From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alexander Potapenko <glider@google.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 23/58] ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
Date: Wed, 9 Aug 2017 12:41:35 -0700 [thread overview]
Message-ID: <20170809194147.422281429@linuxfoundation.org> (raw)
In-Reply-To: <20170809194146.501519882@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 18bcf2907df935981266532e1e0d052aff2e6fae ]
KMSAN reported use of uninitialized memory in skb_set_hash_from_sk(),
which originated from the TCP request socket created in
cookie_v6_check():
==================================================================
BUG: KMSAN: use of uninitialized memory in tcp_transmit_skb+0xf77/0x3ec0
CPU: 1 PID: 2949 Comm: syz-execprog Not tainted 4.11.0-rc5+ #2931
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
TCP: request_sock_TCPv6: Possible SYN flooding on port 20028. Sending cookies. Check SNMP counters.
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
skb_set_hash_from_sk ./include/net/sock.h:2011
tcp_transmit_skb+0xf77/0x3ec0 net/ipv4/tcp_output.c:983
tcp_send_ack+0x75b/0x830 net/ipv4/tcp_output.c:3493
tcp_delack_timer_handler+0x9a6/0xb90 net/ipv4/tcp_timer.c:284
tcp_delack_timer+0x1b0/0x310 net/ipv4/tcp_timer.c:309
call_timer_fn+0x240/0x520 kernel/time/timer.c:1268
expire_timers kernel/time/timer.c:1307
__run_timers+0xc13/0xf10 kernel/time/timer.c:1601
run_timer_softirq+0x36/0xa0 kernel/time/timer.c:1614
__do_softirq+0x485/0x942 kernel/softirq.c:284
invoke_softirq kernel/softirq.c:364
irq_exit+0x1fa/0x230 kernel/softirq.c:405
exiting_irq+0xe/0x10 ./arch/x86/include/asm/apic.h:657
smp_apic_timer_interrupt+0x5a/0x80 arch/x86/kernel/apic/apic.c:966
apic_timer_interrupt+0x86/0x90 arch/x86/entry/entry_64.S:489
RIP: 0010:native_restore_fl ./arch/x86/include/asm/irqflags.h:36
RIP: 0010:arch_local_irq_restore ./arch/x86/include/asm/irqflags.h:77
RIP: 0010:__msan_poison_alloca+0xed/0x120 mm/kmsan/kmsan_instr.c:440
RSP: 0018:ffff880024917cd8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000246 RBX: ffff8800224c0000 RCX: 0000000000000005
RDX: 0000000000000004 RSI: ffff880000000000 RDI: ffffea0000b6d770
RBP: ffff880024917d58 R08: 0000000000000dd8 R09: 0000000000000004
R10: 0000160000000000 R11: 0000000000000000 R12: ffffffff85abf810
R13: ffff880024917dd8 R14: 0000000000000010 R15: ffffffff81cabde4
</IRQ>
poll_select_copy_remaining+0xac/0x6b0 fs/select.c:293
SYSC_select+0x4b4/0x4e0 fs/select.c:653
SyS_select+0x76/0xa0 fs/select.c:634
entry_SYSCALL_64_fastpath+0x13/0x94 arch/x86/entry/entry_64.S:204
RIP: 0033:0x4597e7
RSP: 002b:000000c420037ee0 EFLAGS: 00000246 ORIG_RAX: 0000000000000017
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004597e7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 000000c420037ef0 R08: 000000c420037ee0 R09: 0000000000000059
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000042dc20
R13: 00000000000000f3 R14: 0000000000000030 R15: 0000000000000003
chained origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_save_stack mm/kmsan/kmsan.c:317
kmsan_internal_chain_origin+0x12a/0x1f0 mm/kmsan/kmsan.c:547
__msan_store_shadow_origin_4+0xac/0x110 mm/kmsan/kmsan_instr.c:259
tcp_create_openreq_child+0x709/0x1ae0 net/ipv4/tcp_minisocks.c:472
tcp_v6_syn_recv_sock+0x7eb/0x2a30 net/ipv6/tcp_ipv6.c:1103
tcp_get_cookie_sock+0x136/0x5f0 net/ipv4/syncookies.c:212
cookie_v6_check+0x17a9/0x1b50 net/ipv6/syncookies.c:245
tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:989
tcp_v6_do_rcv+0xdd8/0x1c60 net/ipv6/tcp_ipv6.c:1298
tcp_v6_rcv+0x41a3/0x4f00 net/ipv6/tcp_ipv6.c:1487
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_kmalloc+0x7f/0xe0 mm/kmsan/kmsan.c:337
kmem_cache_alloc+0x1c2/0x1e0 mm/slub.c:2766
reqsk_alloc ./include/net/request_sock.h:87
inet_reqsk_alloc+0xa4/0x5b0 net/ipv4/tcp_input.c:6200
cookie_v6_check+0x4f4/0x1b50 net/ipv6/syncookies.c:169
tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:989
tcp_v6_do_rcv+0xdd8/0x1c60 net/ipv6/tcp_ipv6.c:1298
tcp_v6_rcv+0x41a3/0x4f00 net/ipv6/tcp_ipv6.c:1487
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
==================================================================
Similar error is reported for cookie_v4_check().
