• Eric Dumazet's avatar
    tcp: do not inherit fastopen_req from parent · 8b485ce6
    Eric Dumazet authored
    Under fuzzer stress, it is possible that a child gets a non NULL
    fastopen_req pointer from its parent at accept() time, when/if parent
    morphs from listener to active session.
    
    We need to make sure this can not happen, by clearing the field after
    socket cloning.
    
    BUG: Double free or freeing an invalid pointer
    Unexpected shadow byte: 0xFB
    CPU: 3 PID: 20933 Comm: syz-executor3 Not tainted 4.11.0+ #306
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
    01/01/2011
    Call Trace:
     <IRQ>
     __dump_stack lib/dump_stack.c:16 [inline]
     dump_stack+0x292/0x395 lib/dump_stack.c:52
     kasan_object_err+0x1c/0x70 mm/kasan/report.c:164
     kasan_report_double_free+0x5c/0x70 mm/kasan/report.c:185
     kasan_slab_free+0x9d/0xc0 mm/kasan/kasan.c:580
     slab_free_hook mm/slub.c:1357 [inline]
     slab_free_freelist_hook mm/slub.c:1379 [inline]
     slab_free mm/slub.c:2961 [inline]
     kfree+0xe8/0x2b0 mm/slub.c:3882
     tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]
     tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328
     inet_child_forget+0xb8/0x600 net/ipv4/inet_connection_sock.c:898
     inet_csk_reqsk_queue_add+0x1e7/0x250
    net/ipv4/inet_connection_sock.c:928
     tcp_get_cookie_sock+0x21a/0x510 net/ipv4/syncookies.c:217
     cookie_v4_check+0x1a19/0x28b0 net/ipv4/syncookies.c:384
     tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1384 [inline]
     tcp_v4_do_rcv+0x731/0x940 net/ipv4/tcp_ipv4.c:1421
     tcp_v4_rcv+0x2dc0/0x31c0 net/ipv4/tcp_ipv4.c:1715
     ip_local_deliver_finish+0x4cc/0xc20 net/ipv4/ip_input.c:216
     NF_HOOK include/linux/netfilter.h:257 [inline]
     ip_local_deliver+0x1ce/0x700 net/ipv4/ip_input.c:257
     dst_input include/net/dst.h:492 [inline]
     ip_rcv_finish+0xb1d/0x20b0 net/ipv4/ip_input.c:396
     NF_HOOK include/linux/netfilter.h:257 [inline]
     ip_rcv+0xd8c/0x19c0 net/ipv4/ip_input.c:487
     __netif_receive_skb_core+0x1ad1/0x3400 net/core/dev.c:4210
     __netif_receive_skb+0x2a/0x1a0 net/core/dev.c:4248
     process_backlog+0xe5/0x6c0 net/core/dev.c:4868
     napi_poll net/core/dev.c:5270 [inline]
     net_rx_action+0xe70/0x18e0 net/core/dev.c:5335
     __do_softirq+0x2fb/0xb99 kernel/softirq.c:284
     do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:899
     </IRQ>
     do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328
     do_softirq kernel/softirq.c:176 [inline]
     __local_bh_enable_ip+0x1cf/0x1e0 kernel/softirq.c:181
     local_bh_enable include/linux/bottom_half.h:31 [inline]
     rcu_read_unlock_bh include/linux/rcupdate.h:931 [inline]
     ip_finish_output2+0x9ab/0x15e0 net/ipv4/ip_output.c:230
     ip_finish_output+0xa35/0xdf0 net/ipv4/ip_output.c:316
     NF_HOOK_COND include/linux/netfilter.h:246 [inline]
     ip_output+0x1f6/0x7b0 net/ipv4/ip_output.c:404
     dst_output include/net/dst.h:486 [inline]
     ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
     ip_queue_xmit+0x9a8/0x1a10 net/ipv4/ip_output.c:503
     tcp_transmit_skb+0x1ade/0x3470 net/ipv4/tcp_output.c:1057
     tcp_write_xmit+0x79e/0x55b0 net/ipv4/tcp_output.c:2265
     __tcp_push_pending_frames+0xfa/0x3a0 net/ipv4/tcp_output.c:2450
     tcp_push+0x4ee/0x780 net/ipv4/tcp.c:683
     tcp_sendmsg+0x128d/0x39b0 net/ipv4/tcp.c:1342
     inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
     sock_sendmsg_nosec net/socket.c:633 [inline]
     sock_sendmsg+0xca/0x110 net/socket.c:643
     SYSC_sendto+0x660/0x810 net/socket.c:1696
     SyS_sendto+0x40/0x50 net/socket.c:1664
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x446059
    RSP: 002b:00007faa6761fb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c
    RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000000446059
    RDX: 0000000000000001 RSI: 0000000020ba3fcd RDI: 0000000000000017
    RBP: 00000000006e40a0 R08: 0000000020ba4ff0 R09: 0000000000000010
    R10: 0000000020000000 R11: 0000000000000282 R12: 0000000000708150
    R13: 0000000000000000 R14: 00007faa676209c0 R15: 00007faa67620700
    Object at ffff88003b5bbcb8, in cache kmalloc-64 size: 64
    Allocated:
    PID = 20909
     save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
     save_stack+0x43/0xd0 mm/kasan/kasan.c:513
     set_track mm/kasan/kasan.c:525 [inline]
     kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
     kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745
     kmalloc include/linux/slab.h:490 [inline]
     kzalloc include/linux/slab.h:663 [inline]
     tcp_sendmsg_fastopen net/ipv4/tcp.c:1094 [inline]
     tcp_sendmsg+0x221a/0x39b0 net/ipv4/tcp.c:1139
     inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
     sock_sendmsg_nosec net/socket.c:633 [inline]
     sock_sendmsg+0xca/0x110 net/socket.c:643
     SYSC_sendto+0x660/0x810 net/socket.c:1696
     SyS_sendto+0x40/0x50 net/socket.c:1664
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    Freed:
    PID = 20909
     save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
     save_stack+0x43/0xd0 mm/kasan/kasan.c:513
     set_track mm/kasan/kasan.c:525 [inline]
     kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589
     slab_free_hook mm/slub.c:1357 [inline]
     slab_free_freelist_hook mm/slub.c:1379 [inline]
     slab_free mm/slub.c:2961 [inline]
     kfree+0xe8/0x2b0 mm/slub.c:3882
     tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]
     tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328
     __inet_stream_connect+0x20c/0xf90 net/ipv4/af_inet.c:593
     tcp_sendmsg_fastopen net/ipv4/tcp.c:1111 [inline]
     tcp_sendmsg+0x23a8/0x39b0 net/ipv4/tcp.c:1139
     inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
     sock_sendmsg_nosec net/socket.c:633 [inline]
     sock_sendmsg+0xca/0x110 net/socket.c:643
     SYSC_sendto+0x660/0x810 net/socket.c:1696
     SyS_sendto+0x40/0x50 net/socket.c:1664
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    
    Fixes: e994b2f0 ("tcp: do not lock listener to process SYN packets")
    Fixes: 7db92362 ("tcp: fix potential double free issue for fastopen_req")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Acked-by: default avatarWei Wang <weiwan@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    8b485ce6
tcp_minisocks.c 25.8 KB