lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 5 Mar 2017 08:58:42 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Eric Dumazet <eric.dumazet@...il.com>,
        David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH net] tcp: fix various issues for sockets morphing to
 listen state

On Sun, Mar 5, 2017 at 4:00 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> On Fri, Mar 3, 2017 at 11:08 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
>> From: Eric Dumazet <edumazet@...gle.com>
>>
>> Dmitry Vyukov reported a divide by 0 triggered by syzkaller, exploiting
>> tcp_disconnect() path that was never really considered and/or used
>> before syzkaller ;)
>>
>> I was not able to reproduce the bug, but it seems issues here are the
>> three possible actions that assumed they would never trigger on a
>> listener.
>>
>> 1) tcp_write_timer_handler
>> 2) tcp_delack_timer_handler
>> 3) MTU reduction
>>
>> Only IPv6 MTU reduction was properly testing TCP_CLOSE and TCP_LISTEN
>>  states from tcp_v6_mtu_reduced()
>
> I've run the test as "while ./a.out; do true; done". I've also noticed
> that it either reproduces very quickly or does not happen at all. So I
> rebooted machine, run the program in loop and then repeated if it does
> not happen within seconds.

Yes, I was also doing this.

What I noticed is that your program did not use SO_REUSEADDR, meaning
the second (and later) bind() syscall would fail.

Maybe some sysctl difference between your host and mine....

>
> Retested with your patch, seems to not crash anymore.
>
Thanks for testing !

Powered by blists - more mailing lists