linux/net
Eric Dumazet 9f29f6f8da tcp: make sure treq->af_specific is initialized
[ Upstream commit ba5a4fdd63 ]

syzbot complained about a recent change in TCP stack,
hitting a NULL pointer [1]

tcp request sockets have an af_specific pointer, which
was used before the blamed change only for SYNACK generation
in non SYNCOOKIE mode.

tcp requests sockets momentarily created when third packet
coming from client in SYNCOOKIE mode were not using
treq->af_specific.

Make sure this field is populated, in the same way normal
TCP requests sockets do in tcp_conn_request().

[1]
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534
Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48
RSP: 0018:ffffc90000de0588 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100
RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008
RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0
R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267
 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207
 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258
 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline]
 tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486
 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725
 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422
 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473
 dst_input include/net/dst.h:461 [inline]
 ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405
 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519
 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847
 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413
 napi_poll net/core/dev.c:6480 [inline]
 net_rx_action+0x8ec/0xc60 net/core/dev.c:6567
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097

Fixes: 5b0b9e4c2c ("tcp: md5: incorrect tcp_header_len for incoming connections")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-09 09:05:04 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-09-15 09:50:34 +02:00
9p xen/9p: use alloc/free_pages_exact() 2022-03-11 12:11:54 +01:00
802 net/802/garp: fix memleak in garp_request_join() 2021-07-31 08:16:11 +02:00
8021q net: vlan: fix underflow for the real_dev refcnt 2021-12-01 09:19:08 +01:00
appletalk
atm
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-20 09:23:32 +02:00
batman-adv ipv6: make mc_forwarding atomic 2022-04-13 21:00:56 +02:00
bluetooth Bluetooth: Fix use after free in hci_send_acl 2022-04-13 21:01:00 +02:00
bpf bpf, test, cgroup: Use sk_{alloc,free} for test cases 2021-10-27 09:56:56 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-07-14 16:56:29 +02:00
bridge net: bridge: vlan: fix memory leak in __allowed_ingress 2022-02-01 17:25:48 +01:00
caif net-caif: avoid user-triggerable WARN_ON(1) 2021-09-22 12:27:56 +02:00
can can: isotp: stop timeout monitoring when no first frame was sent 2022-04-27 13:53:57 +02:00
ceph
core bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook 2022-05-09 09:05:02 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:09:37 +01:00
dccp tcp: switch orphan_count to bare per-cpu counters 2021-11-18 14:04:08 +01:00
decnet net: decnet: Fix sleeping inside in af_decnet 2021-07-28 14:35:38 +02:00
dns_resolver
dsa net: dsa: Add missing of_node_put() in dsa_port_link_register_of 2022-05-09 09:05:02 +02:00
ethernet
ethtool ethtool: do not perform operations on net devices being unregistered 2021-12-17 10:14:41 +01:00
hsr net: hsr: fix mac_len checks 2021-06-03 09:00:50 +02:00
ieee802154 net: ieee802154: Return meaningful error codes from the netlink helpers 2022-02-08 18:30:37 +01:00
ife
ipv4 tcp: make sure treq->af_specific is initialized 2022-05-09 09:05:04 +02:00
ipv6 tcp: make sure treq->af_specific is initialized 2022-05-09 09:05:04 +02:00
iucv
kcm
key af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register 2022-04-08 14:39:48 +02:00
l2tp net/l2tp: Fix reference count leak in l2tp_udp_recv_core 2021-09-22 12:27:56 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 13:53:50 +02:00
lapb
llc llc: only change llc->dev when bind() succeeds 2022-03-28 09:57:10 +02:00
mac80211 mac80211: fix potential double free on mesh join 2022-03-28 09:57:10 +02:00
mac802154
mpls net: mpls: Fix notifications when deleting a device 2021-12-08 09:03:23 +01:00
mptcp mptcp: clear 'kern' flag from fallback sockets 2021-12-22 09:30:54 +01:00
ncsi net/ncsi: check for error return from call to nla_put_u32 2022-01-05 12:40:32 +01:00
netfilter netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion 2022-05-09 09:05:02 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-13 21:01:00 +02:00
netlink netlink: reset network and mac headers in netlink_dump() 2022-04-27 13:53:51 +02:00
netrom netrom: fix api breakage in nr_setsockopt() 2022-01-27 10:54:03 +01:00
nfc nfc: nci: add flush_workqueue to prevent uaf 2022-04-20 09:23:18 +02:00
nsh
openvswitch openvswitch: fix OOB access in reserve_sfa_size() 2022-04-27 13:53:55 +02:00
packet net/packet: fix packet_sock xmit return value checking 2022-04-27 13:53:50 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:25:01 +01:00
psample
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 10:09:21 +02:00
rds rds: memory leak in __rds_conn_create() 2021-12-22 09:30:54 +01:00
rfkill
rose
rxrpc rxrpc: Restore removed timer deletion 2022-04-27 13:53:49 +02:00
sched net/sched: cls_u32: fix possible leak in u32_init_knode() 2022-04-27 13:53:50 +02:00
sctp sctp: check asoc strreset_chunk in sctp_generate_reconf_event 2022-05-09 09:05:03 +02:00
smc net/smc: sync err code when tcp connection was refused 2022-05-09 09:05:04 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 14:04:27 +01:00
sunrpc SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() 2022-04-13 21:01:07 +02:00
switchdev
tipc tipc: fix the timer expires after interval 100ms 2022-04-08 14:40:23 +02:00
tls net/tls: fix slab-out-of-bounds bug in decrypt_internal 2022-04-13 21:01:04 +02:00
unix af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress 2022-01-27 10:54:31 +01:00
vmw_vsock vsock: each transport cycles only on its own sockets 2022-03-23 09:13:27 +01:00
wimax
wireless nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size 2022-04-20 09:23:28 +02:00
x25 net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-04-08 14:40:30 +02:00
xdp Revert "xsk: Do not sleep in poll() when need_wakeup set" 2021-12-22 09:30:59 +01:00
xfrm xfrm: fix tunnel model fragmentation behavior 2022-04-08 14:39:47 +02:00
compat.c net: Return the correct errno code 2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c ethtool: improve compat ioctl handling 2021-09-18 13:40:21 +02:00
sysctl_net.c