Kuniyuki Iwashima
ee8cd3abe7
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
commit 62ec33b44e0f7168ff2886520fec6fb62d03b5a3 upstream.
Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove
inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering
WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2]
Also, we can reproduce it by a program in [3].
In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy()
to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in
inet_csk_destroy_sock().
The same check has been in inet_sock_destruct() from at least v2.6,
we can just remove the WARN_ON_ONCE(). However, among the users of
sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct().
Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor().
[0]: https://lore.kernel.org/netdev/39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com/
[1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341
[2]:
WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0
Modules linked in:
CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0
Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9
RSP: 0018:ffff88810570fc68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005
RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488
R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458
FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0
Call Trace:
<TASK>
inet_csk_destroy_sock+0x1a1/0x320
__tcp_close+0xab6/0xe90
tcp_close+0x30/0xc0
inet_release+0xe9/0x1f0
inet6_release+0x4c/0x70
__sock_release+0xd2/0x280
sock_close+0x15/0x20
__fput+0x252/0xa20
task_work_run+0x169/0x250
exit_to_user_mode_prepare+0x113/0x120
syscall_exit_to_user_mode+0x1d/0x40
do_syscall_64+0x48/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f7fdf7ae28d
Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f
R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000
R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8
</TASK>
[3]: https://lore.kernel.org/netdev/20230208004245.83497-1-kuniyu@amazon.com/
Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Christoph Paasch <christophpaasch@icloud.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2023-03-03 11:41:48 +01:00 |
| .. |
|
6lowpan
|
6lowpan: iphc: Fix an off-by-one check of array index
|
2021-09-15 09:47:31 +02:00 |
|
9p
|
9p/xen: check logical size for buffer size
|
2022-12-14 11:30:41 +01:00 |
|
802
|
mrp: introduce active flags to prevent UAF when applicant uninit
|
2023-01-18 11:41:37 +01:00 |
|
8021q
|
net: vlan: fix underflow for the real_dev refcnt
|
2021-12-01 09:23:34 +01:00 |
|
appletalk
|
|
|
|
atm
|
net/atm: fix proc_mpc_write incorrect return value
|
2022-10-29 10:20:35 +02:00 |
|
ax25
|
ax25: Fix UAF bugs in ax25 timers
|
2022-04-20 09:19:40 +02:00 |
|
batman-adv
|
batman-adv: Don't skb_split skbuffs with frag_list
|
2022-05-18 09:47:24 +02:00 |
|
bluetooth
|
Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
|
2023-02-06 07:52:51 +01:00 |
|
bpf
|
bpf: Move skb->len == 0 checks into __bpf_redirect
|
2023-01-18 11:41:04 +01:00 |
|
bpfilter
|
|
|
|
bridge
|
netfilter: br_netfilter: disable sabotage_in hook after first suppression
|
2023-02-22 12:50:24 +01:00 |
|
caif
|
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
|
2023-03-03 11:41:48 +01:00 |
|
can
|
can: j1939: do not wait 250 ms if the same addr was already claimed
|
2023-02-22 12:50:30 +01:00 |
|
ceph
|
|
|
|
core
|
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
|
2023-03-03 11:41:48 +01:00 |
|
dcb
|
net: dcb: disable softirqs in dcbnl_flush_dev()
|
2022-03-08 19:07:51 +01:00 |
|
dccp
|
dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
|
2023-02-22 12:50:40 +01:00 |
|
decnet
|
net: decnet: Fix sleeping inside in af_decnet
|
2021-07-28 13:30:56 +02:00 |
|
dns_resolver
|
|
|
|
dsa
|
net: dsa: ksz: Check return value
|
2022-12-14 11:30:45 +01:00 |
|
ethernet
|
|
|
|
hsr
|
hsr: Avoid double remove of a node.
|
2023-01-18 11:41:09 +01:00 |
|
ieee802154
|
net: ieee802154: fix error return code in dgram_bind()
|
2022-11-03 23:56:54 +09:00 |
|
ife
|
|
|
|
ipv4
|
ipv4: Fix incorrect route flushing when source address is deleted
|
2023-02-22 12:50:38 +01:00 |
|
ipv6
|
ipv6: Fix tcp socket connection with DSCP.
