Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1587613

[PATCH 3.16 12/12] tcp: avoid infinite loop in tcp_splice_read()

Show all headers | View raw

3.16.41-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

commit ccf7abb93af09ad0868ae9033d1ca8108bdaec82 upstream.

Splicing from TCP socket is vulnerable when a packet with URG flag is
received and stored into receive queue.

__tcp_splice_read() returns 0, and sk_wait_data() immediately
returns since there is the problematic skb in queue.

This is a nice way to burn cpu (aka infinite loop) and trigger
soft lockups.

Again, this gem was found by syzkaller tool.

Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov  <dvyukov@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/ipv4/tcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -765,6 +765,12 @@ ssize_t tcp_splice_read(struct socket *s
 				ret = -EAGAIN;
 				break;
 			}
+			/* if __tcp_splice_read() got nothing while we have
+			 * an skb in receive queue, we do not want to loop.
+			 * This might happen with URG data.
+			 */
+			if (!skb_queue_empty(&sk->sk_receive_queue))
+				break;
 			sk_wait_data(sk, &timeo);
 			if (signal_pending(current)) {
 				ret = sock_intr_errno(timeo);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.16 00/12] 3.16.41-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:10 +0100
  [PATCH 3.16 12/12] tcp: avoid infinite loop in tcp_splice_read() Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 04/12] KVM: x86: fix emulation of "MOV SS, null selector" Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 07/12] USB: serial: kl5kusb105: fix line-state error  handling Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 06/12] selinux: fix off-by-one in setprocattr Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 02/12] kvm: nVMX: Allow L1 to intercept software  exceptions (#BP and #OF) Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 01/12] mnt: Add a per mount namespace limit on the  number of mounts Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  [PATCH 3.16 03/12] ext4: validate s_first_meta_bg at mount time Ben Hutchings <ben@decadent.org.uk> - 2017-02-24 14:20 +0100
  Re: [PATCH 3.16 00/12] 3.16.41-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-02-24 17:30 +0100

csiph-web