mirror of
https://github.com/torvalds/linux.git
synced 2024-12-11 21:52:04 +00:00
fbb8295248
I forgot tcp had per netns tracking of timewait sockets, and their sysctl to change the limit. After0dad4087a8
("tcp/dccp: get rid of inet_twsk_purge()"), whole struct net can be freed before last tw socket is freed. We need to allocate a separate struct inet_timewait_death_row object per netns. tw_count becomes a refcount and gains associated debugging infrastructure. BUG: KASAN: use-after-free in inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46 Read of size 8 at addr ffff88807d5f9f40 by task kworker/1:7/3690 CPU: 1 PID: 3690 Comm: kworker/1:7 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events pwq_unbound_release_workfn Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:lockdep_unregister_key+0x1c9/0x250 kernel/locking/lockdep.c:6328 Code: 00 00 00 48 89 ee e8 46 fd ff ff 4c 89 f7 e8 5e c9 ff ff e8 09 cc ff ff 9c 58 f6 c4 02 75 26 41 f7 c4 00 02 00 00 74 01 fb 5b <5d> 41 5c 41 5d 41 5e 41 5f e9 19 4a 08 00 0f 0b 5b 5d 41 5c 41 5d RSP: 0018:ffffc90004077cb8 EFLAGS: 00000206 RAX: 0000000000000046 RBX: ffff88807b61b498 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888077027128 R08: 0000000000000001 R09: ffffffff8f1ea4fc R10: fffffbfff1ff93ee R11: 000000000000af1e R12: 0000000000000246 R13: 0000000000000000 R14: ffffffff8ffc89b8 R15: ffffffff90157fb0 wq_unregister_lockdep kernel/workqueue.c:3508 [inline] pwq_unbound_release_workfn+0x254/0x340 kernel/workqueue.c:3746 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Allocated by task 3635: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:260 [inline] slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3230 [inline] slab_alloc mm/slub.c:3238 [inline] kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3243 kmem_cache_zalloc include/linux/slab.h:705 [inline] net_alloc net/core/net_namespace.c:407 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:462 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3048 __do_sys_unshare kernel/fork.c:3119 [inline] __se_sys_unshare kernel/fork.c:3117 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88807d5f9a80 which belongs to the cache net_namespace of size 6528 The buggy address is located 1216 bytes inside of 6528-byte region [ffff88807d5f9a80, ffff88807d5fb400) The buggy address belongs to the page: page:ffffea0001f57e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807d5f9a80 pfn:0x7d5f8 head:ffffea0001f57e00 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff888070023001 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffff888010dd4f48 ffffea0001404e08 ffff8880118fd000 raw: ffff88807d5f9a80 0000000000040002 00000001ffffffff ffff888070023001 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3634, ts 119694798460, free_ts 119693556950 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab mm/slub.c:1944 [inline] new_slab+0x28a/0x3b0 mm/slub.c:2004 ___slab_alloc+0x87c/0xe90 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] slab_alloc mm/slub.c:3238 [inline] kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3243 kmem_cache_zalloc include/linux/slab.h:705 [inline] net_alloc net/core/net_namespace.c:407 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:462 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3048 __do_sys_unshare kernel/fork.c:3119 [inline] __se_sys_unshare kernel/fork.c:3117 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 skb_free_head net/core/skbuff.c:655 [inline] skb_release_data+0x65d/0x790 net/core/skbuff.c:677 skb_release_all net/core/skbuff.c:742 [inline] __kfree_skb net/core/skbuff.c:756 [inline] consume_skb net/core/skbuff.c:914 [inline] consume_skb+0xc2/0x160 net/core/skbuff.c:908 skb_free_datagram+0x1b/0x1f0 net/core/datagram.c:325 netlink_recvmsg+0x636/0xea0 net/netlink/af_netlink.c:1998 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88807d5f9e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d5f9e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807d5f9f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807d5f9f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d5fa000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes:0dad4087a8
("tcp/dccp: get rid of inet_twsk_purge()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reported-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Paolo Abeni <pabeni@redhat.com> Link: https://lore.kernel.org/r/20220126180714.845362-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
260 lines
7.8 KiB
C
260 lines
7.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* INET An implementation of the TCP/IP protocol suite for the LINUX
|
|
* operating system. INET is implemented using the BSD Socket
|
|
* interface as the means of communication with the user level.
|
|
*
|
|
* Generic TIME_WAIT sockets functions
|
|
*
|
|
* From code orinally in TCP
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <net/inet_hashtables.h>
|
|
#include <net/inet_timewait_sock.h>
|
|
#include <net/ip.h>
|
|
|
|
|
|
/**
|
|
* inet_twsk_bind_unhash - unhash a timewait socket from bind hash
|
|
* @tw: timewait socket
|
|
* @hashinfo: hashinfo pointer
|
|
*
|
|
* unhash a timewait socket from bind hash, if hashed.
|
|
* bind hash lock must be held by caller.
|
|
* Returns 1 if caller should call inet_twsk_put() after lock release.
