asgardius/android_kernel_motorola_sm6225
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_motorola_sm6225/net/ipv4
History
Kuniyuki Iwashima 8223c97c9e tcp: Fix potential use-after-free due to double kfree() 
commit c89dffc70b340780e5b933832d8c3e045ef3791e upstream.

Receiving ACK with a valid SYN cookie, cookie_v4_check() allocates struct
request_sock and then can allocate inet_rsk(req)->ireq_opt. After that,
tcp_v4_syn_recv_sock() allocates struct sock and copies ireq_opt to
inet_sk(sk)->inet_opt. Normally, tcp_v4_syn_recv_sock() inserts the full
socket into ehash and sets NULL to ireq_opt. Otherwise,
tcp_v4_syn_recv_sock() has to reset inet_opt by NULL and free the full
socket.

The commit 01770a1661657 ("tcp: fix race condition when creating child
sockets from syncookies") added a new path, in which more than one cores
create full sockets for the same SYN cookie. Currently, the core which
loses the race frees the full socket without resetting inet_opt, resulting
in that both sock_put() and reqsk_put() call kfree() for the same memory:

  sock_put
    sk_free
      __sk_free
        sk_destruct
          __sk_destruct
            sk->sk_destruct/inet_sock_destruct
              kfree(rcu_dereference_protected(inet->inet_opt, 1));

  reqsk_put
    reqsk_free
      __reqsk_free
        req->rsk_ops->destructor/tcp_v4_reqsk_destructor
          kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1));

Calling kmalloc() between the double kfree() can lead to use-after-free, so
this patch fixes it by setting NULL to inet_opt before sock_put().

As a side note, this kind of issue does not happen for IPv6. This is
because tcp_v6_syn_recv_sock() clones both ipv6_opt and pktopts which
correspond to ireq_opt in IPv4.

