Message ID | 20231214050922.3480023-1-syoshida@redhat.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:3b04:b0:fb:cd0c:d3e with SMTP id c4csp8328181dys; Wed, 13 Dec 2023 21:10:48 -0800 (PST) X-Google-Smtp-Source: AGHT+IHVeb3U+FP8N0lQUzxpQEwnGLnCP7SMngyhQPYC2y35GjoNPM4QN7kZroI+b4IMAh94fFaW X-Received: by 2002:a05:6358:f57:b0:170:17eb:3799 with SMTP id c23-20020a0563580f5700b0017017eb3799mr7778920rwj.65.1702530648641; Wed, 13 Dec 2023 21:10:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702530648; cv=none; d=google.com; s=arc-20160816; b=sbJ/zab9zA0PAj3KCc2NldCh4fmfUW+wxjWsJCCTdk2yXS0OoU68qnwEPb8tMGuGSP jd2RXQbdLnp4DaX0NziRpN1Aw6mXDazn9E4kq06XiZ3xoWFJJjEv/LcKA1h0D2M8fIUJ +ZAY9Bk2tK1YPjIUceEiXMzaKJWpzfkSEPGWu+vZ+vFe73xrsUfmcAm8F7MUEH1NmFOe UJ3bMxilbc4NwVDOqPt1kYyZlXwdxxoswV7a/tS0eS8HAsTw/SpdJ1loftipF7/bmXuM hzO460cmjMDXRTRO28zfAoBmVRUsY6KbnzvQCwTgQDxeDBsxlHcAaw3q9S8SzBVxm9XC rc7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=xO88RRkOEho8UJ2yjNCpaLd/VuL7Hge2PfB6GXsL1SM=; fh=lmkhX/b8bRWejYdTnKoFpp51NdxYCL+UCgqWp90s+98=; b=Ei0APIF5ggfMQD96bSDJxi5j7Ruy2ump10yiUEYC+kTN8UL/SDcx+9zWANglEt2x1r o7T1/en6RYv9m6/fCAmOVDk+bpusA2DvtC/K7fmv0bBFvNyIcYa71iTR2GJaqL4oAkSD 2YDykfPtXHhzzZexcoqVHMtaGXC+Vi2dB7QwJQ2o7l+x2xx8+eR0NQRERZMCcWlh2OVz t9ukCWkDDR/q7HxHK0feh6Da8jNNZ7DUFWrcXS8Pmmif40hX9qa55Jjl3G/9To6ZxCuJ W4s0aepK0+00PiDiyFwDF591y6wIFkNhRLeUvQ28d6BFMNiS/UHTvjunTW7KawoLnTpf XAnA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=KSp2JqdX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from morse.vger.email (morse.vger.email. [23.128.96.31]) by mx.google.com with ESMTPS id s18-20020a17090aad9200b002864ea2384dsi11917521pjq.42.2023.12.13.21.10.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Dec 2023 21:10:48 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) client-ip=23.128.96.31; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=KSp2JqdX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by morse.vger.email (Postfix) with ESMTP id 801E4807CB70; Wed, 13 Dec 2023 21:10:13 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at morse.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230251AbjLNFJ1 (ORCPT <rfc822;dexuan.linux@gmail.com> + 99 others); Thu, 14 Dec 2023 00:09:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229436AbjLNFJ0 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 14 Dec 2023 00:09:26 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C24F9F5 for <linux-kernel@vger.kernel.org>; Wed, 13 Dec 2023 21:09:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1702530572; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=xO88RRkOEho8UJ2yjNCpaLd/VuL7Hge2PfB6GXsL1SM=; b=KSp2JqdXgRHbgxq+8l6Vqe0ZrUtq0Bli18i3wI6mhEeNCUopkIh29YCKUOlRDOtDU6Gd/z SYkCiihGi6gNiXkG0gNibs8OL3kFieAR6Dpz+GWZ9dXr5c2ZIXy9zZ/0+EqE7JLg1J8cpl a01moqixES6v3COVAdDVE5tFK4nEWv8= Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-433-LNZKp_IdOrOD9FEURlOzVQ-1; Thu, 14 Dec 2023 00:09:29 -0500 X-MC-Unique: LNZKp_IdOrOD9FEURlOzVQ-1 Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-28ae02b0752so1250159a91.2 for <linux-kernel@vger.kernel.org>; Wed, 13 Dec 2023 21:09:29 