|
|
*/
|
|
void inet_twsk_bind_unhash(struct inet_timewait_sock *tw,
|
|
struct inet_hashinfo *hashinfo)
|
|
{
|
|
struct inet_bind_bucket *tb = tw->tw_tb;
|
|
|
|
if (!tb)
|
|
return;
|
|
|
|
__hlist_del(&tw->tw_bind_node);
|
|
tw->tw_tb = NULL;
|
|
inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
|
|
__sock_put((struct sock *)tw);
|
|
}
|
|
|
|
/* Must be called with locally disabled BHs. */
|
|
static void inet_twsk_kill(struct inet_timewait_sock *tw)
|
|
{
|
|
struct inet_hashinfo *hashinfo = tw->tw_dr->hashinfo;
|
|
spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
|
|
struct inet_bind_hashbucket *bhead;
|
|
|
|
spin_lock(lock);
|
|
sk_nulls_del_node_init_rcu((struct sock *)tw);
|
|
spin_unlock(lock);
|
|
|
|
/* Disassociate with bind bucket. */
|
|
bhead = &hashinfo->bhash[tw->tw_bslot];
|
|
|
|
spin_lock(&bhead->lock);
|
|
inet_twsk_bind_unhash(tw, hashinfo);
|
|
spin_unlock(&bhead->lock);
|
|
|
|
if (refcount_dec_and_test(&tw->tw_dr->tw_refcount))
|
|
kfree(tw->tw_dr);
|
|
|
|
inet_twsk_put(tw);
|
|
}
|
|
|
|
void inet_twsk_free(struct inet_timewait_sock *tw)
|
|
{
|
|
struct module *owner = tw->tw_prot->owner;
|
|
twsk_destructor((struct sock *)tw);
|
|
#ifdef SOCK_REFCNT_DEBUG
|
|
pr_debug("%s timewait_sock %p released\n", tw->tw_prot->name, tw);
|
|
#endif
|
|
kmem_cache_free(tw->tw_prot->twsk_prot->twsk_slab, tw);
|
|
module_put(owner);
|
|
}
|
|
|
|
void inet_twsk_put(struct inet_timewait_sock *tw)
|
|
{
|
|
if (refcount_dec_and_test(&tw->tw_refcnt))
|
|
inet_twsk_free(tw);
|
|
}
|
|
EXPORT_SYMBOL_GPL(inet_twsk_put);
|
|
|
|
static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw,
|
|
struct hlist_nulls_head *list)
|
|
{
|
|
hlist_nulls_add_head_rcu(&tw->tw_node, list);
|
|
}
|
|
|
|
static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
|
|
struct hlist_head *list)
|
|
{
|
|
hlist_add_head(&tw->tw_bind_node, list);
|
|
}
|
|
|
|
/*
|
|
* Enter the time wait state. This is called with locally disabled BH.
|
|
* Essentially we whip up a timewait bucket, copy the relevant info into it
|
|
* from the SK, and mess with hash chains and list linkage.
|
|
*/
|
|
void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
|
|
struct inet_hashinfo *hashinfo)
|
|
{
|
|
const struct inet_sock *inet = inet_sk(sk);
|
|
const struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
|
|
spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
|
|
struct inet_bind_hashbucket *bhead;
|
|
/* Step 1: Put TW into bind hash. Original socket stays there too.
|
|
Note, that any socket with inet->num != 0 MUST be bound in
|
|
binding cache, even if it is closed.
|
|
*/
|
|
/* Cache inet_bhashfn(), because 'struct net' might be no longer
|
|
* available later in inet_twsk_kill().
|
|
*/
|
|
tw->tw_bslot = inet_bhashfn(twsk_net(tw), inet->inet_num,
|
|
hashinfo->bhash_size);
|
|
bhead = &hashinfo->bhash[tw->tw_bslot];
|
|
spin_lock(&bhead->lock);
|
|
tw->tw_tb = icsk->icsk_bind_hash;
|
|
WARN_ON(!icsk->icsk_bind_hash);
|
|
inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
|
|
spin_unlock(&bhead->lock);
|
|
|
|
spin_lock(lock);
|
|
|
|
inet_twsk_add_node_rcu(tw, &ehead->chain);
|
|
|
|
/* Step 3: Remove SK from hash chain */
|
|
if (__sk_nulls_del_node_init_rcu(sk))
|
|
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
|
|
|
|
spin_unlock(lock);
|
|
|
|
/* tw_refcnt is set to 3 because we have :
|
|
* - one reference for bhash chain.
|
|
* - one reference for ehash chain.
|
|
* - one reference for timer.
|
|
* We can use atomic_set() because prior spin_lock()/spin_unlock()
|
|
* committed into memory all tw fields.
|
|
* Also note that after this point, we lost our implicit reference
|
|
* so we are not allowed to use tw anymore.
