From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6A2312DD85 for ; Fri, 24 May 2024 15:12:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716563536; cv=none; b=ERjoW9cVsKXtKM+wPzFDaZetsKN9oQFddXqs+dGW1avDJx2RhK8xIOQPrKSsj42cjKtAQ2oojdAztRgKfyXNrqDudJF1W5uKsXv34R12FbDYn6M1ieXpMScjM3WRylWv8OFlW00kjOKJ7JQJG6aQ6tuvtVWFrklK+sw7m80LNlg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716563536; c=relaxed/simple; bh=ET8gl5JBckDMqKdPtTgPpBZvdIvP+ykFJjrx8E++eo8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EhgGZRwui2rLxl/OW8JUxC1nnRO8e6+usMl2pAm1vdvVoeJuohClUEPVdSj3Ulw2oM3aG0uIylU6Vh9SYW/r0q0tC1/EFowDagTUJuFOEILVDHxOBV/AYmzQ+aW2FoQ1vzlRjowvryTxxcBDil6DsR113bYdR8YeNCtuVfPdPc4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oVRjy0tm; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oVRjy0tm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 669B4C32782; Fri, 24 May 2024 15:12:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716563535; bh=ET8gl5JBckDMqKdPtTgPpBZvdIvP+ykFJjrx8E++eo8=; h=From:To:Cc:Subject:Date:Reply-to:From; b=oVRjy0tm7U1ASfDZRZD6l1rUeNVETZKlufqf17QS241YxPJxZGxNPlj+1/8dZV6jn bmb3tePPFYYl1ZbAQgqQgHDnekPAn+vxWrfAeOyGjvKk9J/IsPquS9qhFqE1/NbugT REhkYzqNYRAcnTSd4Hqve1YjtePLhVhID4kr5Anc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47544: tcp: fix page frag corruption on page fault Date: Fri, 24 May 2024 17:10:04 +0200 Message-ID: <2024052440-CVE-2021-47544-ceb5@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4359; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ET8gl5JBckDMqKdPtTgPpBZvdIvP+ykFJjrx8E++eo8=; b=owGbwMvMwCRo6H6F97bub03G02pJDGkBa7ckmpoqtHOsZet69F82gENjyr0vnkpLtzM78qkuv SD40FirI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZydA/DfIceo0O9n7KszCRb Zx39mTx7Yeb/DwwLLr8+1nRl5+PD7V5dFz9WHIqSXKd8FQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: tcp: fix page frag corruption on page fault Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file. The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix sk_page_frag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file. The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream. The overall relevant stack trace looks like the following: httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: ffffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139814e sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 __handle_mm_fault+0x4d4 ffffffff90eb8093 handle_mm_fault+0xc3 ffffffff90c74f6d __do_page_fault+0x1ed ffffffff90c75277 do_page_fault+0x37 ffffffff9160111e page_fault+0x1e ffffffff9109e7b5 copyin+0x25 ffffffff9109eb40 _copy_from_iter_full+0xe0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139815c sock_sendmsg+0x4c ffffffff913981f7 sock_write_iter+0x97 ffffffff90f2cc56 do_iter_readv_writev+0x156 ffffffff90f2dff0 do_iter_write+0x80 ffffffff90f2e1c3 vfs_writev+0xa3 ffffffff90f2e27c do_writev+0x5c ffffffff90c042bb do_syscall_64+0x5b ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65 The cifs filesystem rightfully sets sk_allocations to GFP_NOFS, we can avoid the nesting using the sk page frag for allocation lacking the __GFP_FS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage. v1 -> v2: - use a stricted sk_page_frag() check instead of reordering the code (Eric) The Linux kernel CVE team has assigned CVE-2021-47544 to this issue. Affected and fixed versions =========================== Issue introduced in 3.7 with commit 5640f7685831 and fixed in 5.10.84 with commit c6f340a331fb Issue introduced in 3.7 with commit 5640f7685831 and fixed in 5.15.7 with commit 5a9afcd827ca Issue introduced in 3.7 with commit 5640f7685831 and fixed in 5.16 with commit dacb5d8875cc Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47544 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/sock.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c