From: Pavel Skripkin <paskripkin@gmail.com>
To: Dongliang Mu <mudongliangabcd@gmail.com>,
Boris Pismenny <borisp@nvidia.com>,
John Fastabend <john.fastabend@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Jakub Kicinski <kuba@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Dan Carpenter <dan.carpenter@oracle.com>
Cc: netdev@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Subject: Re: Any idea to fix the recursive call in tls_setsockopt?
Date: Sat, 2 Oct 2021 15:52:52 +0300 [thread overview]
Message-ID: <cc51edb5-92f2-bf33-f101-2a5c9f75ca58@gmail.com> (raw)
In-Reply-To: <CAD-N9QW=ex-+gkwnJNw0eQjFCPcQ-awN_NH5OERjQfo-FC=z4A@mail.gmail.com>
On 10/2/21 11:38, Dongliang Mu wrote:
[ +CC netdev, LKML ]
> BUG: stack guard page was hit at ffffc90000b87ff8 (stack is
> ffffc90000b88000..ffffc90000b8bfff)
> kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP
> RIP: 0010:tls_setsockopt+0xe/0x650 net/tls/tls_main.c:617
> Call Trace:
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> ......
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> __sys_setsockopt+0x1b0/0x360 net/socket.c:2176
> __do_sys_setsockopt net/socket.c:2187 [inline]
> __se_sys_setsockopt net/socket.c:2184 [inline]
> __x64_sys_setsockopt+0x22/0x30 net/socket.c:2184
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> My local syzkaller instance finds this bug, however, I am not sure how
> to fix it. So I post the bug report here to seek help. The
> implementation of tls_setsockopt is as follows:
>
> static int tls_setsockopt(struct sock *sk, int level, int optname,
> sockptr_t optval, unsigned int optlen)
> {
> struct tls_context *ctx = tls_get_ctx(sk);
>
> if (level != SOL_TLS)
> return ctx->sk_proto->setsockopt(sk, level, optname, optval,
> optlen);
>
> return do_tls_setsockopt(sk, optname, optval, optlen);
> }
>
> Since I am not familiar with this part code, the fix in my mind is to
> do a sanity check on "ctx->sk_proto->setsockopt" and make sure it is
> not tls_setsockopt.
>
> Any comment here?
>
> --
> My best regards to you.
>
> No System Is Safe!
> Dongliang Mu
>
With regards,
Pavel Skripkin
parent reply other threads:[~2021-10-02 12:53 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <CAD-N9QW=ex-+gkwnJNw0eQjFCPcQ-awN_NH5OERjQfo-FC=z4A@mail.gmail.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cc51edb5-92f2-bf33-f101-2a5c9f75ca58@gmail.com \
--to=paskripkin@gmail.com \
--cc=borisp@nvidia.com \
--cc=dan.carpenter@oracle.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=john.fastabend@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mudongliangabcd@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).