linux-kernel - Re: [syzbot] [net?] WARNING in inet_csk_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20231108174525.1452-1-kuniyu@amazon.com>
Date:   Wed, 8 Nov 2023 09:45:25 -0800
From:   Kuniyuki Iwashima <kuniyu@...zon.com>
To:     <dw@...idwei.uk>
CC:     <avagin@...il.com>, <davem@...emloft.net>, <dsahern@...nel.org>,
        <edumazet@...gle.com>, <kuba@...nel.org>, <kuniyu@...zon.com>,
        <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
        <pabeni@...hat.com>,
        <syzbot+71e724675ba3958edb31@...kaller.appspotmail.com>,
        <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [net?] WARNING in inet_csk_get_port (2)

From: David Wei <dw@...idwei.uk>
Date: Wed, 8 Nov 2023 08:11:56 -0800
> On 2023-09-20 11:59, Kuniyuki Iwashima wrote:
> > From: syzbot <syzbot+71e724675ba3958edb31@...kaller.appspotmail.com>
> > Date: Wed, 20 Sep 2023 11:02:55 -0700
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit:    2cf0f7156238 Merge tag 'nfs-for-6.6-2' of git://git.linux-..
> >> git tree:       upstream
> >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=17405ab0680000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=d594086f139d167
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=71e724675ba3958edb31
> >> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16b2e118680000
> >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=127b55c4680000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/456b02029fa8/disk-2cf0f715.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/9f9ff0c00454/vmlinux-2cf0f715.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/0ede19fba30f/bzImage-2cf0f715.xz
> >>
> >> The issue was bisected to:
> >>
> >> commit c48ef9c4aed3632566b57ba66cec6ec78624d4cb
> >> Author: Kuniyuki Iwashima <kuniyu@...zon.com>
> >> Date:   Mon Sep 11 18:36:57 2023 +0000
> >>
> >>     tcp: Fix bind() regression for v4-mapped-v6 non-wildcard address.
> >>
> > 
> > We need this condition to put v4 sk and v4-mapped-v6 sk into
> > the same bucket.
> > 
> > ---8<---
> > diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
> > index dfb1c61c0c2b..6487357d1ddd 100644
> > --- a/net/ipv4/inet_hashtables.c
> > +++ b/net/ipv4/inet_hashtables.c
> > @@ -822,7 +823,8 @@ static bool inet_bind2_bucket_match(const struct inet_bind2_bucket *tb,
> >  			return ipv6_addr_v4mapped(&tb->v6_rcv_saddr) &&
> >  				tb->v6_rcv_saddr.s6_addr32[3] == sk->sk_rcv_saddr;
> >  
> > -		return false;
> > +		return ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr) &&
> > +			sk->sk_v6_rcv_saddr.s6_addr32[3] == tb->rcv_saddr;
> >  	}
> >  
> >  	if (sk->sk_family == AF_INET6)
> > ---8<---
> > 
> > Scenario is like
> > 
> >   1) bind(v4) creates a tb2 bucket
> >   2) bind(v4-mapped-v6) creates another tb2 bucket
> >   3) listen(v4) finds the second tb2 and trigger warning
> > 
> > ---8<---
> > from socket import *
> > 
> > s = socket()
> > s.setsockopt(SOL_SOCKET, SO_REUSEPORT, 1)
> > s.bind(('255.255.255.255', 0))
> > 
> > s2 = socket(AF_INET6, SOCK_STREAM)
> > s2.setsockopt(SOL_SOCKET, SO_REUSEPORT, 1)
> > s2.bind(('::ffff:255.255.255.255', s.getsockname()[1]))
> > s.listen()
> > ---8<---
> > 
> > Will post a formal patch after doing more tests with SO_REUSEPORT.
> > 
> > Thanks!
> 
> Hi Kuniyuki, did you get around to fixing and posting this patch? I
> couldn't find anything on the mailing list.
> 
> Would you like help fixing this?

Hi,

It's fixed by this patch.
https://lore.kernel.org/netdev/20231010013814.70571-1-kuniyu@amazon.com/

Thanks