From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
David Ahern <dsahern@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@mandriva.com>,
Joanne Koong <joannelkoong@gmail.com>,
Martin KaFai Lau <martin.lau@kernel.org>,
"Mat Martineau" <mathew.j.martineau@linux.intel.com>,
"Ziyang Xuan (William)" <william.xuanziyang@huawei.com>,
Stephen Hemminger <stephen@networkplumber.org>,
Pengfei Xu <pengfei.xu@intel.com>,
"Kuniyuki Iwashima" <kuniyu@amazon.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>, <netdev@vger.kernel.org>,
<dccp@vger.kernel.org>
Subject: [PATCH v4 net 0/4] dccp/tcp: Fix bhash2 issues related to WARN_ON() in inet_csk_get_port().
Date: Fri, 18 Nov 2022 17:49:10 -0800 [thread overview]
Message-ID: <20221119014914.31792-1-kuniyu@amazon.com> (raw)
syzkaller was hitting a WARN_ON() in inet_csk_get_port() in the 4th patch,
which was because we forgot to fix up bhash2 bucket when connect() for a
socket bound to a wildcard address fails in __inet_stream_connect().
There was a similar report [0], but its repro does not fire the WARN_ON() due
to inconsistent error handling.
When connect() for a socket bound to a wildcard address fails, saddr may or
may not be reset depending on where the failure happens. When we fail in
__inet_stream_connect(), sk->sk_prot->disconnect() resets saddr. OTOH, in
(dccp|tcp)_v[46]_connect(), if we fail after inet_hash6?_connect(), we
forget to reset saddr.
We fix this inconsistent error handling in the 1st patch, and then we'll
fix the bhash2 WARN_ON() issue.
Note that there is still an issue in that we reset saddr without checking
if there are conflicting sockets in bhash and bhash2, but this should be
another series.
See [1][2] for the previous discussion.
[0]: https://lore.kernel.org/netdev/0000000000003f33bc05dfaf44fe@google.com/
[1]: https://lore.kernel.org/netdev/20221029001249.86337-1-kuniyu@amazon.com/
[2]: https://lore.kernel.org/netdev/20221103172419.20977-1-kuniyu@amazon.com/
[3]: https://lore.kernel.org/netdev/20221118081906.053d5231@kernel.org/T/#m00aafedb29ff0b55d5e67aef0252ef1baaf4b6ee
Changes:
v4:
* Patch 3
* Narrow down the bhash lock section (Joanne Koong)
v3: https://lore.kernel.org/netdev/20221118205839.14312-1-kuniyu@amazon.com/
* Patch 3
* Update saddr under the bhash's lock
* Correct Fixes tag
* Change #ifdef in inet_update_saddr() along the recent
discussion [3]
v2: https://lore.kernel.org/netdev/20221116222805.64734-1-kuniyu@amazon.com/
* Add patch 2-4
v1: [2]
Kuniyuki Iwashima (4):
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
dccp/tcp: Remove NULL check for prev_saddr in
inet_bhash2_update_saddr().
dccp/tcp: Update saddr under bhash's lock.
dccp/tcp: Fixup bhash2 bucket when connect() fails.
include/net/inet_hashtables.h | 3 +-
net/dccp/ipv4.c | 23 +++-------
net/dccp/ipv6.c | 24 +++-------
net/dccp/proto.c | 3 +-
net/ipv4/af_inet.c | 11 +----
net/ipv4/inet_hashtables.c | 84 ++++++++++++++++++++++++++++++-----
net/ipv4/tcp.c | 3 +-
net/ipv4/tcp_ipv4.c | 21 +++------
net/ipv6/tcp_ipv6.c | 20 ++-------
9 files changed, 96 insertions(+), 96 deletions(-)
--
2.30.2
next reply other threads:[~2022-11-19 1:58 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-19 1:49 Kuniyuki Iwashima [this message]
2022-11-19 1:49 ` [PATCH v4 net 1/4] dccp/tcp: Reset saddr on failure after inet6?_hash_connect() Kuniyuki Iwashima
2022-11-19 1:49 ` [PATCH v4 net 2/4] dccp/tcp: Remove NULL check for prev_saddr in inet_bhash2_update_saddr() Kuniyuki Iwashima
2022-11-19 1:49 ` [PATCH v4 net 3/4] dccp/tcp: Update saddr under bhash's lock Kuniyuki Iwashima
2022-11-22 0:11 ` Joanne Koong
2022-11-19 1:49 ` [PATCH v4 net 4/4] dccp/tcp: Fixup bhash2 bucket when connect() fails Kuniyuki Iwashima
2022-11-21 23:41 ` Joanne Koong
2022-11-22 0:50 ` Kuniyuki Iwashima
2022-11-22 17:54 ` Joanne Koong
2022-11-22 17:54 ` [PATCH v4 net 0/4] dccp/tcp: Fix bhash2 issues related to WARN_ON() in inet_csk_get_port() Eric Dumazet
2022-11-23 5:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221119014914.31792-1-kuniyu@amazon.com \
--to=kuniyu@amazon.com \
--cc=acme@mandriva.com \
--cc=davem@davemloft.net \
--cc=dccp@vger.kernel.org \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=joannelkoong@gmail.com \
--cc=kuba@kernel.org \
--cc=kuni1840@gmail.com \
--cc=martin.lau@kernel.org \
--cc=mathew.j.martineau@linux.intel.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pengfei.xu@intel.com \
--cc=stephen@networkplumber.org \
--cc=william.xuanziyang@huawei.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).