[Bug]KASAN: slab-use-after-free Read in tcp_sync_mss

[Yue Sun <samsun1006219@gmail.com>]

Hello,

We encountered a slab-use-after-free read in tcp_sync_mss() on
7.2.0-rc1-g7558af35077a (upstream parent 7404ce516372).  We checked
the latest mainline commit, a13c140cc289 (Linux 7.2-rc3), and
confirmed that the root cause is still present.

Original KASAN report
=====================
==================================================================
BUG: KASAN: slab-use-after-free in __tcp_mtu_to_mss net/ipv4/tcp_output.c:2005 [inline]
BUG: KASAN: slab-use-after-free in tcp_mtu_to_mss net/ipv4/tcp_output.c:2024 [inline]
BUG: KASAN: slab-use-after-free in tcp_sync_mss+0x560/0x610 net/ipv4/tcp_output.c:2088
Read of size 2 at addr ff11000047600bb8 by task kworker/u8:2/37

CPU: 1 UID: 0 PID: 37 Comm: kworker/u8:2 Tainted: G             L      7.2.0-rc1-g7558af35077a #48 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: krdsd rds_tcp_accept_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xf1/0x5c0 mm/kasan/report.c:482
 kasan_report+0xca/0x100 mm/kasan/report.c:595
 __tcp_mtu_to_mss net/ipv4/tcp_output.c:2005 [inline]
 tcp_mtu_to_mss net/ipv4/tcp_output.c:2024 [inline]
 tcp_sync_mss+0x560/0x610 net/ipv4/tcp_output.c:2088
 tcp_ack_update_window net/ipv4/tcp_input.c:3979 [inline]
 tcp_ack+0x4b35/0x6e80 net/ipv4/tcp_input.c:4336
 tcp_rcv_state_process+0xf30/0x7270 net/ipv4/tcp_input.c:7201
 tcp_v4_do_rcv+0x7ec/0x12b0 net/ipv4/tcp_ipv4.c:1873
 tcp_v4_rcv+0x2d30/0x4800 net/ipv4/tcp_ipv4.c:2245
 ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3ce/0x710 net/ipv4/ip_input.c:241
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip_local_deliver+0x19a/0x200 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:480 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip_rcv+0x327/0x3d0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:6206
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6319
 process_backlog+0x382/0x1540 net/core/dev.c:6670
 __napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7729
 napi_poll net/core/dev.c:7792 [inline]
 net_rx_action+0x9b1/0xea0 net/core/dev.c:7949
 handle_softirqs+0x1d4/0x980 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:914 [inline]
 __dev_queue_xmit+0xe25/0x4300 net/core/dev.c:4907
 dev_queue_xmit include/linux/netdevice.h:3446 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xc52/0x1ea0 net/ipv4/ip_output.c:236
 __ip_finish_output.part.0+0x1bb/0x350 net/ipv4/ip_output.c:314
 __ip_finish_output net/ipv4/ip_output.c:302 [inline]
 ip_finish_output net/ipv4/ip_output.c:324 [inline]
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x376/0x860 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:470 [inline]
 ip_local_out+0x1b4/0x200 net/ipv4/ip_output.c:131
 __ip_queue_xmit+0x773/0x1a90 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x36b1/0x5080 net/ipv4/tcp_output.c:1716
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1876/0x7dd0 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0xb0/0x3c0 net/ipv4/tcp_output.c:3245
 tcp_send_fin+0x11f/0x10d0 net/ipv4/tcp_output.c:3844
 __tcp_close+0xa27/0x10f0 net/ipv4/tcp.c:3220
 tcp_close+0x28/0x110 net/ipv4/tcp.c:3311
 inet_release+0xed/0x200 net/ipv4/af_inet.c:442
 inet6_release+0x50/0x80 net/ipv6/af_inet6.c:472
 __sock_release net/socket.c:710 [inline]
 sock_release+0x91/0x1d0 net/socket.c:738
 rds_tcp_accept_one+0x246/0xf10 net/rds/tcp_listen.c:341
 rds_tcp_accept_worker+0x41/0x60 net/rds/tcp.c:552
 process_one_work+0xce3/0x2210 kernel/workqueue.c:3619
 process_scheduled_works kernel/workqueue.c:3728 [inline]
 worker_thread+0x693/0xeb0 kernel/workqueue.c:3809
 kthread+0x38d/0x4a0 kernel/kthread.c:436
 ret_from_fork+0xb09/0xdb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 46228:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_noprof+0x244/0x690 mm/slub.c:4959
 sk_prot_alloc+0x5f/0x290 net/core/sock.c:2246
 sk_alloc+0x36/0xe10 net/core/sock.c:2308
 smc_sock_alloc net/smc/af_smc.c:428 [inline]
 smc_create+0x125/0x320 net/smc/af_smc.c:3389
 __sock_create+0x382/0x8e0 net/socket.c:1651
 sock_create net/socket.c:1709 [inline]
 __sys_socket_create net/socket.c:1746 [inline]
 __sys_socket_create net/socket.c:1731 [inline]
 __sys_socket+0x145/0x260 net/socket.c:1793
 __do_sys_socket net/socket.c:1807 [inline]
 __se_sys_socket net/socket.c:1805 [inline]
 __x64_sys_socket+0x72/0xb0 net/socket.c:1805
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x11f/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x61/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free_after_rcu_debug+0x105/0x2b0 mm/slub.c:6467
