Eric Dumazet
e68fb96236
soreuseport: initialise timewait reuseport field
commit 3099a52918 upstream.
syzbot reported an uninit-value in inet_csk_bind_conflict() [1]
It turns out we never propagated sk->sk_reuseport into timewait socket.
[1]
BUG: KMSAN: uninit-value in inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151
CPU: 1 PID: 3589 Comm: syzkaller008242 Not tainted 4.16.0+ #82
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
__msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151
inet_csk_get_port+0x1d28/0x1e40 net/ipv4/inet_connection_sock.c:320
inet6_bind+0x121c/0x1820 net/ipv6/af_inet6.c:399
SYSC_bind+0x3f2/0x4b0 net/socket.c:1474
SyS_bind+0x54/0x80 net/socket.c:1460
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x4416e9
RSP: 002b:00007ffce6d15c88 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00000000004416e9
RDX: 000000000000001c RSI: 0000000020402000 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00000000e6d15e08 R09: 00000000e6d15e08
R10: 0000000000000004 R11: 0000000000000217 R12: 0000000000009478
R13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]
kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684
__msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521
tcp_time_wait+0xf17/0xf50 net/ipv4/tcp_minisocks.c:283
tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003
tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331
sk_backlog_rcv include/net/sock.h:908 [inline]
__release_sock+0x2d6/0x680 net/core/sock.c:2271
release_sock+0x97/0x2a0 net/core/sock.c:2786
tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269
inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427
inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435
sock_release net/socket.c:595 [inline]
sock_close+0xe0/0x300 net/socket.c:1149
__fput+0x49e/0xa10 fs/file_table.c:209
____fput+0x37/0x40 fs/file_table.c:243
task_work_run+0x243/0x2c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x10e1/0x38d0 kernel/exit.c:867
do_group_exit+0x1a0/0x360 kernel/exit.c:970
SYSC_exit_group+0x21/0x30 kernel/exit.c:981
SyS_exit_group+0x25/0x30 kernel/exit.c:979
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]
kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684
__msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521
inet_twsk_alloc+0xaef/0xc00 net/ipv4/inet_timewait_sock.c:182
tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258
tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003
tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331
sk_backlog_rcv include/net/sock.h:908 [inline]
__release_sock+0x2d6/0x680 net/core/sock.c:2271
release_sock+0x97/0x2a0 net/core/sock.c:2786
tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269
inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427
inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435
sock_release net/socket.c:595 [inline]
sock_close+0xe0/0x300 net/socket.c:1149
__fput+0x49e/0xa10 fs/file_table.c:209
____fput+0x37/0x40 fs/file_table.c:243
task_work_run+0x243/0x2c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x10e1/0x38d0 kernel/exit.c:867
do_group_exit+0x1a0/0x360 kernel/exit.c:970
SYSC_exit_group+0x21/0x30 kernel/exit.c:981
SyS_exit_group+0x25/0x30 kernel/exit.c:979
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756
inet_twsk_alloc+0x13b/0xc00 net/ipv4/inet_timewait_sock.c:163
tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258
tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003
tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331
sk_backlog_rcv include/net/sock.h:908 [inline]
__release_sock+0x2d6/0x680 net/core/sock.c:2271
release_sock+0x97/0x2a0 net/core/sock.c:2786
tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269
inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427
inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435
sock_release net/socket.c:595 [inline]
sock_close+0xe0/0x300 net/socket.c:1149
__fput+0x49e/0xa10 fs/file_table.c:209
____fput+0x37/0x40 fs/file_table.c:243
task_work_run+0x243/0x2c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x10e1/0x38d0 kernel/exit.c:867
do_group_exit+0x1a0/0x360 kernel/exit.c:970
SYSC_exit_group+0x21/0x30 kernel/exit.c:981
SyS_exit_group+0x25/0x30 kernel/exit.c:979
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Fixes: da5e36308d ("soreuseport: TCP/IPv4 implementation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-16 10:08:41 +02:00
..
