iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
a58015d638
linux/net/mptcp
History
Davide Caratti e7579d5d5b net: mptcp: cap forward allocation to 1M 
the following syzkaller reproducer:

 r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
 bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10)
 connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10)
 sendto$inet(r0, &(0x7f0000000100)="f6", 0xffffffe7, 0xc000, 0x0, 0x0)

systematically triggers the following warning:

 WARNING: CPU: 2 PID: 8618 at net/core/stream.c:208 sk_stream_kill_queues+0x3fa/0x580
 Modules linked in:
 CPU: 2 PID: 8618 Comm: syz-executor Not tainted 5.10.0+ #334
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/04
 RIP: 0010:sk_stream_kill_queues+0x3fa/0x580
 Code: df 48 c1 ea 03 0f b6 04 02 84 c0 74 04 3c 03 7e 40 8b ab 20 02 00 00 e9 64 ff ff ff e8 df f0 81 2
 RSP: 0018:ffffc9000290fcb0 EFLAGS: 00010293
 RAX: ffff888011cb8000 RBX: 0000000000000000 RCX: ffffffff86eecf0e
 RDX: 0000000000000000 RSI: ffffffff86eecf6a RDI: 0000000000000005
 RBP: 0000000000000e28 R08: ffff888011cb8000 R09: fffffbfff1f48139
 R10: ffffffff8fa409c7 R11: fffffbfff1f48138 R12: ffff8880215e6220
 R13: ffffffff8fa409c0 R14: ffffc9000290fd30 R15: 1ffff92000521fa2
 FS:  00007f41c78f4800(0000) GS:ffff88802d000000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f95c803d088 CR3: 0000000025ed2000 CR4: 00000000000006f0
 Call Trace:
  __mptcp_destroy_sock+0x4f5/0x8e0
   mptcp_close+0x5e2/0x7f0
  inet_release+0x12b/0x270
  __sock_release+0xc8/0x270
  sock_close+0x18/0x20
  __fput+0x272/0x8e0
  task_work_run+0xe0/0x1a0
  exit_to_user_mode_prepare+0x1df/0x200
  syscall_exit_to_user_mode+0x19/0x50
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

userspace programs provide arbitrarily high values of 'len' in sendmsg():
this is causing integer overflow of 'amount'. Cap forward allocation to 1
megabyte: higher values are not really useful.

Suggested-by: Paolo Abeni <pabeni@redhat.com>
Fixes: e93da92896 ("mptcp: implement wmem reservation")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://lore.kernel.org/r/3334d00d8b2faecafdfab9aa593efcbf61442756.1608584474.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-12-28 13:53:57 -08:00
..
crypto_test.c mptcp: move crypto test to KUNIT 2020-06-26 16:21:39 -07:00
crypto.c crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
ctrl.c mptcp: add a new sysctl add_addr_timeout 2020-11-04 17:45:53 -08:00
diag.c mptcp: allow dumping subflow context to userspace 2020-03-29 22:14:48 -07:00
Kconfig mptcp: depends on IPV6 but not as a module 2020-10-21 08:05:40 -07:00
Makefile mptcp: enable JOIN requests even if cookies are in use 2020-07-31 16:55:32 -07:00
mib.c mptcp: print new line in mptcp_seq_show() if mptcp isn't in use 2020-12-07 17:45:29 -08:00
mib.h mptcp: add RM_ADDR related mibs 2020-09-24 19:58:34 -07:00
mptcp_diag.c mptcp: avoid a few atomic ops in the rx path 2020-11-30 17:55:23 -08:00
options.c mptcp: push pending frames when subflow has free space 2020-12-17 10:24:47 -08:00
pm_netlink.c mptcp: pm: simplify select_local_address() 2020-12-14 17:30:06 -08:00
pm.c mptcp: link MPC subflow into msk only after accept 2020-12-09 19:31:58 -08:00
protocol.c net: mptcp: cap forward allocation to 1M 2020-12-28 13:53:57 -08:00
protocol.h mptcp: push pending frames when subflow has free space 2020-12-17 10:24:47 -08:00
subflow.c Networking updates for 5.11 2020-12-15 13:22:29 -08:00
syncookies.c mptcp: fix syncookie build error on UP 2020-08-01 11:52:55 -07:00
token_test.c mptcp: introduce token KUNIT self-tests 2020-06-26 16:21:39 -07:00
token.c mptcp: token: fix unititialized variable 2020-11-03 13:08:30 -08:00