Changes in syncookies.c

46a02aa3 - tcp: use sk_skb_reason_drop to free rx packets

Mon, 17 Jun 2024 18:09:20 +0000

tcp: use sk_skb_reason_drop to free rx packetsReplace kfree_skb_reason with sk_skb_reason_drop and pass the receivingsocket to the tracepoint.Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202406011539.jhwBd7DX-lkp@intel.com/Signed-off-by: Yan Zhai Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

f410cbea - tcp: annotate data-races around tp->window_clamp

Thu, 04 Apr 2024 11:42:31 +0000

tcp: annotate data-races around tp->window_clamptp->window_clamp can be read locklessly, add READ_ONCE()and WRITE_ONCE() annotations.Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Link: https://lore.kernel.org/r/20240404114231.2195171-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

956c0d61 - tcp: Clear req->syncookie in reqsk_alloc().

Fri, 15 Mar 2024 22:47:10 +0000

tcp: Clear req->syncookie in reqsk_alloc().syzkaller reported a read of uninit req->syncookie. [0]Originally, req->syncookie was used only in tcp_conn_request()to indicate if we need to encode SYN cookie in SYN+ACK, so thefield remains uninitialised in other places.The commit 695751e31a63 ("bpf: tcp: Handle BPF SYN Cookie incookie_v[46]_check().") added another meaning in ACK path;req->syncookie is set true if SYN cookie is validated by BPFkfunc.After the change, cookie_v[46]_check() always read req->syncookie,but it is not initialised in the normal SYN cookie case as reportedby KMSAN.Let's make sure we always initialise req->syncookie in reqsk_alloc().[0]:BUG: KMSAN: uninit-value in cookie_v4_check+0x22b7/0x29e0 net/ipv4/syncookies.c:477 cookie_v4_check+0x22b7/0x29e0 net/ipv4/syncookies.c:477 tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1855 [inline] tcp_v4_do_rcv+0xb17/0x10b0 net/ipv4/tcp_ipv4.c:1914 tcp_v4_rcv+0x4ce4/0x5420 net/ipv4/tcp_ipv4.c:2322 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x332/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x319/0x9e0 net/core/dev.c:5652 process_backlog+0x480/0x8b0 net/core/dev.c:5981 __napi_poll+0xe7/0x980 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x89d/0x1820 net/core/dev.c:6813 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2776/0x52c0 net/core/dev.c:4362 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip_finish_output2+0x187a/0x1b70 net/ipv4/ip_output.c:235 __ip_finish_output+0x287/0x810 ip_finish_output+0x4b/0x550 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:450 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] __ip_queue_xmit+0x1e93/0x2030 net/ipv4/ip_output.c:535 ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:549 __tcp_transmit_skb+0x3c70/0x4890 net/ipv4/tcp_output.c:1462 tcp_transmit_skb net/ipv4/tcp_output.c:1480 [inline] tcp_write_xmit+0x3ee1/0x8900 net/ipv4/tcp_output.c:2792 __tcp_push_pending_frames net/ipv4/tcp_output.c:2977 [inline] tcp_send_fin+0xa90/0x12e0 net/ipv4/tcp_output.c:3578 tcp_shutdown+0x198/0x1f0 net/ipv4/tcp.c:2716 inet_shutdown+0x33f/0x5b0 net/ipv4/af_inet.c:923 __sys_shutdown_sock net/socket.c:2425 [inline] __sys_shutdown net/socket.c:2437 [inline] __do_sys_shutdown net/socket.c:2445 [inline] __se_sys_shutdown+0x2a4/0x440 net/socket.c:2443 __x64_sys_shutdown+0x6c/0xa0 net/socket.c:2443 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75Uninit was stored to memory at: reqsk_alloc include/net/request_sock.h:148 [inline] inet_reqsk_alloc+0x651/0x7a0 net/ipv4/tcp_input.c:6978 cookie_tcp_reqsk_alloc+0xd4/0x900 net/ipv4/syncookies.c:328 cookie_tcp_check net/ipv4/syncookies.c:388 [inline] cookie_v4_check+0x289f/0x29e0 net/ipv4/syncookies.c:420 tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1855 [inline] tcp_v4_do_rcv+0xb17/0x10b0 net/ipv4/tcp_ipv4.c:1914 tcp_v4_rcv+0x4ce4/0x5420 net/ipv4/tcp_ipv4.c:2322 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x332/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x319/0x9e0 net/core/dev.c:5652 process_backlog+0x480/0x8b0 net/core/dev.c:5981 __napi_poll+0xe7/0x980 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x89d/0x1820 net/core/dev.c:6813 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554Uninit was created at: __alloc_pages+0x9a7/0xe00 mm/page_alloc.c:4592 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2175 [inline] allocate_slab mm/slub.c:2338 [inline] new_slab+0x2de/0x1400 mm/slub.c:2391 ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852 reqsk_alloc include/net/request_sock.h:131 [inline] inet_reqsk_alloc+0x66/0x7a0 net/ipv4/tcp_input.c:6978 tcp_conn_request+0x484/0x44e0 net/ipv4/tcp_input.c:7135 tcp_v4_conn_request+0x16f/0x1d0 net/ipv4/tcp_ipv4.c:1716 tcp_rcv_state_process+0x2e5/0x4bb0 net/ipv4/tcp_input.c:6655 tcp_v4_do_rcv+0xbfd/0x10b0 net/ipv4/tcp_ipv4.c:1929 tcp_v4_rcv+0x4ce4/0x5420 net/ipv4/tcp_ipv4.c:2322 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x332/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] ip_sublist_rcv+0x15f3/0x17f0 net/ipv4/ip_input.c:639 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:674 __netif_receive_skb_list_ptype net/core/dev.c:5581 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5629 __netif_receive_skb_list net/core/dev.c:5681 [inline] netif_receive_skb_list_internal+0x106c/0x16f0 net/core/dev.c:5773 gro_normal_list include/net/gro.h:438 [inline] napi_complete_done+0x425/0x880 net/core/dev.c:6113 virtqueue_napi_complete drivers/net/virtio_net.c:465 [inline] virtnet_poll+0x149d/0x2240 drivers/net/virtio_net.c:2211 __napi_poll+0xe7/0x980 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x89d/0x1820 net/core/dev.c:6813 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554CPU: 0 PID: 16792 Comm: syz-executor.2 Not tainted 6.8.0-syzkaller-05562-g61387b8dcf1d #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024Fixes: 695751e31a63 ("bpf: tcp: Handle BPF SYN Cookie in cookie_v[46]_check().")Reported-by: syzkaller Reported-by: Eric Dumazet Closes: https://lore.kernel.org/bpf/CANn89iKdN9c+C_2JAUbc+VY3DDQjAQukMtiBbormAmAk9CdvQA@mail.gmail.com/Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20240315224710.55209-1-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