 rcu_do_batch kernel/rcu/tree.c:2645 [inline]
 rcu_core+0x59e/0x1130 kernel/rcu/tree.c:2897
 handle_softirqs+0x1d4/0x980 kernel/softirq.c:622
 run_ksoftirqd kernel/softirq.c:1076 [inline]
 run_ksoftirqd+0x3a/0x60 kernel/softirq.c:1068
 smpboot_thread_fn+0x3d4/0xaa0 kernel/smpboot.c:160
 kthread+0x38d/0x4a0 kernel/kthread.c:436
 ret_from_fork+0xb09/0xdb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 slab_free_hook mm/slub.c:2666 [inline]
 slab_free mm/slub.c:6405 [inline]
 kmem_cache_free+0x438/0x720 mm/slub.c:6532
 sk_prot_free net/core/sock.c:2289 [inline]
 __sk_destruct+0x62d/0xab0 net/core/sock.c:2391
 sk_destruct+0xc1/0xe0 net/core/sock.c:2419
 __sk_free+0xf2/0x3e0 net/core/sock.c:2430
 sk_free+0x6a/0x90 net/core/sock.c:2441
 sock_put include/net/sock.h:2020 [inline]
 smc_release+0x41d/0x620 net/smc/af_smc.c:369
 __sock_release+0xb3/0x270 net/socket.c:710
 sock_close+0x1c/0x30 net/socket.c:1501
 __fput+0x402/0xb60 fs/file_table.c:512
 task_work_run+0x16b/0x260 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1de/0x5f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x737/0x860 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ff11000047600000
 which belongs to the cache SMC of size 3216
The buggy address is located 3000 bytes inside of
 freed 3216-byte region [ff11000047600000, ff11000047600c90)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff11000047604f80 pfn:0x47600
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ff11000047607741
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ff11000020a6a780 ff11000020a68708 ffd4000001aa4a10
raw: ff11000047604f80 0000000800090006 00000000f5000000 ff11000047607741
head: 00fff00000000240 ff11000020a6a780 ff11000020a68708 ffd4000001aa4a10
head: ff11000047604f80 0000000800090006 00000000f5000000 ff11000047607741
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13226, tgid 13219 (syz.0.27), ts 78395568066, free_ts 78097920902
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xff/0x130 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xe82/0x2bf0 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x27b/0x2a00 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab mm/slub.c:3408 [inline]
 new_slab+0xad/0x610 mm/slub.c:3454
 refill_objects+0x10e/0x3d0 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x352/0x670 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 kmem_cache_alloc_noprof+0x550/0x690 mm/slub.c:4959
 sk_prot_alloc+0x5f/0x290 net/core/sock.c:2246
 sk_alloc+0x36/0xe10 net/core/sock.c:2308
 smc_sock_alloc net/smc/af_smc.c:428 [inline]
 smc_create+0x125/0x320 net/smc/af_smc.c:3389
 __sock_create+0x382/0x8e0 net/socket.c:1651
 sock_create net/socket.c:1709 [inline]
 __sys_socket_create net/socket.c:1746 [inline]
 __sys_socket_create net/socket.c:1731 [inline]
 __sys_socket+0x145/0x260 net/socket.c:1793
 __do_sys_socket net/socket.c:1807 [inline]
 __se_sys_socket net/socket.c:1805 [inline]
 __x64_sys_socket+0x72/0xb0 net/socket.c:1805
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x11f/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 790 tgid 790 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 free_pages_prepare+0x54b/0xd20 mm/page_alloc.c:1451
 __free_contig_range_common+0x165/0x240 mm/page_alloc.c:6897
 __free_contig_range mm/page_alloc.c:6942 [inline]
 free_pages_bulk+0x125/0x1a0 mm/page_alloc.c:5257
 vm_area_free_pages+0x17c/0x290 mm/vmalloc.c:3439
 vfree+0x125/0x780 mm/vmalloc.c:3488
 delayed_vfree_work+0x57/0x70 mm/vmalloc.c:3392
 process_one_work+0xce3/0x2210 kernel/workqueue.c:3619
 process_scheduled_works kernel/workqueue.c:3728 [inline]
 worker_thread+0x693/0xeb0 kernel/workqueue.c:3809
 kthread+0x38d/0x4a0 kernel/kthread.c:436
 ret_from_fork+0xb09/0xdb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ff11000047600a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ff11000047600b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ff11000047600b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ff11000047600c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ff11000047600c80: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Root cause
==========