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702530568; x=1703135368; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=xO88RRkOEho8UJ2yjNCpaLd/VuL7Hge2PfB6GXsL1SM=; b=e7kp8Xe05K1XrxZAt71BKhqHOy6QrvA64SvauW436GcQ9Ro8G0uPKF6M6dL+iX/Uqz 9GXoyZM74A+c7KMnmNZU3BIzHelF3l3ElPDljgivhGOpfXRcX+46heTplQp4EP1Sbv99 zjmjNApx0bqKw8rgtoAIaUAydXIcsbQxprWesSSa/Tuw3uUWKuP+00s2MQdn6UQcy5jl Ndy4E2Gm+irvhhjNEL4e/NaRSK80+mYTzC6GL1YQuOHNiOZhTNRlPtSSLB/LkPQ7aSQQ m9QutqPh1T8T8hgmTkQ14BAXQr7Uq+//6CKWjWr8ca4v02ViJUoA2MDCyZBuRaAVrSoc M4dw== X-Gm-Message-State: AOJu0YzjmRsXZGxnxtsrG5kE7qD9UfFjlv43ERxdPSpsjnZ1V/Iu5e+G pW3WaFOCIBUTA+KQP5HycaTlPWXh6RhyaSkFphpsBcy6F30YAgiHqKNCuWw+YfJ2nKQxbDzKpGa ksFXgUENZ7s3SsjMHDEDkh/i5 X-Received: by 2002:a17:902:dacf:b0:1d3:5084:e9f3 with SMTP id q15-20020a170902dacf00b001d35084e9f3mr1318157plx.57.1702530568264; Wed, 13 Dec 2023 21:09:28 -0800 (PST) X-Received: by 2002:a17:902:dacf:b0:1d3:5084:e9f3 with SMTP id q15-20020a170902dacf00b001d35084e9f3mr1318152plx.57.1702530567949; Wed, 13 Dec 2023 21:09:27 -0800 (PST) Received: from kernel-devel.local ([240d:1a:c0d:9f00:245e:16ff:fe87:c960]) by smtp.gmail.com with ESMTPSA id r7-20020a170902be0700b001d0c641d220sm11485771pls.257.2023.12.13.21.09.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Dec 2023 21:09:27 -0800 (PST) From: Shigeru Yoshida <syoshida@redhat.com> To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Shigeru Yoshida <syoshida@redhat.com> Subject: [PATCH net] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Date: Thu, 14 Dec 2023 14:09:22 +0900 Message-ID: <20231214050922.3480023-1-syoshida@redhat.com> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on morse.vger.email Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (morse.vger.email [0.0.0.0]); Wed, 13 Dec 2023 21:10:13 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785232777561994755 X-GMAIL-MSGID: 1785232777561994755 |
Series |
[net] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
|
|
Commit Message
Shigeru Yoshida
Dec. 14, 2023, 5:09 a.m. UTC
The following NULL pointer dereference issue occurred:
BUG: kernel NULL pointer dereference, address: 0000000000000000
<...>
RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline]
RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356
<...>
Call Trace:
<TASK>
dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801
inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x83/0xe0 net/socket.c:745
____sys_sendmsg+0x443/0x510 net/socket.c:2558
___sys_sendmsg+0xe5/0x150 net/socket.c:2612
__sys_sendmsg+0xa6/0x120 net/socket.c:2641
__do_sys_sendmsg net/socket.c:2650 [inline]
__se_sys_sendmsg net/socket.c:2648 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2648
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the
socket waiting for the event. However, sk_stream_wait_connect() returns
success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function
that waits for a connection with sk_stream_wait_connect() may misbehave.
In the case of the above DCCP issue, dccp_sendmsg() is waiting for the
connection. If disconnect() is called in concurrently, the above issue
occurs.
This patch fixes the issue by returning error from sk_stream_wait_connect()
if sk_wait_event() fails.
Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
net/core/stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
From: Shigeru Yoshida <syoshida@redhat.com> Date: Thu, 14 Dec 2023 14:09:22 +0900 > The following NULL pointer dereference issue occurred: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > <...> > RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] > RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 > <...> > Call Trace: > <TASK> > dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 > inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 > sock_sendmsg_nosec net/socket.c:730 [inline] > __sock_sendmsg+0x83/0xe0 net/socket.c:745 > ____sys_sendmsg+0x443/0x510 net/socket.c:2558 > ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 > __sys_sendmsg+0xa6/0x120 net/socket.c:2641 > __do_sys_sendmsg net/socket.c:2650 [inline] > __se_sys_sendmsg net/socket.c:2648 [inline] > __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 > entry_SYSCALL_64_after_hwframe+0x63/0x6b > > sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the > socket waiting for the event. However, sk_stream_wait_connect() returns > success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function > that waits for a connection with sk_stream_wait_connect() may misbehave. > > In the case of the above DCCP issue, dccp_sendmsg() is waiting for the > connection. If disconnect() is called in concurrently, the above issue > occurs. > > This patch fixes the issue by returning error from sk_stream_wait_connect() > if sk_wait_event() fails. > > Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") > Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> I guess you picked this issue from syzbot's report. https://lore.kernel.org/netdev/0000000000009e122006088a2b8d@google.com/ If so, let's give a proper credit to syzbot and its authors: Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com Thanks! > --- > net/core/stream.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/core/stream.c b/net/core/stream.c > index 96fbcb9bbb30..b16dfa568a2d 100644 > --- a/net/core/stream.c > +++ b/net/core/stream.c > @@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) > remove_wait_queue(sk_sleep(sk), &wait); > sk->sk_write_pending--; > } while (!done); > - return 0; > + return done < 0 ? done : 0; > } > EXPORT_SYMBOL(sk_stream_wait_connect); > > -- > 2.41.0 >
On 12/14/23 06:09, Shigeru Yoshida wrote: > The following NULL pointer dereference issue occurred: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > <...> > RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] > RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 > <...> > Call Trace: > <TASK> > dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 > inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 > sock_sendmsg_nosec net/socket.c:730 [inline] > __sock_sendmsg+0x83/0xe0 net/socket.c:745 > ____sys_sendmsg+0x443/0x510 net/socket.c:2558 > ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 > __sys_sendmsg+0xa6/0x120 net/socket.c:2641 > __do_sys_sendmsg net/socket.c:2650 [inline] > __se_sys_sendmsg net/socket.c:2648 [inline] > __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 > entry_SYSCALL_64_after_hwframe+0x63/0x6b > > sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the > socket waiting for the event. However, sk_stream_wait_connect() returns > success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function > that waits for a connection with sk_stream_wait_connect() may misbehave. > > In the case of the above DCCP issue, dccp_sendmsg() is waiting for the > connection. If disconnect() is called in concurrently, the above issue > occurs. > > This patch fixes the issue by returning error from sk_stream_wait_connect() > if sk_wait_event() fails. > > Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") > Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com>
On Thu, 14 Dec 2023 17:46:22 +0900, Kuniyuki Iwashima wrote: > From: Shigeru Yoshida <syoshida@redhat.com> > Date: Thu, 14 Dec 2023 14:09:22 +0900 >> The following NULL pointer dereference issue occurred: >> >> BUG: kernel NULL pointer dereference, address: 0000000000000000 >> <...> >> RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] >> RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 >> <...> >> Call Trace: >> <TASK> >> dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 >> inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 >> sock_sendmsg_nosec net/socket.c:730 [inline] >> __sock_sendmsg+0x83/0xe0 net/socket.c:745 >> ____sys_sendmsg+0x443/0x510 net/socket.c:2558 >> ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 >> __sys_sendmsg+0xa6/0x120 net/socket.c:2641 >> __do_sys_sendmsg net/socket.c:2650 [inline] >> __se_sys_sendmsg net/socket.c:2648 [inline] >> __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 >> do_syscall_x64 arch/x86/entry/common.c:51 [inline] >> do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 >> entry_SYSCALL_64_after_hwframe+0x63/0x6b >> >> sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the >> socket waiting for