leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
d737de2d7cc3efdacbf17d4e22efc75697bd76d9
linux/net/ipv4
History
Eric Dumazet 03cfda4fa6 tcp: fix another uninit-value (sk_rx_queue_mapping) 
KMSAN is still not happy [1].

I missed that passive connections do not inherit their
sk_rx_queue_mapping values from the request socket,
but instead tcp_child_process() is calling
sk_mark_napi_id(child, skb)

We have many sk_mark_napi_id() callers, so I am providing
a new helper, forcing the setting sk_rx_queue_mapping
and sk_napi_id.

Note that we had no KMSAN report for sk_napi_id because
passive connections got a copy of this field from the listener.
sk_rx_queue_mapping in the other hand is inside the
sk_dontcopy_begin/sk_dontcopy_end so sk_clone_lock()
leaves this field uninitialized.

We might remove dead code populating req->sk_rx_queue_mapping
in the future.

[1]

BUG: KMSAN: uninit-value in __sk_rx_queue_set include/net/sock.h:1924 [inline]
BUG: KMSAN: uninit-value in sk_rx_queue_update include/net/sock.h:1938 [inline]
BUG: KMSAN: uninit-value in sk_mark_napi_id include/net/busy_poll.h:136 [inline]
BUG: KMSAN: uninit-value in tcp_child_process+0xb42/0x1050 net/ipv4/tcp_minisocks.c:833
 __sk_rx_queue_set include/net/sock.h:1924 [inline]
 sk_rx_queue_update include/net/sock.h:1938 [inline]
 sk_mark_napi_id include/net/busy_poll.h:136 [inline]
 tcp_child_process+0xb42/0x1050 net/ipv4/tcp_minisocks.c:833
 tcp_v4_rcv+0x3d83/0x4ed0 net/ipv4/tcp_ipv4.c:2066
 ip_protocol_deliver_rcu+0x760/0x10b0 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_local_deliver+0x584/0x8c0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:460 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x11fd/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5505 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5553
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5605
 netif_receive_skb_list_internal+0x868/0xde0 net/core/dev.c:5696
 gro_normal_list net/core/dev.c:5850 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6587
 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
 virtnet_poll+0x17b6/0x2350 drivers/net/virtio_net.c:1557
 __napi_poll+0x14e/0xbc0 net/core/dev.c:7020
 napi_poll net/core/dev.c:7087 [inline]
 net_rx_action+0x824/0x1880 net/core/dev.c:7174
 __do_softirq+0x1fe/0x7eb kernel/softirq.c:558
 run_ksoftirqd+0x33/0x50 kernel/softirq.c:920
 smpboot_thread_fn+0x616/0xbf0 kernel/smpboot.c:164
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was created at:
 __alloc_pages+0xbc7/0x10a0 mm/page_alloc.c:5409
 alloc_pages+0x8a5/0xb80
 alloc_slab_page mm/slub.c:1810 [inline]
 allocate_slab+0x287/0x1c20 mm/slub.c:1947
 new_slab mm/slub.c:2010 [inline]
 ___slab_alloc+0xbdf/0x1e90 mm/slub.c:3039
 __slab_alloc mm/slub.c:3126 [inline]
 slab_alloc_node mm/slub.c:3217 [inline]
 slab_alloc mm/slub.c:3259 [inline]
 kmem_cache_alloc+0xbb3/0x11c0 mm/slub.c:3264
 sk_prot_alloc+0xeb/0x570 net/core/sock.c:1914
 sk_clone_lock+0xd6/0x1940 net/core/sock.c:2118
 inet_csk_clone_lock+0x8d/0x6a0 net/ipv4/inet_connection_sock.c:956
 tcp_create_openreq_child+0xb1/0x1ef0 net/ipv4/tcp_minisocks.c:453
 tcp_v4_syn_recv_sock+0x268/0x2710 net/ipv4/tcp_ipv4.c:1563
 tcp_check_req+0x207c/0x2a30 net/ipv4/tcp_minisocks.c:765
 tcp_v4_rcv+0x36f5/0x4ed0 net/ipv4/tcp_ipv4.c:2047
 ip_protocol_deliver_rcu+0x760/0x10b0 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_local_deliver+0x584/0x8c0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:460 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x11fd/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5505 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5553
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5605
 netif_receive_skb_list_internal+0x868/0xde0 net/core/dev.c:5696
 gro_normal_list net/core/dev.c:5850 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6587
 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
 virtnet_poll+0x17b6/0x2350 drivers/net/virtio_net.c:1557
 __napi_poll+0x14e/0xbc0 net/core/dev.c:7020
 napi_poll net/core/dev.c:7087 [inline]
 net_rx_action+0x824/0x1880 net/core/dev.c:7174
 __do_softirq+0x1fe/0x7eb kernel/softirq.c:558

