Eric Dumazet c92e8c02fe tcp/dccp: fix ireq->opt races ...

syzkaller found another bug in DCCP/TCP stacks [1]

For the reasons explained in commit ce1050089c96 ("tcp/dccp: fix
ireq->pktopts race"), we need to make sure we do not access
ireq->opt unless we own the request sock.

Note the opt field is renamed to ireq_opt to ease grep games.

[1]
BUG: KASAN: use-after-free in ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
Read of size 1 at addr ffff8801c951039c by task syz-executor5/3295

CPU: 1 PID: 3295 Comm: syz-executor5 Not tainted 4.14.0-rc4+ #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427
 ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
 tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1135
 tcp_send_ack.part.37+0x3bb/0x650 net/ipv4/tcp_output.c:3587
 tcp_send_ack+0x49/0x60 net/ipv4/tcp_output.c:3557
 __tcp_ack_snd_check+0x2c6/0x4b0 net/ipv4/tcp_input.c:5072
 tcp_ack_snd_check net/ipv4/tcp_input.c:5085 [inline]
 tcp_rcv_state_process+0x2eff/0x4850 net/ipv4/tcp_input.c:6071
 tcp_child_process+0x342/0x990 net/ipv4/tcp_minisocks.c:816
 tcp_v4_rcv+0x1827/0x2f80 net/ipv4/tcp_ipv4.c:1682
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c341
RSP: 002b:00007f469523ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c341
RDX: 0000000000000037 RSI: 0000000020004000 RDI: 0000000000000015
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b7fd1
R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000025000

Allocated by task 3295:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x162/0x760 mm/slab.c:3734
 kmalloc include/linux/slab.h:498 [inline]
 tcp_v4_save_options include/net/tcp.h:1962 [inline]
 tcp_v4_init_req+0x2d3/0x3e0 net/ipv4/tcp_ipv4.c:1271
 tcp_conn_request+0xf6d/0x3410 net/ipv4/tcp_input.c:6283
 tcp_v4_conn_request+0x157/0x210 net/ipv4/tcp_ipv4.c:1313
 tcp_rcv_state_process+0x8ea/0x4850 net/ipv4/tcp_input.c:5857
 tcp_v4_do_rcv+0x55c/0x7d0 net/ipv4/tcp_ipv4.c:1482
 tcp_v4_rcv+0x2d10/0x2f80 net/ipv4/tcp_ipv4.c:1711
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 3306:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 inet_sock_destruct+0x59d/0x950 net/ipv4/af_inet.c:157
 __sk_destruct+0xfd/0x910 net/core/sock.c:1560
 sk_destruct+0x47/0x80 net/core/sock.c:1595
 __sk_free+0x57/0x230 net/core/sock.c:1603
 sk_free+0x2a/0x40 net/core/sock.c:1614
 sock_put include/net/sock.h:1652 [inline]
 inet_csk_complete_hashdance+0xd5/0xf0 net/ipv4/inet_connection_sock.c:959
 tcp_check_req+0xf4d/0x1620 net/ipv4/tcp_minisocks.c:765
 tcp_v4_rcv+0x17f6/0x2f80 net/ipv4/tcp_ipv4.c:1675
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-10-21 01:33:19 +01:00

..

netfilter

netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook

2017-10-09 13:08:39 +02:00

af_inet.c

net: Add comment that early_demux can change via sysctl

2017-08-28 15:17:29 -07:00

ah4.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

arp.c

neigh: increase queue_len_bytes to match wmem_default

2017-08-29 16:10:50 -07:00

cipso_ipv4.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

datagram.c

…

devinet.c

rtnetlink: make rtnl_register accept a flags parameter

2017-08-09 16:57:38 -07:00

esp4_offload.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-01 17:42:05 -07:00

