linux-kernel - Re: [PATCH] nvmet-tcp: don't restore null sk_state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKmqyKMby=+0-dwCeVGYS5rPqGqS26yabbw1K6Kg_j3NdGXMLQ@mail.gmail.com>
Date: Thu, 24 Apr 2025 08:36:57 +1000
From: Alistair Francis <alistair23@...il.com>
To: Hannes Reinecke <hare@...e.de>
Cc: hch@....de, sagi@...mberg.me, kch@...dia.com, 
	linux-nvme@...ts.infradead.org, linux-kernel@...r.kernel.org, 
	csander@...estorage.com, shinichiro.kawasaki@....com, 
	Alistair Francis <alistair.francis@....com>
Subject: Re: [PATCH] nvmet-tcp: don't restore null sk_state_change

On Thu, Apr 24, 2025 at 7:47 AM Alistair Francis <alistair23@...il.com> wrote:
>
> On Wed, Apr 23, 2025 at 4:21 PM Hannes Reinecke <hare@...e.de> wrote:
> >
> > On 4/23/25 08:06, Alistair Francis wrote:
> > > queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if
> > > the TCP connection isn't established when nvmet_tcp_set_queue_sock() is
> > > called then queue->state_change isn't set and sock->sk->sk_state_change
> > > isn't replaced.
> > >
> > > As such we don't need to restore sock->sk->sk_state_change if
> > > queue->state_change is NULL.
> > >
> > Good catch!
> >
> > [ .. ]
> >
> > > Resolves: https://lore.kernel.org/linux-nvme/5hdonndzoqa265oq3bj6iarwtfk5dewxxjtbjvn5uqnwclpwt6@a2n6w3taxxex/
> > > Signed-off-by: Alistair Francis <alistair.francis@....com>
> > > ---
> > > We could also remove the `sock->sk->sk_state != TCP_ESTABLISHED` check
> > > in nvmet_tcp_set_queue_sock() if that's prefered.

Actually that by itself isn't enough to fix the NULL dereference. We
still need the NULL check from this patch.

So I think this patch as it currently is should be the fix

Alistair

> > >
> > Please do.
> > We cannot influence what the network stack did, so if there ever were a
> > modification which caused the ->state_change callback _not_ to be set
> > the whole issue pops up again.
>
> If queue->state_change isn't set for any other reason this patch
> should also work, but I'll remove the `sock->sk->sk_state !=
> TCP_ESTABLISHED` check as well
>
> Alistair
>
> >
> > Cheers,
> >
> > Hannes
> > --
> > Dr. Hannes Reinecke                  Kernel Storage Architect
> > hare@...e.de                                +49 911 74053 688
> > SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
> > HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich