netdev - Re: [PATCH net] tcp: cleanup copied_seq and urg_data in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180708.165754.1627912530912490352.davem@davemloft.net>
Date:   Sun, 08 Jul 2018 16:57:54 +0900 (KST)
From:   David Miller <davem@...emloft.net>
To:     edumazet@...gle.com
Cc:     netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net] tcp: cleanup copied_seq and urg_data in
 tcp_disconnect

From: Eric Dumazet <edumazet@...gle.com>
Date: Sat,  7 Jul 2018 23:00:01 -0700

> tcp_zerocopy_receive() relies on tcp_inq() to limit number of bytes
> requested by user.
> 
> syzbot found that after tcp_disconnect(), tcp_inq() was returning
> a stale value (number of bytes in queue before the disconnect).
> 
> Note that after this patch, ioctl(fd, SIOCINQ, &val) is also fixed
> and returns 0, so this might be a candidate for all known linux kernels.

Ok I'll queue this up for -stable.

> While we are at this, we probably also should clear urg_data to
> avoid other syzkaller reports after it discovers how to deal with
> urgent data.
> 
> syzkaller repro :
> 
> socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
> bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0
> connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
> send(3, ..., 4096, 0) = 4096
> connect(3, {sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, 128) = 0
> getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, ..., [16]) = 0 // CRASH
> 
> Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: syzbot <syzkaller@...glegroups.com>

Applied, thanks Eric.