Fixes: 342159ee39 ("net: avoid dirtying sk->sk_rx_queue_mapping")
Fixes: a37a0ee4d2 ("net: avoid uninit-value from tcp_conn_request")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Tested-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-03 14:15:49 +00:00
..
bpfilter
net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"
2020-08-10 12:06:44 -07:00
netfilter
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2021-10-18 14:05:25 +01:00
af_inet.c
net: introduce sk_forward_alloc_get()
2021-10-27 18:20:29 -07:00
ah4.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
arp.c
net: arp: introduce arp_evict_nocarrier sysctl parameter
2021-11-01 19:57:14 -07:00
bpf_tcp_ca.c
bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
2021-11-15 20:35:58 -08:00
cipso_ipv4.c
NET: IPV4: fix error "do not initialise globals to 0"
2021-09-19 12:43:56 +01:00
datagram.c
net/ipv4/datagram.c: remove superfluous header files from datagram.c
2021-09-29 11:39:33 +01:00
devinet.c
net: return correct error code
2021-11-15 14:22:12 +00:00
esp4_offload.c
xfrm: remove description from xfrm_type struct
2021-06-09 09:38:52 +02:00
esp4.c
ipsec: Remove unneeded extra variable in esp4 esp_ssg_unref()
2021-07-20 16:14:23 +02:00
fib_frontend.c
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-02 11:56:04 +00:00
fib_lookup.h
ipv4: Fix spelling mistakes
2021-06-07 14:08:30 -07:00
fib_notifier.c
net: ipv4: remove superfluous header files from fib_notifier.c
2021-09-28 17:32:56 -07:00
fib_rules.c
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-02 11:56:04 +00:00
fib_semantics.c
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-02 11:56:04 +00:00
fib_trie.c
memcg: enable accounting for IP address and routing-related objects
2021-07-20 06:00:38 -07:00
fou.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
gre_demux.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
gre_offload.c
ip_gre: add csum offload support for gre header
2021-01-29 20:39:14 -08:00
icmp.c
icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe
2021-10-14 07:54:47 -07:00
igmp.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2021-08-13 06:41:22 -07:00
inet_connection_sock.c
inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
2021-12-03 14:15:07 +00:00
inet_diag.c
net: introduce sk_forward_alloc_get()
2021-10-27 18:20:29 -07:00
inet_fragment.c
inet: frags: batch fqdir destroy works
2020-12-12 15:08:54 -08:00
inet_hashtables.c
tcp: switch orphan_count to bare per-cpu counters
2021-10-15 11:28:34 +01:00
inet_timewait_sock.c
net: Use generic ns_common::count
2020-08-19 14:06:36 +02:00
inetpeer.c
inetpeer: use div64_ul() and clamp_val() calculate inet_peer_threshold
2021-03-01 13:32:12 -08:00
ip_forward.c
…
ip_fragment.c
…
ip_gre.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ip_input.c
net: use indirect call helpers for dst_input
2021-02-03 14:51:39 -08:00
ip_options.c
net: clean up codestyle for net/ipv4
2020-08-25 06:28:02 -07:00
ip_output.c
net: ipv4: Fix the warning for dereference
2021-08-30 12:47:09 +01:00
ip_sockglue.c
ipv4: guard IP_MINTTL with a static key
2021-10-25 18:02:14 -07:00
ip_tunnel_core.c
net: ip_tunnel: clean up endianness conversions
2021-01-08 19:25:35 -08:00
ip_tunnel.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ip_vti.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ipcomp.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
ipconfig.c
net: ipconfig: Release the rtnl_lock while waiting for carrier
2021-10-28 14:36:41 +01:00
ipip.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ipmr_base.c
…
ipmr.c
ipmr: Fix indentation issue
2021-07-07 20:52:25 -07:00
Kconfig
net: ipv4: remove duplicate "the the" phrase in Kconfig text
2020-08-18 16:02:16 -07:00
Makefile
bpf: Clean up sockmap related Kconfigs
2021-02-26 12:28:03 -08:00
metrics.c
treewide: rename nla_strlcpy to nla_strscpy.
2020-11-16 08:08:54 -08:00
netfilter.c
netfilter: Dissect flow after packet mangling
2021-04-18 22:04:16 +02:00
netlink.c
…
nexthop.c
net: nexthop: fix null pointer dereference when IPv6 is not enabled
2021-11-23 11:39:53 +00:00
ping.c
Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""
