inet = inet_rsk(req);
2015-
opt = xchg(&req_inet->opt, opt);
2015+
opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
20162016
if (opt)
20172017
kfree_rcu(opt, rcu);
20182018

@@ -2034,11 +2034,13 @@ int cipso_v4_req_setattr(struct request_sock *req,
20342034
* values on failure.
20352035
*
20362036
*/
2037-
static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
2037+
static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
20382038
{
2039+
struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1);
20392040
int hdr_delta = 0;
2040-
struct ip_options_rcu *opt = *opt_ptr;
20412041

2042+
if (!opt || opt->opt.cipso == 0)
2043+
return 0;
20422044
if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
20432045
u8 cipso_len;
20442046
u8 cipso_off;
@@ -2100,14 +2102,10 @@ static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
21002102
*/
21012103
void cipso_v4_sock_delattr(struct sock *sk)
21022104
{
2103-
int hdr_delta;
2104-
struct ip_options_rcu *opt;
21052105
struct inet_sock *sk_inet;
2106+
int hdr_delta;
21062107

21072108
sk_inet = inet_sk(sk);
2108-
opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
2109-
if (!opt || opt->opt.cipso == 0)
2110-
return;
21112109

21122110
hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
21132111
if (sk_inet->is_icsk && hdr_delta > 0) {
@@ -2127,15 +2125,7 @@ void cipso_v4_sock_delattr(struct sock *sk)
21272125
*/
21282126
void cipso_v4_req_delattr(struct request_sock *req)
21292127
{
2130-
struct ip_options_rcu *opt;
2131-
struct inet_request_sock *req_inet;
2132-
2133-
req_inet = inet_rsk(req);
2134-
opt = req_inet->opt;
2135-
if (!opt || opt->opt.cipso == 0)
2136-
return;
2137-
2138-
cipso_v4_delopt(&req_inet->opt);
2128+
cipso_v4_delopt(&inet_rsk(req)->ireq_opt);
21392129
}
21402130

21412131
/**

‎net/ipv4/inet_connection_sock.c‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -412,9 +412,10 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
412412
{
413413
const struct inet_request_sock *ireq = inet_rsk(req);
414414
struct net *net = read_pnet(&ireq->ireq_net);
415-
struct ip_options_rcu *opt = ireq->opt;
415+
struct ip_options_rcu *opt;
416416
struct rtable *rt;
417417

418+
opt = rcu_dereference(ireq->ireq_opt);
418419
flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
419420
RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
420421
sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -448,10 +449,9 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
448449
struct flowi4 *fl4;
449450
struct rtable *rt;
450451

452+
opt = rcu_dereference(ireq->ireq_opt);
451453
fl4 = &newinet->cork.fl.u.ip4;
452454

453-
rcu_read_lock();
454-
opt = rcu_dereference(newinet->inet_opt);
455455
flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
456456
RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
457457
sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -464,13 +464,11 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
464464
goto no_route;
465465
if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
466466
goto route_err;
467-
rcu_read_unlock();
468467
return &rt->dst;
469468

470469
route_err:
471470
ip_rt_put(rt);
472471
no_route:
473-
rcu_read_unlock();
474472
IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
475473
return NULL;
476474
}

‎net/ipv4/syncookies.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
357357
/* We throwed the options of the initial SYN away, so we hope
358358
* the ACK carries the same options again (see RFC1122 4.2.3.8)
359359
*/
360-
ireq->opt = tcp_v4_save_options(skb);
360+
RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(skb));
361361

362362
if (security_inet_conn_request(sk, skb, req)) {
363363
reqsk_free(req);

‎net/ipv4/tcp_input.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6105,7 +6105,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
61056105
struct inet_request_sock *ireq = inet_rsk(req);
61066106

61076107
kmemcheck_annotate_bitfield(ireq, flags);
6108-
ireq->opt = NULL;
6108+
ireq->ireq_opt = NULL;
61096109
atomic64_set(&ireq->ir_cookie, 0);
61106110
ireq->ireq_state = TCP_NEW_SYN_RECV;
61116111
write_pnet(&ireq->ireq_net, sock_net(sk_listener));

‎net/ipv4/tcp_ipv4.c‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -856,7 +856,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
856856

857857
err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
858858
ireq->ir_rmt_addr,
859-
ireq->opt);
859+
rcu_dereference(ireq->ireq_opt));
860860
err = net_xmit_eval(err);
861861
}
862862

@@ -868,7 +868,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
868868
*/
869869
static void tcp_v4_reqsk_destructor(struct request_sock *req)
870870
{
871-
kfree(inet_rsk(req)->opt);
871+
kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1));
872872
}
873873

874874

@@ -1197,7 +1197,7 @@ static void tcp_v4_init_req(struct request_sock *req,
11971197
sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
11981198
sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
11991199
ireq->no_srccheck = inet_sk(sk_listener)->transparent;
1200-
ireq->opt = tcp_v4_save_options(skb);
1200+
RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(skb));
12011201
}
12021202

12031203
static struct dst_entry *tcp_v4_route_req(const struct sock *sk,
@@ -1292,10 +1292,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
12921292
ireq = inet_rsk(req);
12931293
sk_daddr_set(newsk, ireq->ir_rmt_addr);
12941294
sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
1295-
newinet->inet_saddr = ireq->ir_loc_addr;
1296-
inet_opt = ireq->opt;
1297-
rcu_assign_pointer(newinet->inet_opt, inet_opt);
1298-
ireq->opt = NULL;
1295+
newinet->inet_saddr = ireq->ir_loc_addr;
1296+
inet_opt = rcu_dereference(ireq->ireq_opt);
1297+
RCU_INIT_POINTER(newinet->inet_opt, inet_opt);
12991298
newinet->mc_index = inet_iif(skb);
13001299
newinet->mc_ttl = ip_hdr(skb)->ttl;
13011300
newinet->rcv_tos = ip_hdr(skb)->tos;
@@ -1343,9 +1342,12 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
13431342
if (__inet_inherit_port(sk, newsk) < 0)
13441343
goto put_and_exit;
13451344
*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1346-
if (*own_req)
1345+
if (likely(*own_req)) {
13471346
tcp_move_syn(newtp, req);
1348-
1347+
ireq->ireq_opt = NULL;
1348+
} else {
1349+
newinet->inet_opt = NULL;
1350+
}
13491351
return newsk;
13501352

13511353
exit_overflow:
@@ -1356,6 +1358,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
13561358
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
13571359
return NULL;
13581360
put_and_exit:
1361+
newinet->inet_opt = NULL;
13591362
inet_csk_prepare_forced_close(newsk);
13601363
tcp_done(newsk);
13611364
goto exit;

0 commit comments

Comments
 (0)