|
2023-02-22 12:50:41 +01:00 |
|
iucv
|
|
|
|
kcm
|
kcm: close race conditions on sk_receive_queue
|
2022-11-25 17:42:21 +01:00 |
|
key
|
af_key: Fix send_acquire race with pfkey_register
|
2022-12-08 11:22:57 +01:00 |
|
l2tp
|
l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
|
2023-02-06 07:52:38 +01:00 |
|
l3mdev
|
l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
|
2022-04-27 13:50:47 +02:00 |
|
lapb
|
|
|
|
llc
|
llc: only change llc->dev when bind() succeeds
|
2022-03-28 08:46:48 +02:00 |
|
mac80211
|
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
|
2023-02-25 11:53:26 +01:00 |
|
mac802154
|
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
|
2022-12-14 11:30:45 +01:00 |
|
mpls
|
net: mpls: fix stale pointer if allocation fails during device rename
|
2023-02-22 12:50:41 +01:00 |
|
ncsi
|
net/ncsi: check for error return from call to nla_put_u32
|
2022-01-05 12:37:45 +01:00 |
|
netfilter
|
netfilter: nft_tproxy: restrict to prerouting hook
|
2023-02-22 12:50:35 +01:00 |
|
netlabel
|
netlabel: fix out-of-bounds memory accesses
|
2022-04-15 14:18:35 +02:00 |
|
netlink
|
netlink: annotate data races around sk_state
|
2023-02-06 07:52:45 +01:00 |
|
netrom
|
netrom: Fix use-after-free caused by accept on already connected socket
|
2023-02-22 12:50:24 +01:00 |
|
nfc
|
net: nfc: Fix use-after-free in local_cleanup()
|
2023-02-06 07:52:37 +01:00 |
|
nsh
|
|
|
|
openvswitch
|
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
|
2023-02-22 12:50:25 +01:00 |
|
packet
|
net/af_packet: make sure to pull mac header
|
2023-01-18 11:41:45 +01:00 |
|
phonet
|
phonet: refcount leak in pep_sock_accep
|
2022-01-11 15:23:33 +01:00 |
|
psample
|
|
|
|
qrtr
|
net: qrtr: fix another OOB Read in qrtr_endpoint_post
|
2021-09-03 10:08:12 +02:00 |
|
rds
|
rds: rds_rm_zerocopy_callback() use list_first_entry()
|
2023-02-22 12:50:32 +01:00 |
|
rfkill
|
|
|
|
rose
|
net/rose: Fix to not accept on connected socket
|
2023-02-22 12:50:34 +01:00 |
|
rxrpc
|
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
|
2023-01-18 11:41:33 +01:00 |
|
sched
|
Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
|
2023-02-25 11:53:27 +01:00 |
|
sctp
|
sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
|
2023-02-22 12:50:40 +01:00 |
|
smc
|
net/smc: Remove redundant refcount increase
|
2022-09-15 12:04:50 +02:00 |
|
strparser
|
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
|
2021-11-17 09:48:48 +01:00 |
|
sunrpc
|
xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
|
2023-02-22 12:50:29 +01:00 |
|
switchdev
|
net: switchdev: do not propagate bridge updates across bridges
|
2021-10-27 09:54:24 +02:00 |
|
tipc
|
tipc: call tipc_lxc_xmit without holding node_read_lock
|
2023-01-18 11:42:06 +01:00 |
|
tls
|
net/tls: Fix race in TLS device down flow
|
2022-07-29 17:14:12 +02:00 |
|
unix
|
af_unix: Get user_ns from in_skb in unix_diag_get_exact().
|
2022-12-14 11:30:44 +01:00 |
|
vmw_vsock
|
net: vmw_vsock: vmci: Check memcpy_from_msg()
|
2023-01-18 11:41:13 +01:00 |
|
wimax
|
|
|
|
wireless
|
wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
|
2023-01-18 11:41:08 +01:00 |
|
x25
|
net/x25: Fix to not accept on connected socket
|
2023-02-22 12:50:26 +01:00 |
|
xdp
|
Revert "xsk: Do not sleep in poll() when need_wakeup set"
|
2021-12-22 09:29:40 +01:00 |
|
xfrm
|
xfrm: fix bug with DSCP copy to v6 from v4 tunnel
|
2023-02-22 12:50:31 +01:00 |
|
compat.c
|
|
|
|
Kconfig
|
|
|
|
Makefile
|
|
|
|
socket.c
|
net: Fix a data-race around sysctl_somaxconn.
|
2022-09-05 10:27:42 +02:00 |
|
sysctl_net.c
|
|
|