From: Jakub Kicinski <kuba@kernel.org>
To: Florian Westphal <fw@strlen.de>
Cc: <mptcp@lists.linux.dev>,
syzkaller-bugs@googlegroups.com, <netdev@vger.kernel.org>,
linux-kernel@vger.kernel.org,
syzbot+1fd9b69cde42967d1add@syzkaller.appspotmail.com
Subject: Re: [PATCH mptcp] mptcp: remove tcp ulp setsockopt support
Date: Mon, 6 Dec 2021 07:55:15 -0800 [thread overview]
Message-ID: <20211206075515.3cf5b0df@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com> (raw)
In-Reply-To: <20211206075326.700f2078@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
On Mon, 6 Dec 2021 07:53:26 -0800 Jakub Kicinski wrote:
> On Sun, 5 Dec 2021 20:27:00 +0100 Florian Westphal wrote:
> > TCP_ULP setsockopt cannot be used for mptcp because its already
> > used internally to plumb subflow (tcp) sockets to the mptcp layer.
> >
> > syzbot managed to trigger a crash for mptcp connections that are
> > in fallback mode:
>
> Fallback mode meaning ops are NULL? I'm slightly confused by this
> report.
Ah, it's the socket not the ops.
> > KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
> > CPU: 1 PID: 1083 Comm: syz-executor.3 Not tainted 5.16.0-rc2-syzkaller #0
> > RIP: 0010:tls_build_proto net/tls/tls_main.c:776 [inline]
> > [..]
> > __tcp_set_ulp net/ipv4/tcp_ulp.c:139 [inline]
> > tcp_set_ulp+0x428/0x4c0 net/ipv4/tcp_ulp.c:160
> > do_tcp_setsockopt+0x455/0x37c0 net/ipv4/tcp.c:3391
> > mptcp_setsockopt+0x1b47/0x2400 net/mptcp/sockopt.c:638
> >
> > Remove support for TCP_ULP setsockopt.
> >
> > Reported-by: syzbot+1fd9b69cde42967d1add@syzkaller.appspotmail.com
> > Signed-off-by: Florian Westphal <fw@strlen.de>
next prev parent reply other threads:[~2021-12-06 15:55 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-04 9:20 [syzbot] general protection fault in tls_init syzbot
2021-12-05 19:27 ` [PATCH mptcp] mptcp: remove tcp ulp setsockopt support Florian Westphal
2021-12-06 9:44 ` Matthieu Baerts
2021-12-06 10:58 ` Florian Westphal
2021-12-06 18:47 ` Mat Martineau
2021-12-07 13:23 ` Matthieu Baerts
2021-12-06 15:53 ` Jakub Kicinski
2021-12-06 15:55 ` Jakub Kicinski [this message]
2021-12-06 18:44 ` Mat Martineau
2021-12-06 18:57 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211206075515.3cf5b0df@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com \
--to=kuba@kernel.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=syzbot+1fd9b69cde42967d1add@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.