the event. However, sk_stream_wait_connect() returns >> success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function >> that waits for a connection with sk_stream_wait_connect() may misbehave. >> >> In the case of the above DCCP issue, dccp_sendmsg() is waiting for the >> connection. If disconnect() is called in concurrently, the above issue >> occurs. >> >> This patch fixes the issue by returning error from sk_stream_wait_connect() >> if sk_wait_event() fails. >> >> Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") >> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> > > Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> > > I guess you picked this issue from syzbot's report. > https://lore.kernel.org/netdev/0000000000009e122006088a2b8d@google.com/ > > If so, let's give a proper credit to syzbot and its authors: > > Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com Hi Kuniyuki-san, Thank you very much for your review. I didn't notice the syzbot's report. Actually, I found this issue by running syzkaller on my machine. Now, I tested this patch with syzbot, and it looks good. Reported-and-tested-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com Thanks, Shigeru > > Thanks! > >> --- >> net/core/stream.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/net/core/stream.c b/net/core/stream.c >> index 96fbcb9bbb30..b16dfa568a2d 100644 >> --- a/net/core/stream.c >> +++ b/net/core/stream.c >> @@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) >> remove_wait_queue(sk_sleep(sk), &wait); >> sk->sk_write_pending--; >> } while (!done); >> - return 0; >> + return done < 0 ? done : 0; >> } >> EXPORT_SYMBOL(sk_stream_wait_connect); >> >> -- >> 2.41.0 >> >
From: Shigeru Yoshida <syoshida@redhat.com> Date: Thu, 14 Dec 2023 22:31:06 +0900 (JST) > On Thu, 14 Dec 2023 17:46:22 +0900, Kuniyuki Iwashima wrote: > > From: Shigeru Yoshida <syoshida@redhat.com> > > Date: Thu, 14 Dec 2023 14:09:22 +0900 > >> The following NULL pointer dereference issue occurred: > >> > >> BUG: kernel NULL pointer dereference, address: 0000000000000000 > >> <...> > >> RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] > >> RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 > >> <...> > >> Call Trace: > >> <TASK> > >> dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 > >> inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 > >> sock_sendmsg_nosec net/socket.c:730 [inline] > >> __sock_sendmsg+0x83/0xe0 net/socket.c:745 > >> ____sys_sendmsg+0x443/0x510 net/socket.c:2558 > >> ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 > >> __sys_sendmsg+0xa6/0x120 net/socket.c:2641 > >> __do_sys_sendmsg net/socket.c:2650 [inline] > >> __se_sys_sendmsg net/socket.c:2648 [inline] > >> __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 > >> do_syscall_x64 arch/x86/entry/common.c:51 [inline] > >> do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 > >> entry_SYSCALL_64_after_hwframe+0x63/0x6b > >> > >> sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the > >> socket waiting for the event. However, sk_stream_wait_connect() returns > >> success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function > >> that waits for a connection with sk_stream_wait_connect() may misbehave. > >> > >> In the case of the above DCCP issue, dccp_sendmsg() is waiting for the > >> connection. If disconnect() is called in concurrently, the above issue > >> occurs. > >> > >> This patch fixes the issue by returning error from sk_stream_wait_connect() > >> if sk_wait_event() fails. > >> > >> Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") > >> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> > > > > Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> > > > > I guess you picked this issue from syzbot's report. > > https://lore.kernel.org/netdev/0000000000009e122006088a2b8d@google.com/ > > > > If so, let's give a proper credit to syzbot and its authors: > > > > Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com > > Hi Kuniyuki-san, > > Thank you very much for your review. I didn't notice the syzbot's > report. Actually, I found this issue by running syzkaller on my > machine. Thanks for clarifying. I'm also running syzkaller locally and used to add Reported-by: syzbot <syzkaller@googlegroups.com> But, it was confusing for syzbot's owners, and I got a mail from one of the authors, Aleksandr Nogikh. Since then, if syzkaller found an issue that was not on the syzbot dashboard, I have used Reported-by: syzkaller <syzkaller@googlegroups.com> . FWIW, here's Aleksandr's words from the mail. ---8<--- Maybe it would be just a little more clear if instead of Reported-by: syzbot <syzkaller@googlegroups.com> you'd write Reported-by: syzkaller <syzkaller@googlegroups.com> if the bug was found only by a local syzkaller instance, because otherwise it implies that the bug was found by syzbot, which is not really the case here :) ---8<--- > > Now, I tested this patch with syzbot, and it looks good. > > Reported-and-tested-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com This time, this tag is best. Thanks!