253541a3 - tcp: use drop reasons in cookie check for ipv6

Mon, 26 Feb 2024 03:22:22 +0000

tcp: use drop reasons in cookie check for ipv6Like what I did to ipv4 mode, refine this part: adding more dropreasons for better tracing.Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

ed43e76c - tcp: directly drop skb in cookie check for ipv6

Mon, 26 Feb 2024 03:22:21 +0000

tcp: directly drop skb in cookie check for ipv6Like previous patch does, only moving skb drop logical code tocookie_v6_check() for later refinement.Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

695751e3 - bpf: tcp: Handle BPF SYN Cookie in cookie_v[46]_check().

Mon, 15 Jan 2024 20:55:12 +0000

bpf: tcp: Handle BPF SYN Cookie in cookie_v[46]_check().We will support arbitrary SYN Cookie with BPF in the followingpatch.If BPF prog validates ACK and kfunc allocates a reqsk, it willbe carried to cookie_[46]_check() as skb->sk. If skb->sk is notNULL, we call cookie_bpf_check().Then, we clear skb->sk and skb->destructor, which are needed notto hold refcnt for reqsk and the listener. See the following patchfor details.After that, we finish initialisation for the remaining fields withcookie_tcp_reqsk_init().Note that the server side WScale is set only for non-BPF SYN Cookie.Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20240115205514.68364-5-kuniyu@amazon.comSigned-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov List of files: /linux-6.15/net/ipv6/syncookies.c

8e7bab6b - tcp: Factorise cookie-dependent fields initialisation in cookie_v[46]_check()

Wed, 29 Nov 2023 02:29:24 +0000

tcp: Factorise cookie-dependent fields initialisation in cookie_v[46]_check()We will support arbitrary SYN Cookie with BPF, and then kfunc atTC will preallocate reqsk and initialise some fields that shouldnot be overwritten later by cookie_v[46]_check().To simplify the flow in cookie_v[46]_check(), we move such fields'initialisation to cookie_tcp_reqsk_alloc() and factorise non-BPFSYN Cookie handling into cookie_tcp_check(), where we validate thecookie and allocate reqsk, as done by kfunc later.Note that we set ireq->ecn_ok in two steps, the latter of which willbe shared by the BPF case. As cookie_ecn_ok() is one-liner, nowit's inlined.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-9-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

de5626b9 - tcp: Factorise cookie-independent fields initialisation in cookie_v[46]_check().

