[PATCH net] net: tcp: fix crashes trying to free half-baked MTU probes

[PATCH net] net: tcp: fix crashes trying to free half-baked MTU probes

[Jakub Kicinski]

tcp_stream_alloc_skb() initializes the skb to use tcp_tsorted_anchor
which is a union with the destructor. We need to clean that
TCP-iness up before freeing.

Fixes: 736013292e3c ("tcp: let tcp_mtu_probe() build headless packets")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
Thanks to Chris Mason for debug help and Omar Sandoval for
amazing drgn skills and analysis which make all bugs look
obvious :)
---
CC: dsahern@kernel.org
CC: clm@fb.com
CC: osandov@osandov.com
---
 net/ipv4/tcp_output.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f207712eece1..d5961a82a9e8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2449,6 +2449,7 @@ static int tcp_mtu_probe(struct sock *sk)
 
 	/* build the payload, and be prepared to abort if this fails. */
 	if (tcp_clone_payload(sk, nskb, probe_size)) {
+		tcp_skb_tsorted_anchor_cleanup(nskb);
 		consume_skb(nskb);
 		return -1;
 	}
-- 
2.41.0

Re: [PATCH net] net: tcp: fix crashes trying to free half-baked MTU probes

[Eric Dumazet]

On Tue, Oct 10, 2023 at 7:36 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> tcp_stream_alloc_skb() initializes the skb to use tcp_tsorted_anchor
> which is a union with the destructor. We need to clean that
> TCP-iness up before freeing.
>
> Fixes: 736013292e3c ("tcp: let tcp_mtu_probe() build headless packets")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---

SGTM, thanks !

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net] net: tcp: fix crashes trying to free half-baked MTU probes

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Oct 2023 10:36:51 -0700 you wrote:
> tcp_stream_alloc_skb() initializes the skb to use tcp_tsorted_anchor
> which is a union with the destructor. We need to clean that
> TCP-iness up before freeing.
> 
> Fixes: 736013292e3c ("tcp: let tcp_mtu_probe() build headless packets")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> 
> [...]

Here is the summary with links:
  - [net] net: tcp: fix crashes trying to free half-baked MTU probes
    https://git.kernel.org/netdev/net/c/71c299c711d1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html