linux-kernel - Re: [PATCH net] tcp: check if skb is true to avoid crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <28c0330f1d1827fb61eee26a697cc7cf4735fb15.camel@mediatek.com>
Date: Thu, 26 Sep 2024 14:04:57 +0000
From: Lena Wang (王娜) <Lena.Wang@...iatek.com>
To: "edumazet@...gle.com" <edumazet@...gle.com>
CC: "davem@...emloft.net" <davem@...emloft.net>, "kuba@...nel.org"
	<kuba@...nel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "pabeni@...hat.com" <pabeni@...hat.com>,
	"dsahern@...nel.org" <dsahern@...nel.org>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
Subject: Re: [PATCH net] tcp: check if skb is true to avoid crash

On Thu, 2024-09-26 at 11:07 +0200, Eric Dumazet wrote:
>  	 
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
>  On Thu, Sep 26, 2024 at 9:55 AM Lena Wang <lena.wang@...iatek.com>
> wrote:
> >
> > A kernel NULL pointer dereference reported.
> > Backtrace:
> > vmlinux tcp_can_coalesce_send_queue_head(sk=0xFFFFFF80316D9400,
> len=755)
> > + 28 </alps/OfficialRelease/Of/alps/kernel-
> 6.6/net/ipv4/tcp_output.c:2315>
> > vmlinux  tcp_mtu_probe(sk=0xFFFFFF80316D9400) + 3196
> > </alps/OfficialRelease/Of/alps/kernel-
> 6.6/net/ipv4/tcp_output.c:2452>
> > vmlinux  tcp_write_xmit(sk=0xFFFFFF80316D9400, mss_now=128,
> > nonagle=-2145862684, push_one=0, gfp=2080) + 3296
> > </alps/OfficialRelease/Of/alps/kernel-
> 6.6/net/ipv4/tcp_output.c:2689>
> > vmlinux  tcp_tsq_write() + 172
> > </alps/OfficialRelease/Of/alps/kernel-
> 6.6/net/ipv4/tcp_output.c:1033>
> > vmlinux  tcp_tsq_handler() + 104
> > </alps/OfficialRelease/Of/alps/kernel-
> 6.6/net/ipv4/tcp_output.c:1042>
> > vmlinux  tcp_tasklet_func() + 208
> >
> > When there is no pending skb in sk->sk_write_queue, tcp_send_head
> > returns NULL. Directly dereference of skb->len will result crash.
> > So it is necessary to evaluate the skb to be true here.
> >
> > Fixes: 808cf9e38cd7 ("tcp: Honor the eor bit in tcp_mtu_probe")
> > Signed-off-by: Lena Wang <lena.wang@...iatek.com>
> > ---
> 
> I am not sure why tcp_send_head() can return NULL.
> 
> Before tcp_can_coalesce_send_queue_head() is called, we have this
> code :
> 
> size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
> 
> /* Have enough data in the send queue to probe? */
> if (tp->write_seq - tp->snd_nxt < size_needed)
>     return -1;
> 
> 
> 
> Do you have a repro ?
Hi Eric,
It just happens once in monkey test. I can't reproduce it.

from the dump log, it can see these values:
(gdb) p tp->reordering
$16 = 4
(gdb) p tp->mss_cache
$17 = 128
probe_size = 755
size_needed = 755 + (4+1)*128 = 1395

(gdb) p tp->write_seq
$18 = 1571343838
(gdb) p tp->snd_nxt
$19 = 1571336917 
tp->write_seq - tp->snd_nxt = 1571343838 - 1571336917 = 6921 > 1395