From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Andrey Konovalov <andreyknvl@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.8 10/49] dccp: do not send reset to already closed sockets
Date: Sat, 19 Nov 2016 10:23:02 +0100 [thread overview]
Message-ID: <20161119092038.316232001@linuxfoundation.org> (raw)
In-Reply-To: <20161119092036.698705716@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 346da62cc186c4b4b1ac59f87f4482b47a047388 ]
Andrey reported following warning while fuzzing with syzkaller
WARNING: CPU: 1 PID: 21072 at net/dccp/proto.c:83 dccp_set_state+0x229/0x290
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 21072 Comm: syz-executor Not tainted 4.9.0-rc1+ #293
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88003d4c7738 ffffffff81b474f4 0000000000000003 dffffc0000000000
ffffffff844f8b00 ffff88003d4c7804 ffff88003d4c7800 ffffffff8140c06a
0000000041b58ab3 ffffffff8479ab7d ffffffff8140beae ffffffff8140cd00
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81b474f4>] dump_stack+0xb3/0x10f lib/dump_stack.c:51
[<ffffffff8140c06a>] panic+0x1bc/0x39d kernel/panic.c:179
[<ffffffff8111125c>] __warn+0x1cc/0x1f0 kernel/panic.c:542
[<ffffffff8111144c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
[<ffffffff8389e5d9>] dccp_set_state+0x229/0x290 net/dccp/proto.c:83
[<ffffffff838a0aa2>] dccp_close+0x612/0xc10 net/dccp/proto.c:1016
[<ffffffff8316bf1f>] inet_release+0xef/0x1c0 net/ipv4/af_inet.c:415
[<ffffffff82b6e89e>] sock_release+0x8e/0x1d0 net/socket.c:570
[<ffffffff82b6e9f6>] sock_close+0x16/0x20 net/socket.c:1017
[<ffffffff815256ad>] __fput+0x29d/0x720 fs/file_table.c:208
[<ffffffff81525bb5>] ____fput+0x15/0x20 fs/file_table.c:244
[<ffffffff811727d8>] task_work_run+0xf8/0x170 kernel/task_work.c:116
[< inline >] exit_task_work include/linux/task_work.h:21
[<ffffffff8111bc53>] do_exit+0x883/0x2ac0 kernel/exit.c:828
[<ffffffff811221fe>] do_group_exit+0x10e/0x340 kernel/exit.c:931
[<ffffffff81143c94>] get_signal+0x634/0x15a0 kernel/signal.c:2307
[<ffffffff81054aad>] do_signal+0x8d/0x1a30 arch/x86/kernel/signal.c:807
[<ffffffff81003a05>] exit_to_usermode_loop+0xe5/0x130
arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006298>] syscall_return_slowpath+0x1a8/0x1e0
arch/x86/entry/common.c:259
[<ffffffff83fc1a62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Fix this the same way we did for TCP in commit 565b7b2d2e63
("tcp: do not send reset to already closed sockets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/proto.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1009,6 +1009,10 @@ void dccp_close(struct sock *sk, long ti
__kfree_skb(skb);
}
+ /* If socket has been already reset kill it. */
+ if (sk->sk_state == DCCP_CLOSED)
+ goto adjudge_to_death;
+
if (data_was_unread) {
/* Unread data was tossed, send an appropriate Reset Code */
DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
next prev parent reply other threads:[~2016-11-19 9:23 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161119092339epcas3p4464a1a8a19f9171b12871d8cfef3ea16@epcas3p4.samsung.com>
2016-11-19 9:22 ` [PATCH 4.8 00/49] 4.8.10-stable review Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 01/49] dctcp: avoid bogus doubling of cwnd after loss Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 02/49] net: clear sk_err_soft in sk_clone_lock() Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 04/49] bgmac: stop clearing DMA receive control register right after it is set Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 05/49] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 07/49] ipv4: allow local fragmentation in ip_finish_output_gso() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 08/49] tcp: fix return value for partial writes Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 09/49] dccp: do not release listeners too soon Greg Kroah-Hartman
2016-11-19 9:23 ` Greg Kroah-Hartman [this message]
2016-11-19 9:23 ` [PATCH 4.8 11/49] dccp: fix out of bound access in dccp_v4_err() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 12/49] ipv6: dccp: fix out of bound access in dccp_v6_err() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 13/49] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 14/49] sctp: assign assoc_id earlier in __sctp_connect Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 15/49] bpf: fix htab map destruction when extra reserve is in use Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 16/49] net: icmp6_send should use dst dev to determine L3 domain Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 17/49] fib_trie: Correct /proc/net/route off by one error Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 19/49] net: icmp_route_lookup should use rt dev to determine L3 domain Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 20/49] net: __skb_flow_dissect() must cap its return value Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 21/49] ipv4: use new_gw for redirect neigh lookup Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 22/49] tcp: take care of truncations done by sk_filter() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 24/49] mlxsw: spectrum: Fix refcount bug on span entries Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 25/49] mlxsw: spectrum_router: Correctly dump neighbour activity Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 26/49] Revert "bnx2: Reset device during driver initialization" Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 27/49] bnx2: Wait for in-flight DMA to complete at probe stage Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 28/49] sctp: change sk state only when it has assocs in sctp_shutdown Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 29/49] net: stmmac: Fix lack of link transition for fixed PHYs Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 31/49] sparc: Handle negative offsets in arch_jump_label_transform Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 32/49] sparc64: Handle extremely large kernel TSB range flushes sanely Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 33/49] sparc64: Fix illegal relative branches in hypervisor patched TLB code Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 34/49] sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 35/49] sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 36/49] sparc64: Handle extremely large kernel TLB range flushes more gracefully Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 37/49] sparc64: Delete __ret_efault Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 38/49] sparc64: Prepare to move to more saner user copy exception handling Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 39/49] sparc64: Convert copy_in_user to accurate exception reporting Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 40/49] sparc64: Convert GENcopy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 41/49] sparc64: Convert U1copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 42/49] sparc64: Convert NG4copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 43/49] sparc64: Convert NGcopy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 44/49] sparc64: Convert NG2copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 45/49] sparc64: Convert U3copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 46/49] sparc64: Delete now unused user copy assembler helpers Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 47/49] sparc64: Delete now unused user copy fixup functions Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 48/49] usb: gadget: f_fs: edit epfile->ep under lock Greg Kroah-Hartman
2016-11-19 16:21 ` [PATCH 4.8 00/49] 4.8.10-stable review Guenter Roeck
2016-11-19 16:58 ` Greg Kroah-Hartman
2016-11-21 16:32 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161119092038.316232001@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).