lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 11 Jun 2019 08:26:48 +1000 From: Jonathan Maxwell <jmaxwell37@...il.com> To: Eric Dumazet <edumazet@...gle.com> Cc: "David S . Miller" <davem@...emloft.net>, netdev <netdev@...r.kernel.org>, Eric Dumazet <eric.dumazet@...il.com> Subject: Re: [PATCH net-next] tcp: take care of SYN_RECV sockets in tcp_v4_send_ack() and tcp_v6_send_response() Thanks for fixing that Eric. On Tue, Jun 11, 2019 at 7:45 AM Eric Dumazet <edumazet@...gle.com> wrote: > > TCP can send ACK packets on behalf of SYN_RECV sockets. > > tcp_v4_send_ack() and tcp_v6_send_response() incorrectly > dereference sk->sk_mark for non TIME_WAIT sockets. > > This field is not defined for SYN_RECV sockets. > > Using sk_to_full_sk() should get back to the listener socket. > > Note that this also provides a socket pointer to sock_net_uid() calls. > > Fixes: 00483690552c ("tcp: Add mark for TIMEWAIT sockets") > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Cc: Jon Maxwell <jmaxwell37@...il.com> > --- > net/ipv4/tcp_ipv4.c | 6 ++++-- > net/ipv6/tcp_ipv6.c | 1 + > 2 files changed, 5 insertions(+), 2 deletions(-) > > diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c > index f059fbd81a84314ae6fef37f600b0cf28bd2ad30..2bb27d5eae78efdff52a741904d7526a234595d8 100644 > --- a/net/ipv4/tcp_ipv4.c > +++ b/net/ipv4/tcp_ipv4.c > @@ -856,12 +856,14 @@ static void tcp_v4_send_ack(const struct sock *sk, > if (oif) > arg.bound_dev_if = oif; > arg.tos = tos; > - arg.uid = sock_net_uid(net, sk_fullsock(sk) ? sk : NULL); > local_bh_disable(); > ctl_sk = this_cpu_read(*net->ipv4.tcp_sk); > - if (sk) > + if (sk) { > + sk = sk_to_full_sk(sk); > ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ? > inet_twsk(sk)->tw_mark : sk->sk_mark; > + } > + arg.uid = sock_net_uid(net, sk_fullsock(sk) ? sk : NULL); > ip_send_unicast_reply(ctl_sk, > skb, &TCP_SKB_CB(skb)->header.h4.opt, > ip_hdr(skb)->saddr, ip_hdr(skb)->daddr, > diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c > index ad7039137a20f9ad8581d9ca01347c67aa8a8433..ea4dd988bc7f9a90e0d95283e10db5a517a59027 100644 > --- a/net/ipv6/tcp_ipv6.c > +++ b/net/ipv6/tcp_ipv6.c > @@ -884,6 +884,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 > } > > if (sk) { > + sk = sk_to_full_sk(sk); > if (sk->sk_state == TCP_TIME_WAIT) { > mark = inet_twsk(sk)->tw_mark; > /* autoflowlabel relies on buff->hash */ > -- > 2.22.0.rc2.383.gf4fbbf30c2-goog >
Powered by blists - more mailing lists