2021-09-14 14:24:31 +01:00
proc.c
tcp: switch orphan_count to bare per-cpu counters
2021-10-15 11:28:34 +01:00
protocol.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
raw_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
raw.c
Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""
2021-09-14 14:24:31 +01:00
route.c
net/ipv4/route.c: remove superfluous header files from route.c
2021-09-20 13:09:06 +01:00
syncookies.c
net/ipv4/syncookies.c: remove superfluous header files from syncookies.c
2021-09-21 10:48:47 +01:00
sysctl_net_ipv4.c
tcp: remove sk_{tr}x_skb_cache
2021-09-23 12:50:26 +01:00
tcp_bbr.c
bpf: Enable TCP congestion control kfunc from modules
2021-10-05 17:07:41 -07:00
tcp_bic.c
…
tcp_bpf.c
bpf, sockmap: Fix race in ingress receive verdict with redirect to self
2021-11-09 00:58:26 +01:00
tcp_cdg.c
…
tcp_cong.c
net: Only allow init netns to set default tcp cong to a restricted algo
2021-05-04 11:58:28 -07:00
tcp_cubic.c
tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
2021-11-24 17:26:05 -08:00
tcp_dctcp.c
bpf: Enable TCP congestion control kfunc from modules
2021-10-05 17:07:41 -07:00
tcp_dctcp.h
…
tcp_diag.c
…
tcp_fastopen.c
net/ipv4/tcp_fastopen.c: remove superfluous header files from tcp_fastopen.c
2021-09-20 13:09:06 +01:00
tcp_highspeed.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_htcp.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_hybla.c
…
tcp_illinois.c
…
tcp_input.c
tcp: adjust rcv_ssthresh according to sk_reserved_mem
2021-09-30 13:36:46 +01:00
tcp_ipv4.c
ipv4: guard IP_MINTTL with a static key
2021-10-25 18:02:14 -07:00
tcp_lp.c
ipv4: tcp_lp.c: Couple of typo fixes
2021-03-28 17:31:13 -07:00
tcp_metrics.c
Merge tag 'fixes-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux
2020-12-14 16:40:27 -08:00
tcp_minisocks.c
tcp: fix another uninit-value (sk_rx_queue_mapping)
2021-12-03 14:15:49 +00:00
tcp_nv.c
net/ipv4/tcp_nv.c: remove superfluous header files from tcp_nv.c
2021-09-27 12:47:39 +01:00
tcp_offload.c
net, gro: Set inner transport header offset in tcp/udp GRO hook
2021-08-02 10:20:56 +01:00
tcp_output.c
tcp: Use BIT() for OPTION_* constants
2021-11-04 11:26:15 +00:00
tcp_rate.c
tcp: tracking packets with CE marks in BW rate sample
2021-09-24 14:16:40 +01:00
tcp_recovery.c
tcp: more accurately check DSACKs to grow RACK reordering window
2021-07-27 20:07:21 +01:00
tcp_scalable.c
net: ipv4: delete repeated words
2020-08-24 17:31:20 -07:00
tcp_timer.c
net: sock: introduce sk_error_report
2021-06-29 11:28:21 -07:00
tcp_ulp.c
…
tcp_vegas.c
tcp: use semicolons rather than commas to separate statements
2020-10-13 17:11:52 -07:00
tcp_vegas.h
…
tcp_veno.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_westwood.c
…
tcp_yeah.c
tcp_yeah: check struct yeah size at compile time
2021-06-29 11:54:36 -07:00
tcp.c
tcp: Fix uninitialized access in skb frags array for Rx 0cp.
2021-11-12 20:13:28 -08:00
tunnel4.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
udp_bpf.c
net: Implement ->sock_is_readable() for UDP and AF_UNIX
2021-10-26 12:29:33 -07:00
udp_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
udp_impl.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
udp_offload.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
udp_tunnel_core.c
net/ipv4/udp_tunnel_core.c: remove superfluous header files from udp_tunnel_core.c
2021-09-21 10:17:20 +01:00
udp_tunnel_nic.c
udp_tunnel: Fix udp_tunnel_nic work-queue type
2021-09-13 12:38:45 +01:00
udp_tunnel_stub.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp.c
udp: Validate checksum in udp_read_sock()
2021-11-16 13:18:23 +01:00
udplite.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
xfrm4_input.c
xfrm: state: remove extract_input indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_output.c
xfrm: fix unused variable warning if CONFIG_NETFILTER=n
2020-05-11 15:12:27 +02:00
xfrm4_policy.c
…
xfrm4_protocol.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
xfrm4_state.c
xfrm: remove output_finish indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c
net/ipv4/xfrm4_tunnel.c: remove superfluous header files from xfrm4_tunnel.c
2021-09-23 10:10:00 +02:00