Wed, 29 Nov 2023 02:29:23 +0000

tcp: Factorise cookie-independent fields initialisation in cookie_v[46]_check().We will support arbitrary SYN Cookie with BPF, and then some reqsk fieldsare initialised in kfunc, and others are done in cookie_v[46]_check().This patch factorises the common part as cookie_tcp_reqsk_init() andcalls it in cookie_tcp_reqsk_alloc() to minimise the discrepancy betweencookie_v[46]_check().Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-8-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

7b0f570f - tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie().

Wed, 29 Nov 2023 02:29:22 +0000

tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie().We initialise treq->af_specific in cookie_tcp_reqsk_alloc() so thatwe can look up a key later in tcp_create_openreq_child().Initially, that change was added for MD5 by commit ba5a4fdd63ae ("tcp:make sure treq->af_specific is initialized"), but it has not been usedsince commit d0f2b7a9ca0a ("tcp: Disable header prediction for MD5flow.").Now, treq->af_specific is used only by TCP-AO, so, we can move thatinitialisation into tcp_ao_syncookie().In addition to that, l3index in cookie_v[46]_check() is only used fortcp_ao_syncookie(), so let's move it as well.While at it, we move down tcp_ao_syncookie() in cookie_v4_check() sothat it will be called after security_inet_conn_request() to makefunctions order consistent with cookie_v6_check().Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-7-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

efce3d1f - tcp: Don't initialise tp->tsoffset in tcp_get_cookie_sock().

Wed, 29 Nov 2023 02:29:21 +0000

tcp: Don't initialise tp->tsoffset in tcp_get_cookie_sock().When we create a full socket from SYN Cookie, we initialisetcp_sk(sk)->tsoffset redundantly in tcp_get_cookie_sock() asthe field is inherited from tcp_rsk(req)->ts_off. cookie_v[46]_check |- treq->ts_off = 0 `- tcp_get_cookie_sock |- tcp_v[46]_syn_recv_sock | `- tcp_create_openreq_child | `- newtp->tsoffset = treq->ts_off `- tcp_sk(child)->tsoffset = tsoffLet's initialise tcp_rsk(req)->ts_off with the correct offsetand remove the second initialisation of tcp_sk(sk)->tsoffset.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-6-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

7577bc82 - tcp: Don't pass cookie to __cookie_v[46]_check().

Wed, 29 Nov 2023 02:29:20 +0000

tcp: Don't pass cookie to __cookie_v[46]_check().tcp_hdr(skb) and SYN Cookie are passed to __cookie_v[46]_check(), butnone of the callers passes cookie other than ntohl(th->ack_seq) - 1.Let's fetch it in __cookie_v[46]_check() instead of passing the cookieover and over.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-5-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

50468cdd - tcp: Clean up goto labels in cookie_v[46]_check().

Wed, 29 Nov 2023 02:29:19 +0000

tcp: Clean up goto labels in cookie_v[46]_check().We will support arbitrary SYN Cookie with BPF, and then reqskwill be preallocated before cookie_v[46]_check().Depending on how validation fails, we send RST or just drop skb.To make the error handling easier, let's clean up goto labels.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-4-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

45c28509 - tcp: Cache sock_net(sk) in cookie_v[46]_check().

Wed, 29 Nov 2023 02:29:18 +0000

tcp: Cache sock_net(sk) in cookie_v[46]_check().sock_net(sk) is used repeatedly in cookie_v[46]_check().Let's cache it in a variable.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-3-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

34efc9cf - tcp: Clean up reverse xmas tree in cookie_v[46]_check().

Wed, 29 Nov 2023 02:29:17 +0000

tcp: Clean up reverse xmas tree in cookie_v[46]_check().We will grow and cut the xmas tree in cookie_v[46]_check().This patch cleans it up to make later patches tidy.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231129022924.96156-2-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c

23be1e0e - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.

