From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alexander Potapenko <glider@google.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 23/58] ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
Date: Wed, 9 Aug 2017 12:41:35 -0700 [thread overview]
Message-ID: <20170809194147.422281429@linuxfoundation.org> (raw)
In-Reply-To: <20170809194146.501519882@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 18bcf2907df935981266532e1e0d052aff2e6fae ]
KMSAN reported use of uninitialized memory in skb_set_hash_from_sk(),
which originated from the TCP request socket created in
cookie_v6_check():
==================================================================
BUG: KMSAN: use of uninitialized memory in tcp_transmit_skb+0xf77/0x3ec0
CPU: 1 PID: 2949 Comm: syz-execprog Not tainted 4.11.0-rc5+ #2931
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
TCP: request_sock_TCPv6: Possible SYN flooding on port 20028. Sending cookies. Check SNMP counters.
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
skb_set_hash_from_sk ./include/net/sock.h:2011
tcp_transmit_skb+0xf77/0x3ec0 net/ipv4/tcp_output.c:983
tcp_send_ack+0x75b/0x830 net/ipv4/tcp_output.c:3493
tcp_delack_timer_handler+0x9a6/0xb90 net/ipv4/tcp_timer.c:284
tcp_delack_timer+0x1b0/0x310 net/ipv4/tcp_timer.c:309
call_timer_fn+0x240/0x520 kernel/time/timer.c:1268
expire_timers kernel/time/timer.c:1307
__run_timers+0xc13/0xf10 kernel/time/timer.c:1601
run_timer_softirq+0x36/0xa0 kernel/time/timer.c:1614
__do_softirq+0x485/0x942 kernel/softirq.c:284
invoke_softirq kernel/softirq.c:364
irq_exit+0x1fa/0x230 kernel/softirq.c:405
exiting_irq+0xe/0x10 ./arch/x86/include/asm/apic.h:657
smp_apic_timer_interrupt+0x5a/0x80 arch/x86/kernel/apic/apic.c:966
apic_timer_interrupt+0x86/0x90 arch/x86/entry/entry_64.S:489
RIP: 0010:native_restore_fl ./arch/x86/include/asm/irqflags.h:36
RIP: 0010:arch_local_irq_restore ./arch/x86/include/asm/irqflags.h:77
RIP: 0010:__msan_poison_alloca+0xed/0x120 mm/kmsan/kmsan_instr.c:440
RSP: 0018:ffff880024917cd8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000246 RBX: ffff8800224c0000 RCX: 0000000000000005
RDX: 0000000000000004 RSI: ffff880000000000 RDI: ffffea0000b6d770
RBP: ffff880024917d58 R08: 0000000000000dd8 R09: 0000000000000004
R10: 0000160000000000 R11: 0000000000000000 R12: ffffffff85abf810
R13: ffff880024917dd8 R14: 0000000000000010 R15: ffffffff81cabde4
</IRQ>
poll_select_copy_remaining+0xac/0x6b0 fs/select.c:293
SYSC_select+0x4b4/0x4e0 fs/select.c:653
SyS_select+0x76/0xa0 fs/select.c:634
entry_SYSCALL_64_fastpath+0x13/0x94 arch/x86/entry/entry_64.S:204
RIP: 0033:0x4597e7
RSP: 002b:000000c420037ee0 EFLAGS: 00000246 ORIG_RAX: 0000000000000017
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004597e7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 000000c420037ef0 R08: 000000c420037ee0 R09: 0000000000000059
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000042dc20
R13: 00000000000000f3 R14: 0000000000000030 R15: 0000000000000003
chained origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_save_stack mm/kmsan/kmsan.c:317
kmsan_internal_chain_origin+0x12a/0x1f0 mm/kmsan/kmsan.c:547
__msan_store_shadow_origin_4+0xac/0x110 mm/kmsan/kmsan_instr.c:259
tcp_create_openreq_child+0x709/0x1ae0 net/ipv4/tcp_minisocks.c:472
tcp_v6_syn_recv_sock+0x7eb/0x2a30 net/ipv6/tcp_ipv6.c:1103
tcp_get_cookie_sock+0x136/0x5f0 net/ipv4/syncookies.c:212
cookie_v6_check+0x17a9/0x1b50 net/ipv6/syncookies.c:245
tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:989
tcp_v6_do_rcv+0xdd8/0x1c60 net/ipv6/tcp_ipv6.c:1298
tcp_v6_rcv+0x41a3/0x4f00 net/ipv6/tcp_ipv6.c:1487
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_kmalloc+0x7f/0xe0 mm/kmsan/kmsan.c:337
kmem_cache_alloc+0x1c2/0x1e0 mm/slub.c:2766
reqsk_alloc ./include/net/request_sock.h:87
inet_reqsk_alloc+0xa4/0x5b0 net/ipv4/tcp_input.c:6200
cookie_v6_check+0x4f4/0x1b50 net/ipv6/syncookies.c:169
tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:989
tcp_v6_do_rcv+0xdd8/0x1c60 net/ipv6/tcp_ipv6.c:1298
tcp_v6_rcv+0x41a3/0x4f00 net/ipv6/tcp_ipv6.c:1487
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
==================================================================
Similar error is reported for cookie_v4_check().