2018-04-20 08:21:07 +02:00
2017-11-18 11:22:24 +01:00
2016-09-25 23:34:19 +02:00
2016-07-11 02:01:14 +02:00
2018-02-25 11:05:41 +01:00
2016-09-23 07:22:11 -04:00
2016-06-15 20:41:22 -07:00
2016-08-17 19:27:51 -04:00
2017-05-14 14:00:21 +02:00
2016-09-08 11:10:12 +01:00
2016-09-04 13:29:29 -07:00
2017-12-25 14:23:37 +01:00
2018-01-31 12:55:55 +01:00
2016-09-27 21:15:21 -04:00
2016-06-27 15:06:17 -04:00
2018-04-13 19:47:49 +02:00
2016-07-08 12:20:57 +02:00
2017-02-18 15:11:41 +01:00
2016-06-25 12:19:35 -04:00
2016-06-09 23:41:03 -07:00
2016-08-26 11:55:18 -07:00
2016-09-23 08:38:50 -04:00
2016-09-10 20:53:55 -07:00
2017-06-07 12:07:46 +02:00
2016-06-08 11:36:02 -07:00
2016-09-01 16:51:08 -07:00
2016-09-10 23:12:53 -07:00
2016-05-20 18:03:16 -04:00
2016-09-30 13:29:21 +02:00
2016-09-30 13:29:21 +02:00
2016-06-07 16:37:14 -07:00
2016-06-17 20:23:32 -07:00
2016-08-18 01:17:32 -04:00
2016-11-15 22:27:27 -05:00
2016-07-25 17:55:43 -07:00
2016-09-12 11:45:45 +02:00
2016-10-14 10:59:15 -04:00
2016-05-20 18:03:17 -04:00
2016-09-21 00:23:01 -04:00
2016-08-13 15:08:00 -07:00
2017-09-20 08:19:55 +02:00
2017-11-18 11:22:22 +01:00
2018-05-16 10:08:41 +02:00
2017-09-20 08:19:53 +02:00
2017-07-21 07:42:19 +02:00
2016-11-02 15:18:36 -04:00
2017-06-07 12:07:46 +02:00
2016-09-17 10:13:07 -04:00
2016-06-06 09:47:25 +09:00
2018-01-02 20:35:10 +01:00
2018-01-31 12:55:53 +01:00
2017-08-11 08:49:34 -07:00
2016-08-17 19:36:23 -04:00
2016-10-13 12:05:26 -04:00
2018-04-29 11:32:00 +02:00
2017-02-18 15:11:42 +01:00
2018-01-17 09:38:49 +01:00
2016-07-08 13:23:12 +02:00
2016-10-03 02:00:22 -04:00
2016-10-04 02:11:51 -04:00
2016-06-15 20:41:23 -07:00
2018-01-31 12:55:54 +01:00
2016-07-05 09:06:29 -07:00
2016-06-27 15:06:18 -04:00
2017-10-12 11:51:25 +02:00
2018-05-16 10:08:41 +02:00
2016-07-08 12:20:57 +02:00
2016-09-28 05:02:44 -04:00
2016-08-10 17:19:02 -07:00
2016-08-15 10:55:53 -07:00
2018-02-25 11:05:48 +01:00
2016-09-10 23:12:53 -07:00
2016-06-30 06:15:04 -04:00
2018-03-31 18:11:33 +02:00
2018-04-20 08:21:07 +02:00
2017-12-16 16:25:45 +01:00
2016-08-28 23:32:41 -04:00
2016-09-28 04:48:00 -04:00
2018-03-22 09:17:43 +01:00
2016-06-17 20:23:32 -07:00
2016-10-20 14:45:52 -04:00
2018-03-11 16:21:32 +01:00
2017-07-21 07:42:18 +02:00
2018-04-13 19:48:00 +02:00
2017-07-05 14:40:28 +02:00