Fixes: 01770a166165 ("tcp: fix race condition when creating child sockets from syncookies")
CC: Ricardo Dias <rdias@singlestore.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Reviewed-by: Benjamin Herrenschmidt <benh@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20210118055920.82516-1-kuniyu@amazon.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-27 13:39:42 +02:00
..
bpfilter bpfilter: remove trailing newline 2018-07-24 14:10:42 -07:00
netfilter netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() 2022-01-27 09:04:20 +01:00
af_inet.c gso: do not skip outer ip header in case of ipip and net_failover 2022-03-02 11:38:12 +01:00
ah4.c net: use -ENOSPC for transient busy indication 2017-11-03 22:11:17 +08:00
arp.c ipv4: Invalidate neighbour for broadcast address upon address addition 2022-04-15 14:15:01 +02:00
cipso_ipv4.c net: ipv4: fix memory leak in netlbl_cipsov4_add_std 2021-06-30 08:48:15 -04:00
datagram.c inet: stop leaking jiffies on the wire 2019-11-10 11:27:37 +01:00
devinet.c net: return correct error code 2021-12-08 08:50:11 +01:00
esp4.c esp: Fix possible buffer overflow in ESP transformation 2022-03-28 08:41:42 +02:00
esp4_offload.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2018-07-27 09:33:37 -07:00
fib_frontend.c ipv4: Invalidate neighbour for broadcast address upon address addition 2022-04-15 14:15:01 +02:00
fib_lookup.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_notifier.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_rules.c net: fib_rules: add extack support 2018-04-23 10:21:24 -04:00
fib_semantics.c net: Fix the arp error in some cases 2020-06-30 23:17:06 -04:00
fib_trie.c ipv4: Silence suspicious RCU usage warning 2020-08-11 15:32:34 +02:00
fou.c net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv 2019-04-27 09:36:31 +02:00
gre_demux.c erspan: fix version 1 check in gre_parse_header() 2021-01-12 20:10:19 +01:00
gre_offload.c net: gre: recompute gre csum for sctp over gre tunnels 2020-08-11 15:32:34 +02:00
icmp.c ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) 2021-09-22 11:47:47 +02:00
igmp.c igmp: Add ip_mc_list lock in ip_check_mc_rcu 2021-09-22 11:47:47 +02:00
inet_connection_sock.c tcp: fix race condition when creating child sockets from syncookies 2022-04-27 13:39:42 +02:00
inet_diag.c inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() 2020-11-24 13:27:16 +01:00
inet_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:36:33 +02:00
inet_hashtables.c tcp: fix race condition when creating child sockets from syncookies 2022-04-27 13:39:42 +02:00
inet_timewait_sock.c soreuseport: initialise timewait reuseport field 2018-04-07 22:32:32 -04:00
inetpeer.c inetpeer: fix data-race in inet_putpeer / inet_putpeer 2020-01-04 19:13:29 +01:00
ip_forward.c net: clear skb->tstamp in forwarding paths 2019-01-09 17:38:31 +01:00
ip_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:36:33 +02:00
ip_gre.c ip_gre: validate csum_start only on pull 2021-09-22 11:48:14 +02:00
ip_input.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:38:42 +02:00
ip_options.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:38:42 +02:00
ip_output.c ipv4: tcp: send zero IPID in SYNACK messages 2022-02-08 18:23:11 +01:00
ip_sockglue.c net: bpfilter: fix iptables failure if bpfilter_umh is disabled 2019-12-01 09:17:18 +01:00
ip_tunnel.c net: ip_tunnel: fix mtu calculation for ETHER tunnel devices 2021-07-28 11:13:46 +02:00
ip_tunnel_core.c ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL 2019-08-04 09:30:57 +02:00
ip_vti.c ip_vti: receive ipip packet by calling ip_tunnel_rcv 2020-06-03 08:19:46 +02:00
ipcomp.c
ipconfig.c net: ipconfig: Don't override command-line hostnames or domains 2021-06-30 08:48:13 -04:00
ipip.c net: ipip: fix wrong address family in init error path 2020-06-03 08:19:10 +02:00
ipmr.c ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path 2022-02-16 12:51:45 +01:00
ipmr_base.c net: ipmr: fix unresolved entry dumps 2018-10-17 22:35:42 -07:00
Kconfig vti[6]: fix packet tx through bpf_redirect() in XinY cases 2020-04-02 15:28:18 +02:00
Makefile net: remove blank lines at end of file 2018-07-24 14:10:43 -07:00
metrics.c net: metrics: add proper netlink validation 2018-06-05 12:29:43 -04:00
netfilter.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-11-18 19:18:44 +01:00
netlink.c ipv4: Add ICMPv6 support when parse route ipproto 2019-03-10 07:17:17 +01:00
ping.c ping: remove pr_err from ping_lookup 2022-03-02 11:38:11 +01:00
proc.c tcp: tcp_fragment() should apply sane memory limits 2019-06-17 19:51:56 +02:00
protocol.c
raw.c net: add missing SOF_TIMESTAMPING_OPT_ID support 2022-04-15 14:15:04 +02:00
raw_diag.c inet_diag: return classid for all socket types 2020-03-18 07:14:11 +01:00
route.c ipv4: use siphash instead of Jenkins in fnhe_hashfun() 2021-11-02 18:26:44 +01:00
syncookies.c net: Update window_clamp if SOCK_RCVBUF is set 2020-11-18 19:18:51 +01:00
sysctl_net_ipv4.c tcp: add tcp_min_snd_mss sysctl 2019-06-17 19:51:56 +02:00
tcp.c tcp: make tcp_read_sock() more robust 2022-03-23 09:10:41 +01:00
tcp_bbr.c tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets 2021-08-26 08:36:39 -04:00
tcp_bic.c
tcp_cdg.c tcp: cdg: make struct tcp_cdg static 2017-10-16 21:24:25 +01:00
tcp_cong.c net: Only allow init netns to set default tcp cong to a restricted algo 2021-05-22 10:59:39 +02:00
tcp_cubic.c tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows 2021-12-01 09:27:43 +01:00
tcp_dctcp.c tcp: Ensure DCTCP reacts to losses 2019-04-17 08:38:41 +02:00
tcp_diag.c tcp: annotate tp->write_seq lockless reads 2021-03-17 16:43:43 +01:00
tcp_fastopen.c tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD 2021-09-22 11:48:07 +02:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c net/tcp/illinois: replace broken algorithm reference link 2018-02-28 12:03:47 -05:00
tcp_input.c tcp: address problems caused by EDT misshaps 2021-10-06 15:31:19 +02:00
tcp_ipv4.c tcp: Fix potential use-after-free due to double kfree() 2022-04-27 13:39:42 +02:00
tcp_lp.c
tcp_metrics.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
tcp_minisocks.c tcp: relookup sock for RST+ACK packets handled by obsolete req sock 2021-04-07 12:48:47 +02:00
tcp_nv.c tcp_nv: fix potential integer overflow in tcpnv_acked 2018-01-31 10:26:30 -05:00
tcp_offload.c tcp: Don't coalesce decrypted and encrypted SKBs 2018-07-16 00:12:09 -07:00
tcp_output.c tcp: ensure PMTU updates are processed during fastopen 2022-04-15 14:14:50 +02:00
tcp_rate.c tcp: expose both send and receive intervals for rate sample 2018-07-11 23:01:56 -07:00
tcp_recovery.c tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN 2021-02-03 23:23:27 +01:00
tcp_scalable.c
tcp_timer.c tcp: adjust rto_base in retransmits_timed_out() 2021-10-06 15:31:20 +02:00
tcp_ulp.c tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach 2018-08-16 14:58:08 -07:00
tcp_vegas.c tcp: fix under-evaluated ssthresh in TCP Vegas 2017-09-29 06:07:00 +01:00
tcp_vegas.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c inet: whitespace cleanup 2018-02-28 11:43:28 -05:00
udp.c net: udp: fix alignment problem in udp4_seq_show() 2022-01-11 13:58:50 +01:00
udp_diag.c inet_diag: return classid for all socket types 2020-03-18 07:14:11 +01:00
udp_impl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udp_offload.c net: Fix gro aggregation for udp encaps with zero csum 2021-03-17 16:43:42 +01:00
udp_tunnel.c
udplite.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
xfrm4_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm4_mode_tunnel.c xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto 2018-03-07 10:54:29 +01:00
xfrm4_output.c xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish 2020-04-29 16:31:23 +02:00
xfrm4_policy.c xfrm: Don't accidentally set RTO_ONLINK in decode_session4() 2022-02-23 11:58:39 +01:00
xfrm4_protocol.c
xfrm4_state.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xfrm4_tunnel.c