Fixes: 58d607d3e52f ("tcp: provide skb->hash to synack packets")
Signed-off-by: Alexander Potapenko <glider@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/syncookies.c | 1 +
net/ipv6/syncookies.c | 1 +
2 files changed, 2 insertions(+)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock
treq = tcp_rsk(req);
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = cookie;
+ treq->txhash = net_tx_rndhash();
req->mss = mss;
ireq->ir_num = ntohs(th->dest);
ireq->ir_rmt_port = th->source;
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock
treq->snt_synack.v64 = 0;
treq->rcv_isn = ntohl(th->seq) - 1;
treq->snt_isn = cookie;
+ treq->txhash = net_tx_rndhash();
/*
* We need to lookup the dst_entry to get the correct window size.
next prev parent reply other threads:[~2017-08-09 19:42 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-09 19:41 [PATCH 4.4 00/58] 4.4.81-stable review Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 01/58] parisc: Increase thread and stack size to 32kb Greg Kroah-Hartman
2017-08-11 1:33 ` Ben Hutchings
2017-08-11 7:21 ` Helge Deller
2017-08-11 15:33 ` Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 02/58] libata: array underflow in ata_find_dev() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 03/58] workqueue: restore WQ_UNBOUND/max_active==1 to be ordered Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 04/58] ALSA: hda - Fix speaker output from VAIO VPCL14M1R Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 05/58] ASoC: do not close shared backend dailink Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 07/58] mm/page_alloc: Remove kernel address exposure in free_reserved_area() Greg Kroah-Hartman
2017-08-09 19:41 ` Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 08/58] ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 09/58] ext4: fix overflow caused by missing cast in ext4_resize_fs() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 10/58] ARM: dts: armada-38x: Fix irq type for pca955 Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 11/58] media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 12/58] target: Avoid mappedlun symlink creation during lun shutdown Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 13/58] iscsi-target: Always wait for kthread_should_stop() before kthread exit Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 14/58] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 15/58] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Greg Kroah-Hartman
2017-08-11 16:12 ` Ben Hutchings
2017-08-09 19:41 ` [PATCH 4.4 16/58] iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 17/58] iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 18/58] mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries Greg Kroah-Hartman
2017-08-11 17:45 ` Ben Hutchings
2017-08-13 6:27 ` Nadav Amit
2017-08-15 13:36 ` Ben Hutchings
2017-08-15 16:39 ` Nadav Amit
2017-08-14 8:00 ` Mel Gorman
2017-08-09 19:41 ` [PATCH 4.4 19/58] media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 20/58] f2fs: sanity check checkpoint segno and blkoff Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 21/58] drm: rcar-du: fix backport bug Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 22/58] [media] saa7164: fix double fetch PCIe access condition Greg Kroah-Hartman
2017-08-09 19:41 ` Greg Kroah-Hartman [this message]
2017-08-09 19:41 ` [PATCH 4.4 24/58] net: Zero terminate ifr_name in dev_ifname() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 25/58] ipv6: avoid overflow of offset in ip6_find_1stfragopt Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 26/58] ipv4: initialize fib_trie prior to register_netdev_notifier call Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 27/58] rtnetlink: allocate more memory for dev_set_mac_address() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 28/58] mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 29/58] openvswitch: fix potential out of bound access in parse_ct Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 30/58] packet: fix use-after-free in prb_retire_rx_blk_timer_expired() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 31/58] ipv6: Dont increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 32/58] net: ethernet: nb8800: Handle all 4 RGMII modes identically Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 33/58] dccp: fix a memleak that dccp_ipv6 doesnt put reqsk properly Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 34/58] dccp: fix a memleak that dccp_ipv4 " Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 35/58] dccp: fix a memleak for dccp_feat_init err process Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 36/58] sctp: dont dereference ptr before leaving _sctp_walk_{params, errors}() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 37/58] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 38/58] net/mlx5: Fix command bad flow on command entry allocation failure Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 39/58] net: phy: Correctly process PHY_HALTED in phy_stop_machine() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 40/58] xen-netback: correctly schedule rate-limited queues Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 41/58] sparc64: Measure receiver forward progress to avoid send mondo timeout Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 42/58] sparc64: Prevent perf from running during super critical sections Greg Kroah-Hartman
2017-08-10 16:20 ` Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 43/58] wext: handle NULL extra data in iwe_stream_add_point better Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 44/58] sh_eth: R8A7740 supports packet shecksumming Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 45/58] net: phy: dp83867: fix irq generation Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 46/58] tg3: Fix race condition in tg3_get_stats64() Greg Kroah-Hartman
2017-08-09 19:41 ` [PATCH 4.4 47/58] x86/boot: Add missing declaration of string functions Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 48/58] phy state machine: failsafe leave invalid RUNNING state Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 49/58] scsi: qla2xxx: Get mutex lock before checking optrom_state Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 50/58] drm/virtio: fix framebuffer sparse warning Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 51/58] virtio_blk: fix panic in initialization error path Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 52/58] ARM: 8632/1: ftrace: fix syscall name matching Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 53/58] mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 54/58] lib/Kconfig.debug: fix frv build failure Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 55/58] signal: protect SIGNAL_UNKILLABLE from unintentional clearing Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 56/58] mm: dont dereference struct page fields of invalid pages Greg Kroah-Hartman
2017-08-09 19:42 ` [PATCH 4.4 57/58] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Greg Kroah-Hartman
2017-08-10 0:02 ` [PATCH 4.4 00/58] 4.4.81-stable review Shuah Khan
2017-08-10 0:37 ` Guenter Roeck
2017-08-10 16:17 ` Greg Kroah-Hartman
2017-08-10 17:34 ` Guenter Roeck
2017-08-10 16:21 ` Greg Kroah-Hartman
2017-08-10 0:58 ` Guenter Roeck
2017-08-10 16:18 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170809194147.422281429@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.