On Thu, 14 Dec 2023 22:46:14 +0900, Kuniyuki Iwashima wrote: > From: Shigeru Yoshida <syoshida@redhat.com> > Date: Thu, 14 Dec 2023 22:31:06 +0900 (JST) >> On Thu, 14 Dec 2023 17:46:22 +0900, Kuniyuki Iwashima wrote: >> > From: Shigeru Yoshida <syoshida@redhat.com> >> > Date: Thu, 14 Dec 2023 14:09:22 +0900 >> >> The following NULL pointer dereference issue occurred: >> >> >> >> BUG: kernel NULL pointer dereference, address: 0000000000000000 >> >> <...> >> >> RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] >> >> RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 >> >> <...> >> >> Call Trace: >> >> <TASK> >> >> dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 >> >> inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 >> >> sock_sendmsg_nosec net/socket.c:730 [inline] >> >> __sock_sendmsg+0x83/0xe0 net/socket.c:745 >> >> ____sys_sendmsg+0x443/0x510 net/socket.c:2558 >> >> ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 >> >> __sys_sendmsg+0xa6/0x120 net/socket.c:2641 >> >> __do_sys_sendmsg net/socket.c:2650 [inline] >> >> __se_sys_sendmsg net/socket.c:2648 [inline] >> >> __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 >> >> do_syscall_x64 arch/x86/entry/common.c:51 [inline] >> >> do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 >> >> entry_SYSCALL_64_after_hwframe+0x63/0x6b >> >> >> >> sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the >> >> socket waiting for the event. However, sk_stream_wait_connect() returns >> >> success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function >> >> that waits for a connection with sk_stream_wait_connect() may misbehave. >> >> >> >> In the case of the above DCCP issue, dccp_sendmsg() is waiting for the >> >> connection. If disconnect() is called in concurrently, the above issue >> >> occurs. >> >> >> >> This patch fixes the issue by returning error from sk_stream_wait_connect() >> >> if sk_wait_event() fails. >> >> >> >> Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") >> >> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> >> > >> > Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> >> > >> > I guess you picked this issue from syzbot's report. >> > https://lore.kernel.org/netdev/0000000000009e122006088a2b8d@google.com/ >> > >> > If so, let's give a proper credit to syzbot and its authors: >> > >> > Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com >> >> Hi Kuniyuki-san, >> >> Thank you very much for your review. I didn't notice the syzbot's >> report. Actually, I found this issue by running syzkaller on my >> machine. > > Thanks for clarifying. > > I'm also running syzkaller locally and used to add > > Reported-by: syzbot <syzkaller@googlegroups.com> > > But, it was confusing for syzbot's owners, and I got a mail from one of > the authors, Aleksandr Nogikh. Since then, if syzkaller found an issue > that was not on the syzbot dashboard, I have used > > Reported-by: syzkaller <syzkaller@googlegroups.com> Thanks for your information. This tag looks great, so I will use this next time I send a fix found by local syzkaller :) Thanks, Shigeru > > . FWIW, here's Aleksandr's words from the mail. > > ---8<--- > Maybe it would be just a little more clear if instead of > Reported-by: syzbot <syzkaller@googlegroups.com> > you'd write > Reported-by: syzkaller <syzkaller@googlegroups.com> > if the bug was found only by a local syzkaller instance, because > otherwise it implies that the bug was found by syzbot, which is not > really the case here :) > ---8<--- > > >> >> Now, I tested this patch with syzbot, and it looks good. >> >> Reported-and-tested-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com > > This time, this tag is best. > > Thanks! > >
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Thu, 14 Dec 2023 14:09:22 +0900 you wrote: > The following NULL pointer dereference issue occurred: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > <...> > RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] > RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 > <...> > Call Trace: > <TASK> > dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 > inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 > sock_sendmsg_nosec net/socket.c:730 [inline] > __sock_sendmsg+0x83/0xe0 net/socket.c:745 > ____sys_sendmsg+0x443/0x510 net/socket.c:2558 > ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 > __sys_sendmsg+0xa6/0x120 net/socket.c:2641 > __do_sys_sendmsg net/socket.c:2650 [inline] > __se_sys_sendmsg net/socket.c:2648 [inline] > __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 > entry_SYSCALL_64_after_hwframe+0x63/0x6b > > [...] Here is the summary with links: - [net] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails https://git.kernel.org/netdev/net/c/cac23b7d7627 You are awesome, thank you!
diff --git a/net/core/stream.c b/net/core/stream.c index 96fbcb9bbb30..b16dfa568a2d 100644 --- a/net/core/stream.c +++ b/net/core/stream.c @@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) remove_wait_queue(sk_sleep(sk), &wait); sk->sk_write_pending--; } while (!done); - return 0; + return done < 0 ? done : 0; } EXPORT_SYMBOL(sk_stream_wait_connect);