Fixes: 58d607d3e52f ("tcp: provide skb->hash to synack packets")
Signed-off-by: Alexander Potapenko <glider@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/syncookies.c | 1 +
net/ipv6/syncookies.c | 1 +
2 files changed, 2 insertions(+)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock
treq = tcp_rsk(req);
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = cookie;
+ treq->txhash = net_tx_rndhash();
req->mss = mss;
ireq->ir_num = ntohs(th->dest);
ireq->ir_rmt_port = th->source;
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock
treq->snt_synack.v64 = 0;
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = cookie;
+ treq->txhash = net_tx_rndhash();
/*
* We need to lookup the dst_entry to get the correct window size.
next prev parent reply other threads:[~2017-08-09 19:42 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-09 19:41 [PATCH 4.4 00/58] 4.4.81-stable review Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 01/58] parisc: Increase thread and stack size to 32kb Greg Kroah-Hartman
2017-08-11 1:33 ` Ben Hutchings
2017-08-11 7:21 ` Helge Deller
2017-08-11 15:33 ` Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 02/58] libata: array underflow in ata_find_dev() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 03/58] workqueue: restore WQ_UNBOUND/max_active==1 to be ordered Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 04/58] ALSA: hda - Fix speaker output from VAIO VPCL14M1R Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 05/58] ASoC: do not close shared backend dailink Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 07/58] mm/page_alloc: Remove kernel address exposure in free_reserved_area() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 08/58] ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 09/58] ext4: fix overflow caused by missing cast in ext4_resize_fs() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 10/58] ARM: dts: armada-38x: Fix irq type for pca955 Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 11/58] media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 12/58] target: Avoid mappedlun symlink creation during lun shutdown Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 13/58] iscsi-target: Always wait for kthread_should_stop() before kthread exit Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 14/58] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 15/58] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Greg Kroah-Hartman
2017-08-11 16:12 ` Ben Hutchings
2017-08-09 19:41 ` [PATCH 4.4 16/58] iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 17/58] iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 18/58] mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries Greg Kroah-Hartman
2017-08-11 17:45 ` Ben Hutchings
2017-08-13 6:27 ` Nadav Amit
2017-08-15 13:36 ` Ben Hutchings
2017-08-15 16:39 ` Nadav Amit
2017-08-14 8:00 ` Mel Gorman
2017-08-09 19:41 ` [PATCH 4.4 19/58] media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 20/58] f2fs: sanity check checkpoint segno and blkoff Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 21/58] drm: rcar-du: fix backport bug Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 22/58] [media] saa7164: fix double fetch PCIe access condition Greg Kroah-Hartman
2017-08-09 19:41 ` Greg Kroah-Hartman [this message]
2017-08-09 19:41 ` [PATCH 4.4 24/58] net: Zero terminate ifr_name in dev_ifname() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 25/58] ipv6: avoid overflow of offset in ip6_find_1stfragopt Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 26/58] ipv4: initialize fib_trie prior to register_netdev_notifier call Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 27/58] rtnetlink: allocate more memory for dev_set_mac_address() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 28/58] mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 29/58] openvswitch: fix potential out of bound access in parse_ct Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 30/58] packet: fix use-after-free in prb_retire_rx_blk_timer_expired() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 31/58] ipv6: Dont increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 32/58] net: ethernet: nb8800: Handle all 4 RGMII modes identically Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 33/58] dccp: fix a memleak that dccp_ipv6 doesnt put reqsk properly Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 34/58] dccp: fix a memleak that dccp_ipv4 " Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 35/58] dccp: fix a memleak for dccp_feat_init err process Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 36/58] sctp: dont dereference ptr before leaving _sctp_walk_{params, errors}() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 37/58] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 38/58] net/mlx5: Fix command bad flow on command entry allocation failure Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 39/58] net: phy: Correctly process PHY_HALTED in phy_stop_machine() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 40/58] xen-netback: correctly schedule rate-limited queues Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 41/58] sparc64: Measure receiver forward progress to avoid send mondo timeout Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 42/58] sparc64: Prevent perf from running during super critical sections Greg Kroah-Hartman
2017-08-10 16:20 ` Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 43/58] wext: handle NULL extra data in iwe_stream_add_point better Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 44/58] sh_eth: R8A7740 supports packet shecksumming Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 45/58] net: phy: dp83867: fix irq generation Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 46/58] tg3: Fix race condition in tg3_get_stats64() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 47/58] x86/boot: Add missing declaration of string functions Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 48/58] phy state machine: failsafe leave invalid RUNNING state Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 49/58] scsi: qla2xxx: Get mutex lock before checking optrom_state Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 50/58] drm/virtio: fix framebuffer sparse warning Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 51/58] virtio_blk: fix panic in initialization error path Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 52/58] ARM: 8632/1: ftrace: fix syscall name matching Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 53/58] mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 54/58] lib/Kconfig.debug: fix frv build failure Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 55/58] signal: protect SIGNAL_UNKILLABLE from unintentional clearing Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 56/58] mm: dont dereference struct page fields of invalid pages Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 57/58] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Greg Kroah-Hartman
2017-08-10 0:02 ` [PATCH 4.4 00/58] 4.4.81-stable review Shuah Khan
2017-08-10 0:37 ` Guenter Roeck
2017-08-10 16:17 ` Greg Kroah-Hartman
2017-08-10 17:34 ` Guenter Roeck
2017-08-10 16:21 ` Greg Kroah-Hartman
2017-08-10 0:58 ` Guenter Roeck
2017-08-10 16:18 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170809194147.422281429@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).