esp4.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-01 17:42:05 -07:00

fib_frontend.c

rtnetlink: make rtnl_register accept a flags parameter

2017-08-09 16:57:38 -07:00

fib_lookup.h

ipv4: do metrics match when looking up and deleting a route

2017-08-23 20:37:10 -07:00

fib_notifier.c

net: Add module reference to FIB notifiers

2017-09-01 20:33:42 -07:00

fib_rules.c

net: fib_rules: Implement notification logic in core

2017-08-03 15:35:59 -07:00

fib_semantics.c

ipv4: do metrics match when looking up and deleting a route

2017-08-23 20:37:10 -07:00

fib_trie.c

ipv4: do metrics match when looking up and deleting a route

2017-08-23 20:37:10 -07:00

fou.c

gue: fix remcsum when GRO on and CHECKSUM_PARTIAL boundary is outer UDP

2017-08-01 16:09:14 -07:00

gre_demux.c

…

gre_offload.c

gso: fix payload length when gso_size is zero

2017-10-08 10:12:15 -07:00

icmp.c

ip/options: explicitly provide net ns to __ip_options_echo()

2017-08-06 20:51:12 -07:00

igmp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-08-21 17:06:42 -07:00

inet_connection_sock.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

inet_diag.c

inet_diag: allow protocols to provide additional data

2017-09-01 18:38:09 -07:00

inet_fragment.c

Revert "net: use lib/percpu_counter API for fragmentation mem accounting"

2017-09-03 11:01:05 -07:00

inet_hashtables.c

net: ipv4: add second dif to inet socket lookups

2017-08-07 11:39:21 -07:00

inet_timewait_sock.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

inetpeer.c

inetpeer: fix RCU lookup() again

2017-09-28 09:39:34 -07:00

ip_forward.c

ipv4: allow local fragmentation in ip_finish_output_gso()

2016-11-03 16:10:26 -04:00

ip_fragment.c

Revert "net: fix percpu memory leaks"

2017-09-03 11:01:05 -07:00

ip_gre.c

ip_gre: erspan device should keep dst

2017-10-01 22:30:32 -07:00

ip_input.c

IPv4: early demux can return an error code

2017-10-01 03:55:47 +01:00

ip_options.c

ip/options: explicitly provide net ns to __ip_options_echo()

2017-08-06 20:51:12 -07:00

ip_output.c

udp: remove unreachable ufo branches

2017-08-22 14:27:18 -07:00

ip_sockglue.c

net: ipv4: fix l3slave check for index returned in IP_PKTINFO

2017-09-15 14:27:51 -07:00

ip_tunnel_core.c

net: store port/representator id in metadata_dst

2017-06-25 11:42:01 -04:00

ip_tunnel.c

ip_tunnel: fix ip tunnel lookup in collect_md mode

2017-09-12 20:45:31 -07:00

ip_vti.c

vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

2017-09-26 09:58:21 -07:00

ipcomp.c

…

ipconfig.c

networking: convert many more places to skb_put_zero()

2017-06-16 11:48:35 -04:00

ipip.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ipmr.c

rtnetlink: make rtnl_register accept a flags parameter

2017-08-09 16:57:38 -07:00

Kconfig

ip: update policy routing config help

2017-10-12 22:57:11 -07:00

Makefile

tcp: ULP infrastructure

2017-06-15 12:12:40 -04:00

netfilter.c

netfilter: use skb_to_full_sk in ip_route_me_harder

2017-02-28 12:49:36 +01:00

ping.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

proc.c

tcp: Revert "tcp: remove header prediction"

2017-08-30 11:20:09 -07:00

protocol.c

net: Add sysctl to toggle early demux for tcp and udp

2017-03-24 13:17:07 -07:00

raw_diag.c

net: ipv6: add second dif to raw socket lookups

2017-08-07 11:39:22 -07:00

raw.c

net: ipv4: add second dif to multicast source filter

2017-08-07 11:39:22 -07:00

route.c

ipv4: Fix traffic triggered IPsec connections.

