netdev - Re: [PATCH net] tcp: fix various issues for sockets morphing to listen state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKaXGJnLAKubNG4h8wPECnoMttLDyWmRHgnGD+Unhew-Q@mail.gmail.com>
Date:   Sun, 5 Mar 2017 08:58:42 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Eric Dumazet <eric.dumazet@...il.com>,
        David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH net] tcp: fix various issues for sockets morphing to
 listen state

On Sun, Mar 5, 2017 at 4:00 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> On Fri, Mar 3, 2017 at 11:08 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
>> From: Eric Dumazet <edumazet@...gle.com>
>>
>> Dmitry Vyukov reported a divide by 0 triggered by syzkaller, exploiting
>> tcp_disconnect() path that was never really considered and/or used
>> before syzkaller ;)
>>
>> I was not able to reproduce the bug, but it seems issues here are the
>> three possible actions that assumed they would never trigger on a
>> listener.
>>
>> 1) tcp_write_timer_handler
>> 2) tcp_delack_timer_handler
>> 3) MTU reduction
>>
>> Only IPv6 MTU reduction was properly testing TCP_CLOSE and TCP_LISTEN
>>  states from tcp_v6_mtu_reduced()
>
> I've run the test as "while ./a.out; do true; done". I've also noticed
> that it either reproduces very quickly or does not happen at all. So I
> rebooted machine, run the program in loop and then repeated if it does
> not happen within seconds.

Yes, I was also doing this.

What I noticed is that your program did not use SO_REUSEADDR, meaning
the second (and later) bind() syscall would fail.

Maybe some sysctl difference between your host and mine....

>
> Retested with your patch, seems to not crash anymore.
>
Thanks for testing !