Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1710045

[PATCH 4.9 04/16] net: fix keepalive code vs TCP_FASTOPEN_CONNECT

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 2dda640040876cd8ae646408b69eea40c24f9ae9 ]

syzkaller was able to trigger a divide by 0 in TCP stack [1]

Issue here is that keepalive timer needs to be updated to not attempt
to send a probe if the connection setup was deferred using
TCP_FASTOPEN_CONNECT socket option added in linux-4.11

[1]
 divide error: 0000 [#1] SMP
 CPU: 18 PID: 0 Comm: swapper/18 Not tainted
 task: ffff986f62f4b040 ti: ffff986f62fa2000 task.ti: ffff986f62fa2000
 RIP: 0010:[<ffffffff8409cc0d>]  [<ffffffff8409cc0d>] __tcp_select_window+0x8d/0x160
 Call Trace:
  <IRQ>
  [<ffffffff8409d951>] tcp_transmit_skb+0x11/0x20
  [<ffffffff8409da21>] tcp_xmit_probe_skb+0xc1/0xe0
  [<ffffffff840a0ee8>] tcp_write_wakeup+0x68/0x160
  [<ffffffff840a151b>] tcp_keepalive_timer+0x17b/0x230
  [<ffffffff83b3f799>] call_timer_fn+0x39/0xf0
  [<ffffffff83b40797>] run_timer_softirq+0x1d7/0x280
  [<ffffffff83a04ddb>] __do_softirq+0xcb/0x257
  [<ffffffff83ae03ac>] irq_exit+0x9c/0xb0
  [<ffffffff83a04c1a>] smp_apic_timer_interrupt+0x6a/0x80
  [<ffffffff83a03eaf>] apic_timer_interrupt+0x7f/0x90
  <EOI>
  [<ffffffff83fed2ea>] ? cpuidle_enter_state+0x13a/0x3b0
  [<ffffffff83fed2cd>] ? cpuidle_enter_state+0x11d/0x3b0

Tested:

Following packetdrill no longer crashes the kernel

`echo 0 >/proc/sys/net/ipv4/tcp_timestamps`

// Cache warmup: send a Fast Open cookie request
    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
   +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
   +0 setsockopt(3, SOL_TCP, TCP_FASTOPEN_CONNECT, [1], 4) = 0
   +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation is now in progress)
   +0 > S 0:0(0) <mss 1460,nop,nop,sackOK,nop,wscale 8,FO,nop,nop>
 +.01 < S. 123:123(0) ack 1 win 14600 <mss 1460,nop,nop,sackOK,nop,wscale 6,FO abcd1234,nop,nop>
   +0 > . 1:1(0) ack 1
   +0 close(3) = 0
   +0 > F. 1:1(0) ack 1
   +0 < F. 1:1(0) ack 2 win 92
   +0 > .  2:2(0) ack 2

   +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 4
   +0 fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
   +0 setsockopt(4, SOL_TCP, TCP_FASTOPEN_CONNECT, [1], 4) = 0
   +0 setsockopt(4, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
 +.01 connect(4, ..., ...) = 0
   +0 setsockopt(4, SOL_TCP, TCP_KEEPIDLE, [5], 4) = 0
   +10 close(4) = 0

`echo 1 >/proc/sys/net/ipv4/tcp_timestamps`

Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Wei Wang <weiwan@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_timer.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -654,7 +654,8 @@ static void tcp_keepalive_timer (unsigne
 		goto death;
 	}
 
-	if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
+	if (!sock_flag(sk, SOCK_KEEPOPEN) ||
+	    ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
 		goto out;
 
 	elapsed = keepalive_time_when(tp);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/16] 4.9.43-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:10 +0200
  [PATCH 4.9 07/16] net: sched: set xt_tgchk_param par.nft_compat as 0 in ipt_init_target Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:10 +0200
  [PATCH 4.9 13/16] revert "ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:10 +0200
  [PATCH 4.9 08/16] tcp: fastopen: tcp_connect() must refresh the route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 16/16] KVM: arm/arm64: Handle hva aging while destroying the vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 11/16] packet: fix tp_reserve race in packet_set_ring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 15/16] sparc64: Prevent perf from running during super critical sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 04/16] net: fix keepalive code vs TCP_FASTOPEN_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 12/16] revert "net: account for current skb length when deciding about UFO" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 03/16] tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 06/16] net/mlx4_en: dont set CHECKSUM_COMPLETE on SCTP packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 14/16] udp: consistently apply ufo or fragmentation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 05/16] bpf, s390: fix jit branch offset related to ldimm64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 10/16] igmp: Fix regression caused by igmp sysctl namespace code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 02/16] ppp: fix xmit recursion detection on ppp channels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  [PATCH 4.9 01/16] ppp: Fix false xmit recursion detect with two ppp devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 00:20 +0200
  Re: [PATCH 4.9 00/16] 4.9.43-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-12 04:00 +0200
  Re: [PATCH 4.9 00/16] 4.9.43-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-12 14:40 +0200
    Re: [PATCH 4.9 00/16] 4.9.43-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-12 18:10 +0200
      Re: [PATCH 4.9 00/16] 4.9.43-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-12 18:30 +0200

csiph-web