The KASAN report places the invalid read 3000 bytes into a freed
3216-byte struct smc_sock.  In the crashing build:

  offsetof(struct smc_sock, af_ops) = 2992
  offsetof(struct inet_connection_sock_af_ops, net_header_len) = 8

Their sum is 3000, so the invalid two-byte read is precisely
smc->af_ops.net_header_len.  This matches __tcp_mtu_to_mss():

  mss_now = pmtu - icsk->icsk_af_ops->net_header_len -
            sizeof(struct tcphdr);

smc_listen() replaces the underlying TCP socket's icsk_af_ops with an
operations structure embedded in the SMC socket before calling
kernel_listen():

  smc->ori_af_ops = inet_csk(smc->clcsock->sk)->icsk_af_ops;
  smc->af_ops = *smc->ori_af_ops;
  smc->af_ops.syn_recv_sock = smc_tcp_syn_recv_sock;
  inet_csk(smc->clcsock->sk)->icsk_af_ops = &smc->af_ops;

  rc = kernel_listen(smc->clcsock, backlog);
  if (rc) {
          smc_clcsock_restore_cb(...);
          rcu_assign_sk_user_data(smc->clcsock->sk, NULL);
          goto out;
  }

When kernel_listen() fails, the error path restores sk_data_ready and
sk_user_data but does not restore icsk_af_ops.  Closing the SMC socket
can therefore free the smc_sock while its TCP clcsock still contains
an icsk_af_ops pointer into that object.  Later TCP receive processing
dereferences the stale pointer in tcp_sync_mss().

The triggering program uses an AF_SMC socket, sends with MSG_FASTOPEN,
then calls listen().  MSG_FASTOPEN switches SMC to TCP fallback and
starts activity on the underlying TCP socket; kernel_listen() then
fails, leaving the stale pointer installed.  The same missing restore
is still present in smc_listen() at a13c140cc289.

The error path should restore the original pointer before returning:

  inet_csk(smc->clcsock->sk)->icsk_af_ops = smc->ori_af_ops;

This may be related to the issue discussed in:
https://lore.kernel.org/netdev/tencent_BD4B709F8D16281265EDBC0DC9EFC8758808@qq.com/

Thanks,
--
Yue Sun