netdev - [TCP]: TCP_DEFER_ACCEPT causes leak sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Jun 2008 16:58:40 +0400
From:	Vitaliy Gusev <vgusev@...nvz.org>
To:	David Miller <davem@...emloft.net>
Cc:	Patrick McManus <mcmanus@...ksong.com>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	Pavel Emelyanov <xemul@...nvz.org>, netdev@...r.kernel.org
Subject: [TCP]: TCP_DEFER_ACCEPT causes leak sockets

Hello!

While testing network namespace with 2.6.26 OpenVZ kernel port I found
some problem with the patch commit ec3c0982a2dd1e671bad8e9d26c28dcba0039d87 
("[TCP]: TCP_DEFER_ACCEPT updates - process as established")


>--- a/net/ipv4/tcp_timer.c
>+++ b/net/ipv4/tcp_timer.c
>@@ -481,6 +481,11 @@ static void tcp_keepalive_timer (unsigned long data)
> 		goto death;
> 	}
> 
>+	if (tp->defer_tcp_accept.request && sk->sk_state == TCP_ESTABLISHED) {
>+		tcp_send_active_reset(sk, GFP_ATOMIC);
>+		goto death;

Here socket sk is not attached to listening socket's request queue. tcp_done() 
will not call inet_csk_destroy_sock() (and tcp_v4_destroy_sock() which should 
release this sk) as socket is not DEAD. Therefore socket sk will be lost for 
freeing.

>+	}
>+
> 	if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
> 		goto out;
>
>diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
>index 0ba6e91..167a0f5 100644
>--- a/net/ipv4/tcp_ipv4.c
>+++ b/net/ipv4/tcp_ipv4.c
>@@ -1920,6 +1920,14 @@ int tcp_v4_destroy_sock(struct sock *sk)
> 		sk->sk_sndmsg_page = NULL;
> 	}
> 
>+	if (tp->defer_tcp_accept.request) {
>+		reqsk_free(tp->defer_tcp_accept.request);
>+		sock_put(tp->defer_tcp_accept.listen_sk);
>+		sock_put(sk);
>+		tp->defer_tcp_accept.listen_sk = NULL;
>+		tp->defer_tcp_accept.request = NULL;
>+	}
>+
> 	atomic_dec(&tcp_sockets_allocated);
> 
> 	return 0;

I asked Alexey Kuznetsov about this problem and he answered he didn't know 
what to do yet.

-- 
Thank,
Vitaliy Gusev
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html