Paolo Abeni
dc24f8b4ec
mptcp: add dummy icsk_sync_mss() ...
syzbot noted that the master MPTCP socket lacks the icsk_sync_mss
callback, and was able to trigger a null pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 8e171067 P4D 8e171067 PUD 93fa2067 PMD 0
Oops: 0010 [#1 ] PREEMPT SMP KASAN
CPU: 0 PID: 8984 Comm: syz-executor066 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffffc900020b7b80 EFLAGS: 00010246
RAX: 1ffff110124ba600 RBX: 0000000000000000 RCX: ffff88809fefa600
RDX: ffff8880994cdb18 RSI: 0000000000000000 RDI: ffff8880925d3140
RBP: ffffc900020b7bd8 R08: ffffffff870225be R09: fffffbfff140652a
R10: fffffbfff140652a R11: 0000000000000000 R12: ffff8880925d35d0
R13: ffff8880925d3140 R14: dffffc0000000000 R15: 1ffff110124ba6ba
FS: 0000000001a0b880(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000a6d6f000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cipso_v4_sock_setattr+0x34b/0x470 net/ipv4/cipso_ipv4.c:1888
netlbl_sock_setattr+0x2a7/0x310 net/netlabel/netlabel_kapi.c:989
smack_netlabel security/smack/smack_lsm.c:2425 [inline]
smack_inode_setsecurity+0x3da/0x4a0 security/smack/smack_lsm.c:2716
security_inode_setsecurity+0xb2/0x140 security/security.c:1364
__vfs_setxattr_noperm+0x16f/0x3e0 fs/xattr.c:197
vfs_setxattr fs/xattr.c:224 [inline]
setxattr+0x335/0x430 fs/xattr.c:451
__do_sys_fsetxattr fs/xattr.c:506 [inline]
__se_sys_fsetxattr+0x130/0x1b0 fs/xattr.c:495
__x64_sys_fsetxattr+0xbf/0xd0 fs/xattr.c:495
do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440199
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcadc19e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000be
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440199
RDX: 0000000020000200 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000003 R09: 00000000004002c8
R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000401a20
R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000000
Address the issue adding a dummy icsk_sync_mss callback.
To properly sync the subflows mss and options list we need some
additional infrastructure, which will land to net-next.
Reported-by: syzbot+f4dfece964792d80b139@syzkaller.appspotmail.com
Fixes: 2303f994b3e1 ("mptcp: Associate MPTCP context with TCP socket")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-26 20:49:50 -08:00
2019-12-09 10:36:44 -08:00
2020-01-09 12:13:43 -08:00
2020-02-04 03:05:26 +00:00
2020-01-09 18:41:40 -08:00
2020-01-19 22:10:04 +01:00
2020-01-26 10:34:17 +02:00
2019-12-18 17:05:58 -08:00
2020-02-04 01:53:07 +09:00
2020-02-24 11:11:19 -08:00
2020-01-24 08:12:06 +01:00
2019-12-08 11:52:02 +01:00
2020-02-08 13:26:41 -08:00
2020-02-26 16:59:18 -08:00
2019-12-09 10:36:44 -08:00
2020-01-09 18:41:40 -08:00
2020-02-14 07:34:51 -08:00
2020-01-27 11:09:31 +01:00
2020-02-26 11:27:31 -08:00
2020-02-19 10:55:42 -08:00
2019-11-02 13:54:56 -07:00
2020-02-23 17:23:35 -08:00
2020-02-26 20:20:58 -08:00
2019-12-09 10:36:44 -08:00
2020-02-04 12:35:49 +01:00
2019-12-20 21:19:36 -08:00
2020-02-24 10:42:38 +01:00
2019-12-04 12:27:13 -08:00
2020-02-26 20:49:50 -08:00
2020-01-09 18:36:22 -08:00
2020-02-26 23:25:07 +01:00
2020-02-18 12:44:23 -08:00
2020-02-22 21:58:33 -08:00
2019-10-24 14:53:48 -07:00
2019-12-18 11:57:33 -08:00
2020-02-20 10:00:19 -08:00
2020-01-29 14:55:47 -08:00
2020-01-03 12:25:50 -08:00
2019-11-26 14:40:13 -08:00
2020-01-14 18:36:42 -08:00
2020-02-16 18:37:09 -08:00
2019-12-16 10:15:49 +01:00
2020-01-26 10:40:21 +01:00
2020-02-07 11:20:57 +01:00
2020-02-26 17:10:44 -08:00
2020-02-17 21:56:03 -08:00
2020-02-26 20:18:07 -08:00
2020-02-13 15:35:33 -05:00
2020-02-10 10:23:00 +01:00
2020-02-19 16:32:06 -08:00
2020-02-06 13:59:10 +01:00
2020-01-19 22:10:04 +01:00
2020-02-24 10:41:13 +01:00
2020-01-09 18:39:33 -08:00
2020-02-11 15:51:11 +01:00
2020-02-13 14:19:00 -08:00
2019-11-15 14:38:29 +01:00
2020-02-20 15:02:02 -08:00
2020-01-24 13:44:07 +01:00
2020-01-08 15:02:21 -08:00
dc24f8b4ec