2017-10-09 09:39:50 -07:00

syncookies.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

sysctl_net_ipv4.c

tcp: remove low_latency sysctl

2017-07-31 14:37:49 -07:00

tcp_bbr.c

tcp_bbr: init pacing rate on first RTT sample

2017-07-15 14:43:29 -07:00

tcp_bic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_cdg.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_cong.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-01 17:42:05 -07:00

tcp_cubic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_dctcp.c

Revert "dctcp: update cwnd on congestion event"

2016-12-06 11:34:24 -05:00

tcp_diag.c

tcp_diag: report TCP MD5 signing keys and addresses

2017-09-01 18:38:09 -07:00

tcp_fastopen.c

tcp: Remove the unused parameter for tcp_try_fastopen.

2017-08-22 14:16:12 -07:00

tcp_highspeed.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_htcp.c

tcp: fix cwnd undo in Reno and HTCP congestion controls

2017-08-06 21:25:10 -07:00

tcp_hybla.c

tcp: make undo_cwnd mandatory for congestion modules

2016-11-21 13:20:17 -05:00

tcp_illinois.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_input.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

tcp_ipv4.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

tcp_lp.c

tcp: switch TCP TS option (RFC 7323) to 1ms clock

2017-05-17 16:06:01 -04:00

tcp_metrics.c

tcp: use tcp_jiffies32 to feed tp->snd_cwnd_stamp

2017-05-17 16:06:01 -04:00

tcp_minisocks.c

tcp: Revert "tcp: remove header prediction"

2017-08-30 11:20:09 -07:00

tcp_nv.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_offload.c

net: convert sock.sk_wmem_alloc from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

tcp_output.c

tcp: fastopen: fix on syn-data transmit failure

2017-09-19 16:16:51 -07:00

tcp_probe.c

tcp: remove redundant argument from tcp_rcv_established()

2017-07-24 17:28:12 -07:00

tcp_rate.c

tcp: export do_tcp_sendpages and tcp_rate_check_app_limited functions

2017-06-15 12:12:40 -04:00

tcp_recovery.c

tcp: adjust tail loss probe timeout

2017-07-19 16:14:10 -07:00

tcp_scalable.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_timer.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-08-09 16:28:45 -07:00

tcp_ulp.c

tcp: ulp: avoid module refcnt leak in tcp_set_ulp

2017-08-14 22:17:05 -07:00

tcp_vegas.c

tcp: make undo_cwnd mandatory for congestion modules

2016-11-21 13:20:17 -05:00

tcp_vegas.h

…

tcp_veno.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_westwood.c

tcp: Revert "tcp: remove CA_ACK_SLOWPATH"

2017-08-30 11:20:08 -07:00

tcp_yeah.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp.c

net: prepare (struct ubuf_info)->refcnt conversion

2017-09-01 20:22:03 -07:00

tunnel4.c

tunnels: correct conditional build of MPLS and IPv6

2016-07-11 13:27:06 -07:00

udp_diag.c

net: ipv6: add second dif to udp socket lookups

2017-08-07 11:39:22 -07:00

udp_impl.h

udp: make *udp*_queue_rcv_skb() functions static

2017-05-18 10:23:33 -04:00

udp_offload.c

gso: fix payload length when gso_size is zero

2017-10-08 10:12:15 -07:00

udp_tunnel.c

net: add infrastructure to un-offload UDP tunnel port

2017-07-24 13:52:59 -07:00

udp.c

udp: fix bcast packet reception

2017-10-09 10:28:25 -07:00

udplite.c

udplite: call proper backlog handlers

2016-11-24 15:32:14 -05:00

xfrm4_input.c

esp: Add a software GRO codepath

2017-02-15 11:04:11 +01:00

xfrm4_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm4_mode_transport.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm4_mode_tunnel.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm4_output.c

xfrm: Add an IPsec hardware offloading API

2017-04-14 10:06:10 +02:00

xfrm4_policy.c

net: xfrm: support setting an output mark.

2017-08-11 07:03:00 +02:00

xfrm4_protocol.c

xfrm: input: constify xfrm_input_afinfo

2017-02-09 10:22:17 +01:00

xfrm4_state.c

xfrm: remove unused function

2017-01-10 10:57:12 +01:00

xfrm4_tunnel.c

…