|
|
*/
|
|
refcount_set(&tw->tw_refcnt, 3);
|
|
}
|
|
EXPORT_SYMBOL_GPL(inet_twsk_hashdance);
|
|
|
|
static void tw_timer_handler(struct timer_list *t)
|
|
{
|
|
struct inet_timewait_sock *tw = from_timer(tw, t, tw_timer);
|
|
|
|
inet_twsk_kill(tw);
|
|
}
|
|
|
|
struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
|
|
struct inet_timewait_death_row *dr,
|
|
const int state)
|
|
{
|
|
struct inet_timewait_sock *tw;
|
|
|
|
if (refcount_read(&dr->tw_refcount) - 1 >= dr->sysctl_max_tw_buckets)
|
|
return NULL;
|
|
|
|
tw = kmem_cache_alloc(sk->sk_prot_creator->twsk_prot->twsk_slab,
|
|
GFP_ATOMIC);
|
|
if (tw) {
|
|
const struct inet_sock *inet = inet_sk(sk);
|
|
|
|
tw->tw_dr = dr;
|
|
/* Give us an identity. */
|
|
tw->tw_daddr = inet->inet_daddr;
|
|
tw->tw_rcv_saddr = inet->inet_rcv_saddr;
|
|
tw->tw_bound_dev_if = sk->sk_bound_dev_if;
|
|
tw->tw_tos = inet->tos;
|
|
tw->tw_num = inet->inet_num;
|
|
tw->tw_state = TCP_TIME_WAIT;
|
|
tw->tw_substate = state;
|
|
tw->tw_sport = inet->inet_sport;
|
|
tw->tw_dport = inet->inet_dport;
|
|
tw->tw_family = sk->sk_family;
|
|
tw->tw_reuse = sk->sk_reuse;
|
|
tw->tw_reuseport = sk->sk_reuseport;
|
|
tw->tw_hash = sk->sk_hash;
|
|
tw->tw_ipv6only = 0;
|
|
tw->tw_transparent = inet->transparent;
|
|
tw->tw_prot = sk->sk_prot_creator;
|
|
atomic64_set(&tw->tw_cookie, atomic64_read(&sk->sk_cookie));
|
|
twsk_net_set(tw, sock_net(sk));
|
|
timer_setup(&tw->tw_timer, tw_timer_handler, TIMER_PINNED);
|
|
/*
|
|
* Because we use RCU lookups, we should not set tw_refcnt
|
|
* to a non null value before everything is setup for this
|
|
* timewait socket.
|
|
*/
|
|
refcount_set(&tw->tw_refcnt, 0);
|
|
|
|
__module_get(tw->tw_prot->owner);
|
|
}
|
|
|
|
return tw;
|
|
}
|
|
EXPORT_SYMBOL_GPL(inet_twsk_alloc);
|
|
|
|
/* These are always called from BH context. See callers in
|
|
* tcp_input.c to verify this.
|
|
*/
|
|
|
|
/* This is for handling early-kills of TIME_WAIT sockets.
|
|
* Warning : consume reference.
|
|
* Caller should not access tw anymore.
|
|
*/
|
|
void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
|
|
{
|
|
if (del_timer_sync(&tw->tw_timer))
|
|
inet_twsk_kill(tw);
|
|
inet_twsk_put(tw);
|
|
}
|
|
EXPORT_SYMBOL(inet_twsk_deschedule_put);
|
|
|
|
void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, bool rearm)
|
|
{
|
|
/* timeout := RTO * 3.5
|
|
*
|
|
* 3.5 = 1+2+0.5 to wait for two retransmits.
|
|
*
|
|
* RATIONALE: if FIN arrived and we entered TIME-WAIT state,
|
|
* our ACK acking that FIN can be lost. If N subsequent retransmitted
|
|
* FINs (or previous seqments) are lost (probability of such event
|
|
* is p^(N+1), where p is probability to lose single packet and
|
|
* time to detect the loss is about RTO*(2^N - 1) with exponential
|
|
* backoff). Normal timewait length is calculated so, that we
|
|
* waited at least for one retransmitted FIN (maximal RTO is 120sec).
|
|
* [ BTW Linux. following BSD, violates this requirement waiting
|
|
* only for 60sec, we should wait at least for 240 secs.
|
|
* Well, 240 consumes too much of resources 8)
|
|
* ]
|
|
* This interval is not reduced to catch old duplicate and
|
|
* responces to our wandering segments living for two MSLs.
|
|
* However, if we use PAWS to detect
|
|
* old duplicates, we can reduce the interval to bounds required
|
|
* by RTO, rather than MSL. So, if peer understands PAWS, we
|
|
* kill tw bucket after 3.5*RTO (it is important that this number
|
|
* is greater than TS tick!) and detect old duplicates with help
|
|
* of PAWS.
|
|
*/
|
|
|
|
if (!rearm) {
|
|
bool kill = timeo <= 4*HZ;
|
|
|
|
__NET_INC_STATS(twsk_net(tw), kill ? LINUX_MIB_TIMEWAITKILLED :
|
|
LINUX_MIB_TIMEWAITED);
|
|
BUG_ON(mod_timer(&tw->tw_timer, jiffies + timeo));
|
|
refcount_inc(&tw->tw_dr->tw_refcount);
|
|
} else {
|
|
mod_timer_pending(&tw->tw_timer, jiffies + timeo);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL_GPL(__inet_twsk_schedule);
|