Mon, 30 Oct 2023 20:10:42 +0000

dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of childsockets") introduced security_inet_conn_request() in some functionswhere reqsk is allocated. The hook is added just after the allocation,so reqsk's IPv6 remote address was not initialised then.However, SELinux/Smack started to read it in netlbl_req_setattr()after commit e1adea927080 ("calipso: Allow request sockets to berelabelled by the lsm.").Commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request()hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling wasnot supported at that time. Finally, the same issue was introduced againin IPv6.Let's apply the same fix on DCCPv6 and TCPv6.Fixes: e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.")Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Signed-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/syncookies.c

248411b8 - net/tcp: Wire up l3index to TCP-AO

Mon, 23 Oct 2023 19:22:13 +0000

net/tcp: Wire up l3index to TCP-AOSimilarly how TCP_MD5SIG_FLAG_IFINDEX works for TCP-MD5,TCP_AO_KEYF_IFINDEX is an AO-key flag that binds that MKT to a specifiedby L3 ifinndex. Similarly, without this flag the key will work inthe default VRF l3index = 0 for connections.To prevent AO-keys from overlapping, it's restricted to add key B for asocket that has key A, which have the same sndid/rcvid and one ofthe following is true:- !(A.keyflags & TCP_AO_KEYF_IFINDEX) or !(B.keyflags & TCP_AO_KEYF_IFINDEX) so that any key is non-bound to a VRF- A.l3index == B.l3index both want to work for the same VRFAdditionally, it's restricted to match TCP-MD5 keys for the same peerthe following way:|--------------|--------------------|----------------|---------------|| | MD5 key without | MD5 key | MD5 key || | l3index | l3index=0 | l3index=N ||--------------|--------------------|----------------|---------------|| TCP-AO key | | | || without | reject | reject | reject || l3index | | | ||--------------|--------------------|----------------|---------------|| TCP-AO key | | | || l3index=0 | reject | reject | allow ||--------------|--------------------|----------------|---------------|| TCP-AO key | | | || l3index=N | reject | allow | reject ||--------------|--------------------|----------------|---------------|This is done with the help of tcp_md5_do_lookup_any_l3index() to rejectadding AO key without TCP_AO_KEYF_IFINDEX if there's TCP-MD5 in any VRF.This is important for case where sysctl_tcp_l3mdev_accept = 1Similarly, for TCP-AO lookups tcp_ao_do_lookup() may be used withl3index < 0, so that __tcp_ao_key_cmp() will match TCP-AO key in any VRF.Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

06b22ef2 - net/tcp: Wire TCP-AO to request sockets

Mon, 23 Oct 2023 19:22:02 +0000

net/tcp: Wire TCP-AO to request socketsNow when the new request socket is created from the listening socket,it's recorded what MKT was used by the peer. tcp_rsk_used_ao() isa new helper for checking if TCP-AO option was used to create therequest socket.tcp_ao_copy_all_matching() will copy all keys that match the peer on therequest socket, as well as preparing them for the usage (creatingtraffic keys).Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

f2e383b5 - tcp: Fix data-races around sysctl_tcp_syncookies.

Fri, 15 Jul 2022 17:17:47 +0000

tcp: Fix data-races around sysctl_tcp_syncookies.While reading sysctl_tcp_syncookies, it can be changed concurrently.Thus, we need to add READ_ONCE() to its readers.Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

ba5a4fdd - tcp: make sure treq->af_specific is initialized

Sun, 24 Apr 2022 20:35:09 +0000

tcp: make sure treq->af_specific is initializedsyzbot complained about a recent change in TCP stack,hitting a NULL pointer [1]tcp request sockets have an af_specific pointer, whichwas used before the blamed change only for SYNACK generationin non SYNCOOKIE mode.tcp requests sockets momentarily created when third packetcoming from client in SYNCOOKIE mode were not usingtreq->af_specific.Make sure this field is populated, in the same way normalTCP requests sockets do in tcp_conn_request().[1]TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters.general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASANKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48RSP: 0018:ffffc90000de0588 EFLAGS: 00010202RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming connections")Signed-off-by: Eric Dumazet Cc: Francesco Ruggeri Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/syncookies.c

49ecc2e9 - net: align static siphash keys

Mon, 15 Nov 2021 17:23:03 +0000

net: align static siphash keyssiphash keys use 16 bytes.Define siphash_aligned_key_t macro so that we can make sure theyare not crossing a cache line boundary.Signed-off-by: Eric Dumazet Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/syncookies.c